API HOOK框架

采用微软的 detours1.5 为内核， detours.h和detours.lib自己到网上下。

代码如下：

 

MsHookApi.h

/****************************************************************************API HOOK 采用微软的Detours1.5为内核使用方法:参照例子，首先使用DefHookApi或者DefHookDApi构造自己替换的API函数，然后在StartHook函数中添加动态或者静态的HOOK，最后在程序需要的地方或者DLL的入口调用StartHook，在出口调用StopHook。其中 InDllToProcess 函数的功能是启动进程，并注入DLL。****************************************************************************/#include <tchar.h>#include <stdio.h>#include <windows.h>#include "detours.h"#pragma comment(lib, "detours.lib")extern "C" __declspec( dllexport) BOOL InDllToProcess(TCHAR *ExeCmdline, TCHAR *ExeDir, TCHAR *DllPath);//静态替换方法//DetourFunctionWithTrampoline((PBYTE)中间函数名,//(PBYTE)目标函数名);//定义中间函数//DETOUR_TRAMPOLINE(类型 WINAPI 中间函数明(参数...),源函数名);//中间函数过程//类型 WINAPI 中间函数明(参数...){函数过程}//DetourRemove((PBYTE)中间函数名,(PBYTE)目标函数名)#define DefHookApi(SourceFunctionName,FunctionType,FunctionParameter) /DETOUR_TRAMPOLINE(FunctionType WINAPI Real_##SourceFunctionName##FunctionParameter,SourceFunctionName); /FunctionType WINAPI Mine_##SourceFunctionName##FunctionParameter//用法//DefHookAPI(源API函数名,源API函数类型,源API函数参数)　//参数格式:(参数1,参数2...)//{//return;//}#define HookApi(SourceFunctionName) /AddHookApi((PBYTE)Real_##SourceFunctionName,(PBYTE)Mine_##SourceFunctionName); //用法//HookAPI(源API函数名);//*************************************************************//动态替换方法//中间函数=DetourFunction(源函数地址,目标函数地址);#define DefHookDApi(SourceFunctionName,FunctionType,FunctionParameter) /typedef FunctionType (WINAPI *P##SourceFunctionName)##FunctionParameter; /P##SourceFunctionName Real_##SourceFunctionName = NULL; /BOOL Hook##SourceFunctionName##Tag=FALSE; /FunctionType WINAPI Mine_##SourceFunctionName##FunctionParameter//用法//DefHookDApi(源API函数名,源API函数类型,源API函数参数)　//参数格式:(参数1,参数2...)//{//return;//}#define HookDApi(SourceFunctionName,SourceFunctionAddress) /if(!Hook##SourceFunctionName##Tag){ /Hook##SourceFunctionName##Tag=TRUE; /Real_##SourceFunctionName = (P##SourceFunctionName)DetourFunction((PBYTE)SourceFunctionAddress,(PBYTE)Mine_##SourceFunctionName); /AddHookDApi((PBYTE)Real_##SourceFunctionName,(PBYTE)Mine_##SourceFunctionName); }//用法//HookDAPI(源API函数名,源API函数名地址)/////////////////////////////////////////////////////////////////定义结构///////////////////////////////////////////////////////////////typedef struct tagHOOKAPIINFO//HOOK结构{UINT Count;//个数PBYTE RealObjectApiName[250];//源API名PBYTE MineObjectApiName[250];//目标API名}HOOKAPIINFO, *PHOOKAPIINFO;typedef struct tagHOOKDAPIINFO//HOOK结构{UINT Count;//个数PBYTE RealObjectApiName[250];//源API名PBYTE MineObjectApiName[250];//目标API名}HOOKDAPIINFO, *PHOOKDAPIINFO;///////////////////////////////////////////////////////////////VOID TrampolineWith(VOID);//替换API函数VOID UnTrampolineWith(VOID);//恢复API函数//添加静态HOOK信息VOID AddHookApi(PBYTE ObjectApiName, PBYTE SourceApiName); //添加动态HOOK信息VOID AddHookDApi(PBYTE RealObjectApiName, PBYTE MineObjectApiName);VOID StartHook();VOID StopHook();

 

MsHookApi.cpp

#include "MsHookApi.h"HOOKAPIINFOHookApiInfo;HOOKAPIINFOHookDApiInfo;//注入DLL到进程BOOL InDllToProcess(TCHAR *ExeCmdline, TCHAR *ExeDir, TCHAR *DllPath){/*TCHAR szFilePath[MAX_PATH] = {0};TCHAR szDetouredDllPath[MAX_PATH] = {0};if(GetModuleFileName(NULL, szFilePath, MAX_PATH) <= 0) { return FALSE;}(*strrchr(szFilePath, '//')) = '/0';_tcscpy(szDetouredDllPath, szFilePath);_tcscat(szDetouredDllPath, _T("//detoured.dll"));*/STARTUPINFO si;PROCESS_INFORMATION pi;ZeroMemory(&si, sizeof(si));ZeroMemory(&pi, sizeof(pi));si.cb = sizeof(si);return DetourCreateProcessWithDll(NULL,ExeCmdline,NULL, NULL, TRUE, CREATE_DEFAULT_ERROR_MODE,NULL, ExeDir,&si, &pi,DllPath, NULL);}//替换API函数VOID TrampolineWith(VOID){UINT i;for(i=0; i<HookApiInfo.Count; i++){ DetourFunctionWithTrampoline(HookApiInfo.RealObjectApiName[i], HookApiInfo.MineObjectApiName[i]);}}//恢复API函数VOID UnTrampolineWith(VOID){UINT i;for(i=0; i<HookApiInfo.Count; i++)//初始化静态API函数{DetourRemoveWithTrampoline(HookApiInfo.RealObjectApiName[i], HookApiInfo.MineObjectApiName[i]);}for(i=0; i<HookDApiInfo.Count; i++)//初始化动态API函数{DetourRemoveWithTrampoline(HookDApiInfo.RealObjectApiName[i], HookDApiInfo.MineObjectApiName[i]);}}//添加静态HOOK函数VOID AddHookApi(PBYTE RealObjectApiName,PBYTE MineObjectApiName){UINT i;BOOL blFound = FALSE;//检查静态HOOK信息里是否已经有这个函数for(i=0; i<HookApiInfo.Count; i++){if(HookApiInfo.RealObjectApiName[i] == RealObjectApiName)blFound = TRUE;}//如果没有就添加if(!blFound){HookApiInfo.Count++;HookApiInfo.RealObjectApiName[i] = RealObjectApiName;HookApiInfo.MineObjectApiName[i] = MineObjectApiName;}}//添加动态HOOK函数VOID AddHookDApi(PBYTE RealObjectApiName,PBYTE MineObjectApiName){UINT i; BOOL blFound = FALSE;//检查动态HOOK信息里是否已经有这个函数for(i=0; i<HookDApiInfo.Count; i++){if(HookDApiInfo.RealObjectApiName[i] == RealObjectApiName)blFound = TRUE;}//如果没有就添加if(!blFound){HookDApiInfo.Count++;HookDApiInfo.RealObjectApiName[i] = RealObjectApiName;HookDApiInfo.MineObjectApiName[i] = MineObjectApiName;}}//------------------------------------------------------------------------------------//********************** 例子 *********************************////MessageBoxA, 静态拦截DefHookApi(MessageBoxA, int, (HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType)){int iRet = Real_MessageBoxA(hWnd, lpText, "A", uType);return iRet;}//MessageBoxW, 动态拦截DefHookDApi(MessageBoxW, int, (HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType)){int iRet = Real_MessageBoxW(hWnd, lpText, L"W", uType);return iRet;}VOID StartHook(){HookApi(MessageBoxA);//静态HOOKHMODULE hUser = LoadLibrary(_T("User32.dll"));//动态HOOKif(hUser){FARPROC fnProc = GetProcAddress(hUser, _T("MessageBoxW"));if(fnProc){HookDApi(MessageBoxW, fnProc);}FreeLibrary(hUser);}TrampolineWith();}VOID StopHook(){UnTrampolineWith();}