Detours Hook的问题

绿建科技 2014-03-14 02:30:43

DLL中写了如下代码：

HANDLE (WINAPI *SysCreateFile)(
LPCWSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile)
= CreateFileW;

HANDLE WINAPI MyCreateFile(
LPCWSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile
)
{
MessageBox(NULL, L"asdf", L"asdf", MB_OK);

return CreateFile(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
}

// 安装HOOK
DWORD WINAPI ThreadHookCreateFile(LPVOID lpParam)
{
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)SysCreateFile, MyCreateFile);
DetourTransactionCommit();
return 0;
}

BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
// 创建监控线程
HANDLE hThread = CreateThread(NULL, 0, ThreadHookCreateFile, NULL, 0, NULL);
if(hThread != INVALID_HANDLE_VALUE){
CloseHandle(hThread);
}
}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
{
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourDetach(&(PVOID&)SysCreateFile, MyCreateFile);
DetourTransactionCommit();
}
break;
}
return TRUE;
}

注入之后，目标进程打开文件没有任何反应，感觉是注入失败了。测试环境：Win764

...全文