15,471
社区成员
发帖
与我相关
我的任务
分享如何在其他进程中安装Hook钩子的问题（已经将dll注入其他进程）
问题讲解：【如何在一个远程进程的安装局部钩子】
1.A进程注入DLL到进程B中
2.然后在DLL中安置钩子
3。通过钩子截获发往B中的线程
自认为问题出在DLLMain()
1.A进程注入DLL到进程B中
2.然后在DLL中安置钩子
3。通过钩子截获发往B中的线程
自认为问题出在DLLMain()
...全文
请发表友善的回复…
发表回复
chelp 2012-06-15
- 打赏
- 举报
谢谢大家的关注
chelp 2012-06-14
- 打赏
- 举报
跪求啊？
chelp 2012-06-11
- 打赏
- 举报
我就是想：用钩子截获其他特定进程窗口的消息
远程注入DLL已成功
想在DLL中设置钩子，实现截获
远程注入DLL已成功
想在DLL中设置钩子，实现截获
sj720618 2012-06-11
- 打赏
- 举报
你是想hook PeekMessage吗？
chelp 2012-06-11
- 打赏
- 举报
整体思路：远程注入DLL (CreateRemoteThread())到其他进程
我要的是如何在DLL MAIN()所在线程中设置HOOK
截获消息
我要的是如何在DLL MAIN()所在线程中设置HOOK
截获消息
chelp 2012-06-11
- 打赏
- 举报
WH_GETMESSAGE钩子，现在是安装钩子不起作用。
BOOL APIENTRY DllMain(HINSTANCE hModule, DWORD reason, LPVOID lpReserved)
{ char * szProcessId = (char *)malloc(10*sizeof(char));
char *szThreadId=(char *)malloc(10*sizeof(char));
DWORD ProcessId=GetCurrentProcessId();
DWORD ThreadId=-1;
THREADENTRY32 pe32;
pe32.dwSize=sizeof(pe32);
HANDLE hsnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if(hsnapshot==NULL)
{
MessageBox(NULL,"WWW0",NULL,0);
}
BOOL isThread =Thread32First(hsnapshot,&pe32);
if(isThread==FALSE)
{
MessageBox(NULL,"WWW1",NULL,0);
return 0;
}
do
{
if(ProcessId==pe32.th32OwnerProcessID)
{
ThreadId=pe32.th32ThreadID;
break;
}
}
while(Thread32Next(hsnapshot,&pe32));
switch (reason){
case DLL_PROCESS_ATTACH:{
//获取并显示当前进程ID
_itoa(GetCurrentProcessId(), szProcessId, 16);
_itoa(ThreadId,szThreadId,16);
m_GetM=SetWindowsHookEx(WH_GETMESSAGE,GetMsgProc,hModule,ThreadId);//GetModuleHandle(NULL),ThreadId);
if(m_GetM==NULL)
{
MessageBox(NULL,"ADF","DLL OR DLL",MB_OK);
return 0;
}
MessageBox(NULL,szProcessId,"RemoteDLL",MB_OK);
MessageBox(NULL,szThreadId,"dlltread",MB_OK);
Sleep(10000);
}
default:
return TRUE;
}
return TRUE;
}
LRESULT CALLBACK GetMsgProc(
int code, // hook code
WPARAM wParam, // removal flag
LPARAM lParam // address of structure with message
)
{
if(code<0)return CallNextHookEx(m_GetM,code,wParam,lParam);
if(code!=HC_ACTION) return CallNextHookEx(m_GetM,code,wParam,lParam);
MSG *Pmsg=(MSG *)lParam;
switch(Pmsg->message)
{
case WM_LBUTTONDOWN: Pmsg->message=WM_RBUTTONDOWN; MessageBox(Pmsg->hwnd,"WM_LBUTTON","WM_RBUTTON",0);break;
default :
return 0;
}
return 0;
}
BOOL APIENTRY DllMain(HINSTANCE hModule, DWORD reason, LPVOID lpReserved)
{ char * szProcessId = (char *)malloc(10*sizeof(char));
char *szThreadId=(char *)malloc(10*sizeof(char));
DWORD ProcessId=GetCurrentProcessId();
DWORD ThreadId=-1;
THREADENTRY32 pe32;
pe32.dwSize=sizeof(pe32);
HANDLE hsnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if(hsnapshot==NULL)
{
MessageBox(NULL,"WWW0",NULL,0);
}
BOOL isThread =Thread32First(hsnapshot,&pe32);
if(isThread==FALSE)
{
MessageBox(NULL,"WWW1",NULL,0);
return 0;
}
do
{
if(ProcessId==pe32.th32OwnerProcessID)
{
ThreadId=pe32.th32ThreadID;
break;
}
}
while(Thread32Next(hsnapshot,&pe32));
switch (reason){
case DLL_PROCESS_ATTACH:{
//获取并显示当前进程ID
_itoa(GetCurrentProcessId(), szProcessId, 16);
_itoa(ThreadId,szThreadId,16);
m_GetM=SetWindowsHookEx(WH_GETMESSAGE,GetMsgProc,hModule,ThreadId);//GetModuleHandle(NULL),ThreadId);
if(m_GetM==NULL)
{
MessageBox(NULL,"ADF","DLL OR DLL",MB_OK);
return 0;
}
MessageBox(NULL,szProcessId,"RemoteDLL",MB_OK);
MessageBox(NULL,szThreadId,"dlltread",MB_OK);
Sleep(10000);
}
default:
return TRUE;
}
return TRUE;
}
LRESULT CALLBACK GetMsgProc(
int code, // hook code
WPARAM wParam, // removal flag
LPARAM lParam // address of structure with message
)
{
if(code<0)return CallNextHookEx(m_GetM,code,wParam,lParam);
if(code!=HC_ACTION) return CallNextHookEx(m_GetM,code,wParam,lParam);
MSG *Pmsg=(MSG *)lParam;
switch(Pmsg->message)
{
case WM_LBUTTONDOWN: Pmsg->message=WM_RBUTTONDOWN; MessageBox(Pmsg->hwnd,"WM_LBUTTON","WM_RBUTTON",0);break;
default :
return 0;
}
return 0;
}
chelp 2012-06-11
- 打赏
- 举报
哎！神啊！
Lactoferrin 2012-06-11
- 打赏
- 举报
SetWindowsHookEx本身就有注入dll的功能
Lactoferrin 2012-06-10
- 打赏
- 举报
你的钩子指什么
