怎样编写一个全局勾子勾住系统中的API ?(十万火急)

[cabbage]

需要解决的问题:
一旦利用这个勾子勾住系统中的API后，对所有的
进程都有效，不管那个进程调用这个API，首先都被拦截.

[Un1]

去看看“鼠标取词”源码！

[GreenStuff]

必须是一个DLL

[zzh]

我这有一段代码，是用来勾住函数的，你修改一下就可以使用了。代码如下
bool HookFunc (BYTE* pbCodeBuffer, DWORD& dwBufLen)
{
// ole libraries probably have been initialized, just get the handle
HMODULE hModule = GetModuleHandle (_T ("ds_avc.dll"));
if (hModule == NULL)
{
hModule = LoadLibrary (_T ("ds_avc.dll"));
}

// get address of the original CLSIDFromProgID
PVOID pfnOrg = (PVOID) GetProcAddress (hModule, "AvcCmdSetStreamState");

HANDLE hProcess = GetCurrentProcess ();

DWORD dwRead = 0;

// calculate offset from the original procedure to our;
// it doesn't matter the base address of our DLL, since "CPU" jumps always forward;
// notice dwJmpInstructionLen - the offset is calculated from next instruction
DWORD dwHookOffest = (DWORD)FuncProc -
((DWORD) pfnOrg + 5);//dwJmpInstructionLen);

if (!ReadProcessMemory (hProcess,
pfnOrg,
pbCodeBuffer,
dwJmpInstructionLen,
&dwRead))
{
// should be zero in this case
dwBufLen = 0;
return false;
}

// will be used to restore the original code during UnHook
dwBufLen = dwRead;

DWORD dwWritten = 0;

// write the jmp instruction. NT will perform copy-on-write, therefore no
// process will be affected by the change

if (!WriteProcessMemory (hProcess,
pfnOrg, // write at start of CLSIDFromProgID
(LPVOID) &bJmpCode, // jmp code 0xE9
sizeof (bJmpCode),
&dwWritten) && dwWritten != 0)
{
return false;
}

dwWritten = 0;
// write the offset to CLSIDProgIDProc
return (WriteProcessMemory (hProcess,
(LPVOID)((DWORD) pfnOrg + 1), // from the next byte
&dwHookOffest, // offset calculated before
sizeof (DWORD), &dwWritten) &&
dwWritten != 0);
}

bool HookFunc2 (BYTE* pbCodeBuffer, DWORD& dwBufLen)
{
// ole libraries probably have been initialized, just get the handle
HMODULE hModule = GetModuleHandle (_T ("ds_avc.dll"));
if (hModule == NULL)
{
hModule = LoadLibrary (_T ("ds_avc.dll"));
}

// get address of the original CLSIDFromProgID
PVOID pfnOrg = (PVOID) GetProcAddress (hModule, "AvcCmdGetVideoInputLumaSatGainThresh");

HANDLE hProcess = GetCurrentProcess ();

DWORD dwRead = 0;

// calculate offset from the original procedure to our;
// it doesn't matter the base address of our DLL, since "CPU" jumps always forward;
// notice dwJmpInstructionLen - the offset is calculated from next instruction
DWORD dwHookOffest = (DWORD)FuncProc2 -
((DWORD) pfnOrg + 5);//dwJmpInstructionLen);

if (!ReadProcessMemory (hProcess,
pfnOrg,
pbCodeBuffer,
dwJmpInstructionLen,
&dwRead))
{
// should be zero in this case
dwBufLen = 0;
return false;
}

// will be used to restore the original code during UnHook
dwBufLen = dwRead;

DWORD dwWritten = 0;

// write the jmp instruction. NT will perform copy-on-write, therefore no
// process will be affected by the change

if (!WriteProcessMemory (hProcess,
pfnOrg, // write at start of CLSIDFromProgID
(LPVOID) &bJmpCode, // jmp code 0xE9
sizeof (bJmpCode),
&dwWritten) && dwWritten != 0)
{
return false;
}

dwWritten = 0;
// write the offset to CLSIDProgIDProc
return (WriteProcessMemory (hProcess,
(LPVOID)((DWORD) pfnOrg + 1), // from the next byte
&dwHookOffest, // offset calculated before
sizeof (DWORD), &dwWritten) &&
dwWritten != 0);
}


// restore the previously saved code
void UnHookFunc (BYTE* pbCodeBuffer, DWORD dwBufLen)
{
HMODULE hModule = GetModuleHandle (_T ("ds_avc.dll"));
if (hModule != NULL)
{
// the ole32.DLL must be in memory
// get address of the original CLSIDFromProgID
PVOID pfnOrg = (PVOID) GetProcAddress (hModule, "AvcCmdSetStreamState");

HANDLE hProcess = GetCurrentProcess ();

DWORD dwWritten = 0;
WriteProcessMemory (hProcess,
pfnOrg,
pbCodeBuffer,
dwBufLen,
&dwWritten);

}
}

//-----------------------------------------------------------------------------------//
// the actual hook code
//-----------------------------------------------------------------------------------//



UINT _cdecl FuncProc (PVOID,PVOID, UINT state,UINT options)
{

TRACE("state options :0x%x,0x%x\n",state,options);

return options;
}
UINT _cdecl FuncProc2 (PVOID, UINT *gain)
{

TRACE("FuncProc2\n");
*gain = 0;

return 0;
}

[lu0]

看DETOUR的实现.全局的影响说来简单,其实也难.有些DLL的加载次序不一样.对
它的拦截就需要是动态的.当然KERNEL32,USER32,GDI32通常是在相同地址出现.
一个巧妙的拦截应该是拦截LOADLIBRARY.根据目标的加载而拦截.(KERNEL32永远
映射到同一地址.所以拦截LOADLIBRARY是安全,完整的解决方案.)
http://lu0.126.com

[cabbage]

zzh: 跳转指令怎么写

[superbat]

Unl:
鼠标取词源码在哪？

[yueyue]

waiting...

[Un1]

大把，比如：
http://iflower.363.net/pmzhz.htm