请教关于APIHOOK的初级问题(新手)

2003-02-21 12:04:27 86 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

Win32汇编注入：APIHook 1，APIHook 概述：概述：注入windows画图工具（32位），让画图工具启动后，只要画图工具调用要hook的api，就能弹出一个对话框；以上关键使用APIHook； APIHook也是杀软主动防御的一个基础； 2，提前搞清楚几个问题 2.1 A和W版本 WindowsAPI有A和W版本，如果使用A版本，A版本最后还是会调用W版本，所以尽可能hook的是W版本；这里涉及到其他问阅读详情

请各位帮帮忙：
我从别的地方copy了一段代码想实现简单的APIHOOK，就是在运行notepad.exe时hook MessageBoxW这个API，使它指向ExitProcess，但是这个程序在运行时总是报Access voilation。在单步跟踪时停在了ImageDirectoryEntryToData()
程序代码很短，就包括一个main()和ReplaceIATEntryInOneMod()两个函数，如下：

#include "windows.h"
#include <ImageHlp.h>
#pragma comment(lib, "ImageHlp")

const BYTE cPushOpCode = 0x68;

void ReplaceIATEntryInOneMod(PCSTR pszCalleeModName,
PROC pfnCurrent, PROC pfnNew, HMODULE hmodCaller) {

// Get the address of the module's import section
ULONG ulSize;
PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)
ImageDirectoryEntryToData(hmodCaller, TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize);

if (pImportDesc == NULL)
return; // This module has no import section

// Find the import descriptor containing references to callee's functions
for (; pImportDesc->Name; pImportDesc++) {
PSTR pszModName = (PSTR) ((PBYTE) hmodCaller + pImportDesc->Name);
if (lstrcmpiA(pszModName, pszCalleeModName) == 0)
break; // Found
}

if (pImportDesc->Name == 0)
return; // This module doesn't import any functions from this callee

// Get caller's import address table (IAT) for the callee's functions
PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)
((PBYTE) hmodCaller + pImportDesc->FirstThunk);

// Replace current function address with new function address
for (; pThunk->u1.Function; pThunk++) {

// Get the address of the function address
PROC* ppfn = (PROC*) &pThunk->u1.Function;

// Is this the function we're looking for?
BOOL fFound = (*ppfn == pfnCurrent);

if (fFound) {
// The addresses match, change the import section address
WriteProcessMemory(GetCurrentProcess(), ppfn, &pfnNew,
sizeof(pfnNew), NULL);
return; // We did it, get out
}
}

// If we get to here, the function is not in the caller's import section
}

void main(){
PROC pfnOrig=GetProcAddress(GetModuleHandle("Kernel32"),"MessageBoxW");
HMODULE hmodCaller=GetModuleHandle("notepad.exe");
PROC MyMessageBoxW=GetProcAddress(GetModuleHandle("Kernel32"),"ExitProcess");
ReplaceIATEntryInOneMod(
"Kernel32,dll",
pfnOrig,
MyMessageBoxW,
hmodCaller);

}

还有一个问题就是字调用WriteProcessMemory时，我怎么知道当前的进程是不是notepad.exe？

...全文