Delphi写的一个函数的Hook类

 unit HookFuncLib;interfaceuses Windows,SysUtils,Classes;const CHookJump_LEN = 5; //要修改的函数的跳转5字节,一个Jmp指令，一个函数地址type TFuncHookList = class; TFuncHook = class private OldProtection: DWORD;//内存区域原读写权限 FOldFunc: Pointer; OldCode: array[0..4] of Byte;//要修改的原函数5字节 NewCode: array[0..4] of Byte; function GetHasInstalled: Boolean;//要替换成的5字节 public constructor Create(OldFunc: Pointer); destructor Destroy;override; property HasHooked: Boolean read GetHasInstalled; function HookFunc(NewFunc: Pointer): Boolean; procedure UnHookFunc; procedure SwapOld; procedure SwapNew; end; TFuncHookList = class private HookList: TStringList; function Getitem(index: Integer): TFuncHook; function GetFuncCount: Integer; public constructor Create; destructor Destroy;override; function AddHookFunc(HookName: string;OldFunc: Pointer;NewFunc: Pointer): Boolean; function FindHookedFunc(Func: Pointer): Integer; procedure UnHookFunc(HookName: string);overload; procedure UnHookFunc(Func: Pointer);overload; procedure SwapToOldFunc(HookName: string);overload; procedure SwapToOldFunc(Func: Pointer);overload; procedure SwapToNewFunc(HookName: string);overload; procedure SwapToNewFunc(Func: Pointer);overload; procedure SwapToOldFuncs; procedure SwapToNewFuncs; procedure UnHookFuncs; property item[index: Integer]: TFuncHook read Getitem; property FuncCount: Integer read GetFuncCount; end;implementation{ TFuncHook }constructor TFuncHook.Create(OldFunc: Pointer);begin OldProtection := 0; FOldFunc := OldFunc; NewCode[0] := 0;end;destructor TFuncHook.Destroy;begin if HasHooked then UnHookFunc; inherited;end;function TFuncHook.GetHasInstalled: Boolean;begin Result := NewCode[0] <> 0;end;function TFuncHook.HookFunc(NewFunc: Pointer): Boolean;var OffsetAddr: DWORD; //偏移地址begin Result := False; if (NewFunc <> nil) and (not HasHooked) then begin if VirtualProtect(FOldFunc,8,PAGE_EXECUTE_READWRITE,@OldProtection) then //解内存保护成功 begin NewCode[0] := $e9;//Jmp指令机器码 OffsetAddr := Integer(NewFunc) - Integer(FOldFunc) - SizeOf(NewCode); CopyMemory(@NewCode[1],@OffsetAddr,SizeOf(OffsetAddr));//将偏移地址写入NewCode的Jmp指令后 CopyMemory(@OldCode[0],FOldFunc,SizeOf(OldCode));//保存原函数5字节 CopyMemory(FOldFunc,@NewCode[0],SizeOf(NewCode));//替换5字节 Result := True; end; end;end;procedure TFuncHook.SwapNew;begin if HasHooked then CopyMemory(FOldFunc,@NewCode[0],SizeOf(NewCode));//恢复到新函数执行end;procedure TFuncHook.SwapOld;begin if FOldFunc <> nil then CopyMemory(FOldFunc,@OldCode[0],SizeOf(OldCode));//恢复到原函数end;procedure TFuncHook.UnHookFunc;var temp: DWORD;begin if (FOldFunc <> nil) and HasHooked then begin try CopyMemory(FOldFunc,@OldCode[0],SizeOf(OldCode));//恢复原函数 VirtualProtect(FOldFunc,8,OldProtection,@temp);//恢复原读写保护 NewCode[0] := 0; except end; end;end;{ TFuncHookList }function TFuncHookList.AddHookFunc(HookName: string;OldFunc, NewFunc: Pointer): Boolean;var FuncHook: TFuncHook; index: integer;begin if HookList.IndexOf(HookName) = -1 then begin index := FindHookedFunc(OldFunc); if index <> -1 then begin FuncHook := TFuncHook(HookList.Objects[index]); Result := FuncHook.HookFunc(NewFunc); HookList[index] := HookName; end else begin FuncHook := TFuncHook.Create(OldFunc); Result := FuncHook.HookFunc(NewFunc); HookList.AddObject(HookName,FuncHook); end; end else raise Exception.Create('HookName '+HookName+' 已经存在！');end;constructor TFuncHookList.Create;begin HookList := TStringList.Create;end;destructor TFuncHookList.Destroy;begin UnHookFuncs; HookList.Free; inherited;end;function TFuncHookList.FindHookedFunc(Func: Pointer): Integer;var i: Integer;label 1;begin Result := -1; for i := 0 to HookList.Count - 1 do begin if TFuncHook(HookList.Objects[i]).FOldFunc = Func then begin Result := i; goto 1; end; end; 1:end;procedure TFuncHookList.UnHookFunc(HookName: string);var index: Integer;begin index := HookList.IndexOf(HookName); if index <> -1 then begin TFuncHook(HookList.Objects[index]).Free; //HookList.Delete(index); end;end;procedure TFuncHookList.UnHookFunc(Func: Pointer);var index: Integer;begin index := FindHookedFunc(Func); if index <> -1 then begin TFuncHook(HookList.Objects[index]).Free; HookList.Delete(index); end;end;procedure TFuncHookList.SwapToOldFuncs;var i: Integer;begin for i := 0 to HookList.Count - 1 do TFuncHook(HookList.Objects[i]).SwapOld;end;procedure TFuncHookList.SwapToNewFuncs;var i: integer;begin for i := 0 to HookList.Count - 1 do TFuncHook(HookList.Objects[i]).SwapNew;end;procedure TFuncHookList.UnHookFuncs;begin while HookList.Count > 0 do begin TFuncHook(HookList.Objects[HookList.Count - 1]).Free; HookList.Delete(HookList.Count - 1); end;end;procedure TFuncHookList.SwapToOldFunc(HookName: string);var index: Integer;begin index := HookList.IndexOf(HookName); if index <> -1 then TFuncHook(HookList.Objects[index]).SwapOld;end;procedure TFuncHookList.SwapToOldFunc(Func: Pointer);var index: Integer;begin index := FindHookedFunc(Func); if index <> -1 then TFuncHook(HookList.Objects[index]).SwapOldend;procedure TFuncHookList.SwapToNewFunc(HookName: string);var index: Integer;begin index := HookList.IndexOf(HookName); if index <> -1 then TFuncHook(HookList.Objects[index]).SwapNew;end;procedure TFuncHookList.SwapToNewFunc(Func: Pointer);var index: Integer;begin index := FindHookedFunc(Func); if index <> -1 then TFuncHook(HookList.Objects[index]).SwapNew;end;function TFuncHookList.Getitem(index: Integer): TFuncHook;begin if (index < 0) or (index > HookList.Count - 1) then raise Exception.Create('超过边界'); Result := TFuncHook(HookList.Objects[index]);end;function TFuncHookList.GetFuncCount: Integer;begin Result := HookList.Count;end;end.