劫持系统函数system

#include "detours.h"#pragma comment(lib,"detours.lib")int(*poldsystem)(const char *_Command) = system;int newsystem(const char*_Command){ printf("你执行的是：%s\n", _Command); poldsystem(_Command);char *p = strstr(_Command, "notepad");if (NULL==p){printf("安全的，运行通过！\n");poldsystem(_Command);} else{printf("发现威胁，已被成功处理，禁止通过！\n");}}void hook(){DetourRestoreAfterWith();//恢复之前状态   避免反复拦截DetourTransactionBegin();//开始劫持DetourUpdateThread(GetCurrentThread());//刷新当前线程DetourAttach((void**)&poldsystem, newsystem);//拦截DetourTransactionCommit();//立即生效}void main(){system("mspaint");hook();system("notepad");printf("\n开始拦截：\n");system("notepad");system("title 黑鹰's-Blog");system("notepad");system("calc");system("notepad");getchar();}