API HOOK.rar (344.63 KB)

程序代码：

while pThunk^.Function_<>0 do begin
          if pThunk^.Function_=DWORD(originalProc) then break;
          inc(pThunk^.Function_);
end;

while pThunk<>nil do begin
          if pThunk^.Function_=DWORD(originalProc) then break;
          inc(DWORD(pThunk), SizeOf(IMAGE_THUNK_DATA));
    end;

程序代码：

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls,TLHelp32,ImageHlp, ExtCtrls, ComCtrls,JwaWinNT;

type
  TForm1 = class(TForm)
    Panel1: TPanel;
    Button1: TButton;
    Button2: TButton;
    procedure Button1Click(Sender: TObject);
    procedure Button2Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;


type
    pFunction=function(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall;
var
  Form1: TForm1;
  pThunk:PIMAGE_THUNK_DATA;
  function MessageBoxB(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall;
  procedure HookFunction(hFormModule:HMODULE; pStrFunctionModule,
                         pStrFunctionName:pchar;pNewFunction:Pointer);
implementation

{$R *.dfm}

procedure HookFunction(hFormModule:HMODULE; pStrFunctionModule,
                       pStrFunctionName:pchar;pNewFunction:Pointer);
type
    pDword=^DWORD;
var
    pid:PIMAGE_IMPORT_DESCRIPTOR;
    //pThunk:PIMAGE_THUNK_DATA;
    uSize:ULONG;
    dllName:String;
    originalProc,pFunc:FARPROC;
    memoryInfo:MEMORY_BASIC_INFORMATION;
    lpflOldProtect:DWord;
    error:DWORD;
    lpNumberOfBytesWritten,Protect: DWORD;
    msgbox:pFunction;
begin
    pid:=PIMAGE_IMPORT_DESCRIPTOR(ImageDirectoryEntryToData(Pointer(hFormModule),
                                  True,IMAGE_DIRECTORY_ENTRY_IMPORT,uSize));
    if pid=nil then exit;
    while pid<>nil do begin
          dllName:=PChar(hFormModule+pid^.Name);
          //if dllName=pStrFunctionModule then break;
          if StrIComp(PCHAR(dllName),pStrFunctionModule)=0 then break;
          inc(DWORD(pid), SizeOf(IMAGE_IMPORT_DESCRIPTOR));
    end;
    if pid^.Name=0 then exit;
    pThunk:=PIMAGE_THUNK_DATA(hFormModule+pid^.FirstThunk);
    originalProc:=GetProcAddress(GetModuleHandle(pStrFunctionModule),'MessageBoxW');
    while pThunk<>nil do begin
          if pThunk^.Function_=DWORD(originalProc) then break;
          inc(DWORD(pThunk), SizeOf(IMAGE_THUNK_DATA));
    end;
    VirtualQuery(@pThunk^.Function_,memoryInfo,SizeOf(memoryInfo));
    if not VirtualProtect(memoryInfo.BaseAddress,memoryInfo.RegionSize,
                          PAGE_READWRITE,Pointer(@memoryInfo.Protect)) then begin
      exit;
    end;
    pThunk^.Function_:=DWORD(pNewFunction);
    if not VirtualProtect(memoryInfo.BaseAddress,memoryInfo.RegionSize,
           PAGE_READONLY,@Protect) then begin
        exit;
    end;
end;

function MessageBoxB(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall;
begin
     Form1.Caption:='hook ok';
end;

procedure TForm1.Button1Click(Sender: TObject);
begin
     MessageBoxW(0,'original','original',mb_ok);
     HookFunction(hInstance,'user32.dll','MessageBoxW',@MessageBoxB);
     //MessageBoxW(0,'xx','xx',mb_ok);
end;

procedure TForm1.Button2Click(Sender: TObject);
begin
     MessageBoxW(0,'xx','xx',mb_ok);
end;

end.


















(*function HookAPIFunction(hFromModule: HMODULE;pszFunctionModule: PAnsiChar;
  pszFunctionName: PAnsiChar;pfnNewProc: Pointer): Pointer;
var
  pfnOriginalProc: Pointer;
  pDosHeader: PImageDosHeader;
  pNTHeader: PImageNtHeaders;
  pImportDesc: PImage_Import_Descriptor;
  pThunk: PImageThunkData;
  dwProtectionFlags,dwScratch: DWORD;
  pszModName: PAnsiChar;
  memInfo:TMemoryBasicInformation;
  xxx:array[0..1024] of char;
  func:Pointer;
begin
  Result := nil;
  pfnOriginalProc := GetProcAddress(GetModuleHandle(pszFunctionModule),pszFunctionName);
  pDosHeader := PImageDosHeader(hFromModule);
  pNTHeader := PImageNTHeaders(DWORD(pDosHeader)+DWORD(pDosHeader^.e_lfanew));
  pImportDesc := PImage_Import_Descriptor(DWORD(pDosHeader)+
                                        DWORD(pNTHeader^.OptionalHeader.
                                        DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].
                                        VirtualAddress));
  while pImportDesc^.Name <> 0 do
  begin
    pszModName := PAnsiChar(Pointer(DWORD(pDosHeader) + DWORD(pImportDesc^.Name)));
    if LowerCase(pszModName) = LowerCase(pszFunctionModule) then Break;
    Inc(pImportDesc);
  end;
  if pImportDesc^.Name = 0 then Exit;
  pThunk := PImageThunkData(DWORD(pDosHeader) + DWORD(pImportDesc^.FirstThunk));
  while pThunk^.Function_ <> 0 do
  begin
    if (pThunk^.Function_ = DWORD(pfnOriginalProc)) then

    begin
      VirtualQuery(@pThunk^.Function_,memInfo,SizeOf(memInfo));
      if true then begin
      dwProtectionFlags := PAGE_READWRITE;
      if VirtualProtect(@pThunk^.Function_,4,PAGE_EXECUTE_READWRITE,@dwScratch) then
      pThunk^.Function_ := DWORD(pfnNewProc);
      //func:=@MessageBoxB;
      //WriteProcessMemory(GetCurrentProcess(), @pThunk^.Function_, @pfnNewProc, 4, dwScratch);
      Result := pfnOriginalProc ;
      Break;
      end;
    end;
    Inc(pThunk);
  end;
end;*)