1,183
社区成员
发帖
与我相关
我的任务
分享
typedef HRESULT (STDMETHODCALLTYPE * LPFN_HOOKPROC)(IUnknown *pThis, REFIID riid, void __RPC_FAR *__RPC_FAR *ppvObject);
LPFN_HOOKPROC Proc;
HRESULT STDMETHODCALLTYPE HookQueryInterface(IUnknown *pThis, REFIID riid, void __RPC_FAR *__RPC_FAR *ppvObject)
{
return Proc(pThis, riid, ppvObject);//调用原来的QueryInterface方法,记得有个this指针的参数
}
void WordSelectAll()
{
CLSID clsid;
IUnknown *pUnk;
CLSIDFromProgID(L"Word.Application", &clsid);
GetActiveObject(clsid, NULL, &pUnk);//这只是获取Word.Application的接口指针而已
if (pUnk == NULL) return;
//这儿进行Hook
PVOID pVmt = *((PVOID*)pUnk);//从接口指针找VMT指针
DWORD dwProtect;
VirtualProtect(&((PVOID*)pVmt)[0], sizeof(PVOID), PAGE_READWRITE, &dwProtect);
Proc = ((LPFN_HOOKPROC*)pVmt)[0];//把VMT中第一个方法地址保存到Proc中
((LPFN_HOOKPROC*)pVmt)[0] = &HookQueryInterface;//把HookQueryInterface方法地址写到VMT中
VirtualProtect(&((PVOID*)pVmt)[0], sizeof(PVOID), dwProtect, &dwProtect);
//这儿Hook完成了(其实只是Hook的代理而已,因为Word.Application是进程外组件)
pUnk->QueryInterface(IID_IDispatch, (LPVOID *)&dispApp);//调用这句的时候就会跳转到HookQueryInterface中去
pUnk->Release();
}