谁写过HOOK IAT,请赐教!谢谢!
我自己用Delphi写了个,可惜没hook成功,也不知道是哪出了问题,请各位帮忙看看咯。谢谢!
API HOOK.rar
(344.51 KB)
程序代码:
unit Unit1; interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls,TLHelp32,ImageHlp, ExtCtrls, ComCtrls,JwaWinNT; type TForm1 = class(TForm) Panel1: TPanel; Button1: TButton; procedure Button1Click(Sender: TObject); private { Private declarations } public { Public declarations } end; type pFunction=function(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall; var Form1: TForm1; pThunk:PIMAGE_THUNK_DATA; function MessageBoxB(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall; procedure HookFunction(hFormModule:HMODULE; pStrFunctionModule, pStrFunctionName:pchar;pNewFunction:Pointer); implementation {$R *.dfm} procedure HookFunction(hFormModule:HMODULE; pStrFunctionModule, pStrFunctionName:pchar;pNewFunction:Pointer); var pid:PIMAGE_IMPORT_DESCRIPTOR; //pThunk:PIMAGE_THUNK_DATA; uSize:ULONG; dllName:String; originalProc,pFunc:FARPROC; memoryInfo:MEMORY_BASIC_INFORMATION; lpflOldProtect:DWord; error:DWORD; lpNumberOfBytesWritten,Protect: DWORD; msgbox:pFunction; begin pid:=PIMAGE_IMPORT_DESCRIPTOR(ImageDirectoryEntryToData(Pointer(hFormModule), True,IMAGE_DIRECTORY_ENTRY_IMPORT,uSize)); if pid=nil then exit; while pid<>nil do begin dllName:=PChar(hFormModule+pid^.Name); if dllName=pStrFunctionModule then break; inc(pid); end; if pid^.Name=0 then exit; pThunk:=PIMAGE_THUNK_DATA(hFormModule+pid^.FirstThunk); originalProc:=GetProcAddress(GetModuleHandle(pStrFunctionModule),'MessageBoxA'); while pThunk^.Function_<>0 do begin if pThunk^.Function_=DWORD(originalProc) then break; inc(pThunk^.Function_); end; VirtualQuery(@pThunk^.Function_,memoryInfo,SizeOf(memoryInfo)); if not VirtualProtect(memoryInfo.BaseAddress,memoryInfo.RegionSize, PAGE_READWRITE,Pointer(@memoryInfo.Protect)) then begin exit; end; pThunk^.Function_:=DWORD(pNewFunction); //WriteProcessMemory(GetCurrentProcess,@pThunk^.Function_,@pNewFunction,4,lpNumberOfBytesWritten); //if not WriteProcessMemory(GetCurrentProcess,@pThunk^.Function_, //@pNewFunction,4,lpNumberOfBytesWritten) then begin //exit; //end; if not VirtualProtect(memoryInfo.BaseAddress,memoryInfo.RegionSize, PAGE_READONLY,@Protect) then begin exit; end; end; function MessageBoxB(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall; begin exit; end; procedure TForm1.Button1Click(Sender: TObject); begin HookFunction(hInstance,'user32.dll','MessageBoxA',@MessageBoxB); MessageBoxA(0,'xx','xx',mb_ok); end; end. (*function HookAPIFunction(hFromModule: HMODULE;pszFunctionModule: PAnsiChar; pszFunctionName: PAnsiChar;pfnNewProc: Pointer): Pointer; var pfnOriginalProc: Pointer; pDosHeader: PImageDosHeader; pNTHeader: PImageNtHeaders; pImportDesc: PImage_Import_Descriptor; pThunk: PImageThunkData; dwProtectionFlags,dwScratch: DWORD; pszModName: PAnsiChar; memInfo:TMemoryBasicInformation; xxx:array[0..1024] of char; func:Pointer; begin Result := nil; pfnOriginalProc := GetProcAddress(GetModuleHandle(pszFunctionModule),pszFunctionName); pDosHeader := PImageDosHeader(hFromModule); pNTHeader := PImageNTHeaders(DWORD(pDosHeader)+DWORD(pDosHeader^.e_lfanew)); pImportDesc := PImage_Import_Descriptor(DWORD(pDosHeader)+ DWORD(pNTHeader^.OptionalHeader. DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]. VirtualAddress)); while pImportDesc^.Name <> 0 do begin pszModName := PAnsiChar(Pointer(DWORD(pDosHeader) + DWORD(pImportDesc^.Name))); if LowerCase(pszModName) = LowerCase(pszFunctionModule) then Break; Inc(pImportDesc); end; if pImportDesc^.Name = 0 then Exit; pThunk := PImageThunkData(DWORD(pDosHeader) + DWORD(pImportDesc^.FirstThunk)); while pThunk^.Function_ <> 0 do begin if (pThunk^.Function_ = DWORD(pfnOriginalProc)) then begin VirtualQuery(@pThunk^.Function_,memInfo,SizeOf(memInfo)); if true then begin dwProtectionFlags := PAGE_READWRITE; if VirtualProtect(@pThunk^.Function_,4,PAGE_EXECUTE_READWRITE,@dwScratch) then pThunk^.Function_ := DWORD(pfnNewProc); //func:=@MessageBoxB; //WriteProcessMemory(GetCurrentProcess(), @pThunk^.Function_, @pfnNewProc, 4, dwScratch); Result := pfnOriginalProc ; Break; end; end; Inc(pThunk); end; end;*)