怎样编写一个全局勾子勾住系统中的API ?

[cabbage]

[zzh]

我这里有两个函数，是用来勾住DLL中函数的，你可以参照一下，只要把函数名换一下即可。bool HookFunc (BYTE* pbCodeBuffer, DWORD& dwBufLen)
{
// ole libraries probably have been initialized, just get the handle
HMODULE hModule = GetModuleHandle (_T ("ds_avc.dll"));
if (hModule == NULL)
{
hModule = LoadLibrary (_T ("ds_avc.dll"));
}

// get address of the original CLSIDFromProgID
PVOID pfnOrg = (PVOID) GetProcAddress (hModule, "AvcCmdSetStreamState");

HANDLE hProcess = GetCurrentProcess ();

DWORD dwRead = 0;

// calculate offset from the original procedure to our;
// it doesn't matter the base address of our DLL, since "CPU" jumps always forward;
// notice dwJmpInstructionLen - the offset is calculated from next instruction
DWORD dwHookOffest = (DWORD)FuncProc -
((DWORD) pfnOrg + 5);//dwJmpInstructionLen);

if (!ReadProcessMemory (hProcess,
pfnOrg,
pbCodeBuffer,
dwJmpInstructionLen,
&dwRead))
{
// should be zero in this case
dwBufLen = 0;
return false;
}

// will be used to restore the original code during UnHook
dwBufLen = dwRead;

DWORD dwWritten = 0;

// write the jmp instruction. NT will perform copy-on-write, therefore no
// process will be affected by the change

if (!WriteProcessMemory (hProcess,
pfnOrg, // write at start of CLSIDFromProgID
(LPVOID) &bJmpCode, // jmp code 0xE9
sizeof (bJmpCode),
&dwWritten) && dwWritten != 0)
{
return false;
}

dwWritten = 0;
// write the offset to CLSIDProgIDProc
return (WriteProcessMemory (hProcess,
(LPVOID)((DWORD) pfnOrg + 1), // from the next byte
&dwHookOffest, // offset calculated before
sizeof (DWORD), &dwWritten) &&
dwWritten != 0);
}

bool HookFunc2 (BYTE* pbCodeBuffer, DWORD& dwBufLen)
{
// ole libraries probably have been initialized, just get the handle
HMODULE hModule = GetModuleHandle (_T ("ds_avc.dll"));
if (hModule == NULL)
{
hModule = LoadLibrary (_T ("ds_avc.dll"));
}

// get address of the original CLSIDFromProgID
PVOID pfnOrg = (PVOID) GetProcAddress (hModule, "AvcCmdGetVideoInputLumaSatGainThresh");

HANDLE hProcess = GetCurrentProcess ();

DWORD dwRead = 0;

// calculate offset from the original procedure to our;
// it doesn't matter the base address of our DLL, since "CPU" jumps always forward;
// notice dwJmpInstructionLen - the offset is calculated from next instruction
DWORD dwHookOffest = (DWORD)FuncProc2 -
((DWORD) pfnOrg + 5);//dwJmpInstructionLen);

if (!ReadProcessMemory (hProcess,
pfnOrg,
pbCodeBuffer,
dwJmpInstructionLen,
&dwRead))
{
// should be zero in this case
dwBufLen = 0;
return false;
}

// will be used to restore the original code during UnHook
dwBufLen = dwRead;

DWORD dwWritten = 0;

// write the jmp instruction. NT will perform copy-on-write, therefore no
// process will be affected by the change

if (!WriteProcessMemory (hProcess,
pfnOrg, // write at start of CLSIDFromProgID
(LPVOID) &bJmpCode, // jmp code 0xE9
sizeof (bJmpCode),
&dwWritten) && dwWritten != 0)
{
return false;
}

dwWritten = 0;
// write the offset to CLSIDProgIDProc
return (WriteProcessMemory (hProcess,
(LPVOID)((DWORD) pfnOrg + 1), // from the next byte
&dwHookOffest, // offset calculated before
sizeof (DWORD), &dwWritten) &&
dwWritten != 0);
}


// restore the previously saved code
void UnHookFunc (BYTE* pbCodeBuffer, DWORD dwBufLen)
{
HMODULE hModule = GetModuleHandle (_T ("ds_avc.dll"));
if (hModule != NULL)
{
// the ole32.DLL must be in memory
// get address of the original CLSIDFromProgID
PVOID pfnOrg = (PVOID) GetProcAddress (hModule, "AvcCmdSetStreamState");

HANDLE hProcess = GetCurrentProcess ();

DWORD dwWritten = 0;
WriteProcessMemory (hProcess,
pfnOrg,
pbCodeBuffer,
dwBufLen,
&dwWritten);

}
}

//-----------------------------------------------------------------------------------//
// the actual hook code
//-----------------------------------------------------------------------------------//



UINT _cdecl FuncProc (PVOID,PVOID, UINT state,UINT options)
{

TRACE("state options :0x%x,0x%x\n",state,options);

return options;
}
UINT _cdecl FuncProc2 (PVOID, UINT *gain)
{

TRACE("FuncProc2\n");
*gain = 0;

return 0;
}

[Star]

首先，系统中的API范围如何？

其次，钩子针对的是消息，不是API，用钩子来钩API不是不能实现(如果你要求监视的API不是太深)，而是不是最好的实现。

我个人的建议是写虚设驱动。

[lu0]

STAR有理.HOOK本身需要USER模块的支持.如果一个应用不需要USER模块.HOOK就
没用了.当然,如果修改了系统区的API代码.影响到的确是全局性的.:)

[cabbage]

首先谢谢各位

我想要做的是要这个勾子对其它进程也有效

[zeatul]

问题还解决了。
偶也遇到这问题。
请赐教。

[flywhc]

恰好我刚做完这样的一个程序 -- 类似金山词霸的屏幕取词。
我是参考了GUIDLLNT的源程序，不知道这个程序哪里还有。

原理是先用全局鼠标钩子钩进所有进程，替换进程里的DLL入口。
在NT里用VirtualProtect函数改变权限，然后再WriteProcessMemory写入跳转指令
在你的“API钩子”程序里则恢复，处理，再写入跳转指令。

而在WIN9X则完全不同，要用未公开的WIN16函数allocCStoDsAlise
--- 我现在也没做好WIN16的程序，卡在32/16混合编程上了。

可以去各大BBS站搜索一下屏幕取词技术，基本都是两年前的文章 :O

[zeatul]

能借阅一下，for NT 的源程序吗。
allocCStoDsAlise 能用来改TextOutW()的代码吗，否则不能支持IE。
faint!, 我上一篇怎么被删掉了。

[continue]

每次调用API都要重读写系统内存好几次，很慢的。

[stamf]

看看http://www.searon.com/octopus/Diskprt.zip，这是"网吧管理专家"自带的一个硬盘防删除插件，据作者说，采用的是API调用拦截，没有使用vxd。

当程序载入内存以后，自动切入2G以上的系统内存，并将自带的Dll载入高端内存区，修改Openfile(),Writefile()等等Windows API的指向，用自带的Dll里面的函数替换他们达到拦截API调用的目的。

整个程序压缩以后才20多K，那家伙太厉害了

[huiyugan]

你说的是要对全局的其他进程都有效是吧？那你的钩子CallBack函数是放在一个动态连接库了，当你的回调函数要和你的程序通信时，你必须保证你的动态连接库和应用程序交换数据用到的变量是在你的两个进程都能存取到的区域，这样你可以用内存映射文件来实现。

[buding]

关注