apihook.rar_APIHOOK_api hook_hook api

//--------------------------------------------------------------------------- #include <vcl.h> #include <windows.h> #pragma hdrstop //--------------------------------------------------------------------------- // Important note about DLL memory management when your DLL uses the // static version of the RunTime Library: // // If your DLL exports any functions that pass String objects (or structs/ // classes containing nested Strings) as parameter or function results, // you will need to add the library MEMMGR.LIB to both the DLL project and // any other projects that use the DLL. You will also need to use MEMMGR.LIB // if any other projects which use the DLL will be performing new or delete // operations on any non-TObject-derived classes which are exported from the // DLL. Adding MEMMGR.LIB to your project will change the DLL and its calling // EXE's to use the BORLNDMM.DLL as their memory manager. In these cases, // the file BORLNDMM.DLL should be deployed along with your DLL. // // To avoid using BORLNDMM.DLL, pass string information using "char *" or // ShortString parameters. // // If your DLL uses the dynamic version of the RTL, you do not need to // explicitly add MEMMGR.LIB as this will be done implicitly for you //--------------------------------------------------------------------------- #pragma argsused BYTE oldCode[5],newCode[5]; FARPROC pMessageBoxA; bool mHook=false; DWORD procId,oldId; void _fastcall HookOn(void); void _fastcall HookOff(void); extern "C" { void _export _stdcall InstallHook(); void _export _stdcall UnInstall(); }; HHOOK hHook=NULL; HINSTANCE hInst; LRESULT CALLBACK mMouseProc( int nCode, // hook code WPARAM wParam, // message identifier LPARAM lParam // mouse coordinates ) { return CallNextHookEx(hHook,nCode,wParam,lParam); } void _stdcall InstallHook() { if(!hHook) hHook=SetWindowsHookEx(WH_MOUSE,(FARPROC)mMouseProc,hInst,0); } void _stdcall UnInstall() { if(hHook) { UnhookWindowsHookEx(hHook); hHook=NULL; } int WINAPI MyMessageBoxA( HWND hWnd, // handle of owner window LPCTSTR lpText, // address of text in message box LPCTSTR lpCaption, // address of title of message box UINT uType // style of message box ); int WINAPI MyMessageBoxA( HWND hWnd, // handle of owner window LPCTSTR lpText, // address of text in message box LPCTSTR lpCaption, // address of title of message box UINT uType // style of message box ) { int nRet; // procId=GetCurrentProcessId(); HookOff(); nRet=MessageBoxA(hWnd,(AnsiString(lpText)+"(已拦截)").c_str(), lpCaption,uType); HookOn(); return nRet; } void _fastcall HookOn(void) { procId=oldId; HANDLE hProc=OpenProcess(PROCESS_ALL_ACCESS,0,procId); VirtualProtectEx(hProc,pMessageBoxA,5,PAGE_READWRITE,&procId); WriteProcessMemory(hProc,pMessageBoxA,newCode,5,0); VirtualProtectEx(hProc,pMessageBoxA,5,procId,&procId); mHook=true; } void _fastcall HookOff(void) { procId=oldId; HANDLE hProc=OpenProcess(PROCESS_ALL_ACCESS,0,procId); VirtualProtectEx(hProc,pMessageBoxA,5,PAGE_READWRITE,&procId); WriteProcessMemory(hProc,pMessageBoxA,oldCode,5,0); VirtualProtectEx(hProc,pMessageBoxA,5,procId,&procId); mHook=false; } bool Init() { bool ret=true; HMODULE hModule=GetModuleHandle("user32.dll"); if(hModule) { pMessageBoxA=(FARPROC)GetProcAddress(hModule,"MessageBoxA"); if(pMessageBoxA) { Move(pMessageBoxA,oldCode,5); newCode[0]=0xe9; DWORD *addr=(DWORD *)(newCode+1); *addr=(DWORD)MyMessageBoxA-(DWORD)pMessageBoxA-5; oldId=GetCurrentProcessId(); HookOn(); } else ret=false; } else ret=false; return ret; } int WINAPI DllEntryPoint(HINSTANCE hinst, unsigned long reason, void* lpReserved) { hInst=hinst; switch(reason) { case DLL_PROCESS_ATTACH: if(!Init()) MessageBox(0,"初始化错误！","",MB_OK); break; case DLL_PROCESS_DETACH: if(mHook) HookOff(); break; } return 1; } //---------------------------------------------------------------------------