用修改IAT法HOOK API

来源：互联网发布：js map 值是否存在编辑：程序博客网时间：2024/04/29 09:18

#include <windows.h>
#include <stdio.h>
#include <tchar.h>

#define UNICODE
#define _UNICODE

PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNTHeaders;
PIMAGE_OPTIONAL_HEADER   pOptHeader;
PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor;
PIMAGE_THUNK_DATA         pThunkData;
PIMAGE_IMPORT_BY_NAME     pImportByName;
HMODULE hMod;

int * addr = (int *)MessageBoxA; //保存函数的入口地址
// 定义MessageBoxA函数原型
typedef int (WINAPI *PFNMESSAGEBOX)(HWND, LPCSTR, LPCSTR, UINT uType);
int WINAPI MessageBoxProxy(IN HWND hWnd, IN LPCSTR lpText, IN LPCSTR lpCaption, IN UINT uType);

int * myaddr = (int *)MessageBoxProxy;

int main()
{
//OutputDebugString(_T("start !"));
MessageBoxA(NULL, "原函数", "09HookDemo", 0);

//-------------HOOK部分
hMod = GetModuleHandle(NULL);

        pDosHeader = (PIMAGE_DOS_HEADER)hMod;
        pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hMod + pDosHeader->e_lfanew);
        pOptHeader = (PIMAGE_OPTIONAL_HEADER)&(pNTHeaders->OptionalHeader);

pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE *)hMod + pOptHeader->DataDirectory[1].VirtualAddress);

        while(pImportDescriptor->FirstThunk)
        {
                char * dllname = (char *)((BYTE *)hMod + pImportDescriptor->Name);
                //printf("函数模块：%s\n",dllname);

pThunkData = (PIMAGE_THUNK_DATA)((BYTE *)hMod + pImportDescriptor->OriginalFirstThunk);

                int no = 1;
                while(pThunkData->u1.Function)
                {
                        char * funname = (char *)((BYTE *)hMod + (DWORD)pThunkData->u1.AddressOfData + 2);
                        PDWORD lpAddr = (DWORD *)((BYTE *)hMod + (DWORD)pImportDescriptor->FirstThunk) +(no-1);

                        //printf("%4d: ",no);
                        //printf("%30s",funname);
                        //printf("%8x\n",lpAddr);
                        //printf("%8x\n",*lpAddr);
                        //修改内存的部分
                        if((*lpAddr) == (int)addr)
                        {
                                //修改内存页的属性
                                DWORD dwOLD;
                                MEMORY_BASIC_INFORMATION mbi;
                                VirtualQuery(lpAddr,&mbi,sizeof(mbi));
                                VirtualProtect(lpAddr,sizeof(DWORD),PAGE_READWRITE,&dwOLD);
                                //写内存
                                WriteProcessMemory(GetCurrentProcess(),
                                                lpAddr, &myaddr, sizeof(DWORD), NULL);
                                //恢复内存页的属性
                                VirtualProtect(lpAddr,sizeof(DWORD),dwOLD,0);
                        }
            //---------
                        no++;
                        pThunkData++;
                }

pImportDescriptor++;
}

//用于测试的API函数
MessageBoxA(NULL, "原函数", "09HookDemo", 0);

getchar();
return 0;
}

int WINAPI MessageBoxProxy(IN HWND hWnd, IN LPCSTR lpText, IN LPCSTR lpCaption, IN UINT uType)
{
return ((PFNMESSAGEBOX)addr)(NULL, "Gxter", "Gxter", 0);
//用地址调用一个API函数
}