关于API HOOK（OpenProcess)，根据网上文章改写

来源：互联网发布：网络扫描技术揭秘 pdf 编辑：程序博客网时间：2024/04/30 07:02

以下是部分程序，在VC++6.0 Plat SDK 2003 SP1下编译通过

#include <windows.h>
#include "APIHook.h"

extern CAPIHook g_OpenProcess;

// 自定义OpenProcess函数
#pragma data_seg("YCIShared")
HHOOK g_hHook = NULL;
DWORD dwCurrentProcessId=0;
#pragma data_seg()

HANDLE WINAPI Hook_OpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId)
{
typedef HANDLE (WINAPI *PFNTERMINATEPROCESS)(DWORD, BOOL,DWORD);

if(dwProcessId != dwCurrentProcessId)
{
return ((PFNTERMINATEPROCESS)(PROC)g_OpenProcess)(dwDesiredAccess,bInheritHandle,dwProcessId);
}
return 0;
}

// 挂钩OpenProcess函数
CAPIHook g_OpenProcess("kernel32.dll", "OpenProcess",
(PROC)Hook_OpenProcess);

///////////////////////////////////////////////////////////////////////////

static HMODULE ModuleFromAddress(PVOID pv)
{
MEMORY_BASIC_INFORMATION mbi;
if(::VirtualQuery(pv, &mbi, sizeof(mbi)) != 0)
{
return (HMODULE)mbi.AllocationBase;
}
else
{
return NULL;
}
}

static LRESULT WINAPI GetMsgProc(int code, WPARAM wParam, LPARAM lParam)
{
return ::CallNextHookEx(g_hHook, code, wParam, lParam);
}

BOOL WINAPI SetSysHook(BOOL bInstall, DWORD dwThreadId)
{
BOOL bOk;
    dwCurrentProcessId=dwThreadId;
if(bInstall)
{
  g_hHook = ::SetWindowsHookEx(WH_GETMESSAGE, GetMsgProc,
      ModuleFromAddress(GetMsgProc), 0);
  bOk = (g_hHook != NULL);
}
else
{
  bOk = ::UnhookWindowsHookEx(g_hHook);
  g_hHook = NULL;
}
return bOk;
}