\n\t\/*———————————–apihook.h——————————————*\/\n<\/p>\n
\n\t#ifndef APIHOOK_H_INCLUDED
\n#define APIHOOK_H_INCLUDED\n<\/p>\n
\n\t#include <windows.h>\n<\/p>\n
\n\tclass APIHook
\n{
\npublic:
\n APIHook();
\n ~APIHook();\n<\/p>\n
\n\t \/\/Set API Info
\n int SetHookAPI(LPSTR _pModuleName,LPSTR _pAPIName,PROC _func);
\n \/\/HOOK API
\n int Hook();
\n \/\/Clear HOOK
\n int UnHook();\n<\/p>\n
\n\tprivate:
\n LPSTR pModuleName; \/\/API\u6240\u5728\u94fe\u63a5\u5e93\u540d\u79f0
\n LPSTR pAPIName; \/\/API\u540d\u79f0
\n PROC pAPIAddress; \/\/API\u5730\u5740
\n PROC func; \/\/\u56de\u8c03\u7684\u51fd\u6570
\n DWORD Previous; \/\/\u4fdd\u5b58\u5185\u5b58\u9875\u8001\u7684\u4fdd\u62a4\u65b9\u5f0f
\n BYTE oldByteData[5]; \/\/\u539f\u51fd\u6570\u5165\u53e3\u4ee3\u7801
\n BYTE newByteData[5]; \/\/\u66f4\u6539\u540e\u7684\u51fd\u6570\u5165\u53e3\u4ee3\u7801
\n};\n<\/p>\n
\n\t#endif \/\/ APIHOOK_H_INCLUDED\n<\/p>\n
\n\t\/*——————————-apihook.cpp——————————————*\/\n<\/p>\n
\n\t \n<\/p>\n
\n\t#include “apihook.h”\n<\/p>\n
\n\tAPIHook::APIHook()
\n{
\n pModuleName=NULL;
\n pAPIName=NULL;
\n pAPIAddress=NULL;
\n memset(oldByteData,NULL,5);
\n memset(newByteData,NULL,5);\n<\/p>\n
\n\t return;
\n}\n<\/p>\n
\n\tAPIHook::~APIHook()
\n{
\n if(pModuleName!=NULL)
\n delete pModuleName;
\n if(pAPIName!=NULL)
\n delete pAPIName;\n<\/p>\n
\n\t return;
\n}\n<\/p>\n
\n\tint APIHook::SetHookAPI(LPSTR _pModuleName,LPSTR _pAPIName,PROC _func)
\n{
\n if(pModuleName!=NULL)
\n return -1;
\n pModuleName=new char(strlen(_pModuleName)+1);
\n pAPIName=new char(strlen(_pAPIName)+1);
\n if(pModuleName==NULL || pAPIName==NULL)
\n return -2;
\n memset(pModuleName,NULL,strlen(_pModuleName)+1);
\n memset(pAPIName,NULL,strlen(_pAPIName)+1);\n<\/p>\n
\n\t strcat(pModuleName,_pModuleName);
\n strcat(pAPIName,_pAPIName);\n<\/p>\n
\n\t this->func=_func;\n<\/p>\n
\n\t return 0;
\n}\n<\/p>\n
\n\tint APIHook::Hook()
\n{
\n DWORD dwNum=0;\n<\/p>\n
\n\t \/\/\u83b7\u53d6\u6307\u5b9a\u6a21\u5757\u4e2d\u7684API\u5730\u5740
\n pAPIAddress=(PROC)GetProcAddress(GetModuleHandle(pModuleName),pAPIName);
\n if(pAPIAddress==NULL)
\n return -1;\n<\/p>\n
\n\t \/\/\u6539\u53d8\u5185\u5b58\u9875\u4fdd\u62a4\u5c5e\u6027
\n VirtualProtect((void *)pAPIAddress,5,PAGE_EXECUTE_READWRITE,&Previous);\n<\/p>\n
\n\t \/\/\u4fdd\u5b58\u8be5\u5730\u5740\u59045\u4e2a\u5b57\u8282\u7684\u5185\u5bb9
\n if(ReadProcessMemory(GetCurrentProcess(),(LPCVOID)pAPIAddress,oldByteData,5,&dwNum)==0)
\n return -2;
\n if(dwNum!=5)
\n return -2;\n<\/p>\n
\n\t \/\/\u6784\u9020JMP\u6307\u4ee4
\n newByteData[0]=0xE9; \/\/jmp code
\n *(DWORD *)(newByteData+1)=(DWORD)func-(DWORD)pAPIAddress-5;\n<\/p>\n
\n\t \/\/\u5c06\u6784\u9020\u597d\u7684JMP\u5730\u5740\u5199\u5165\u5230\u8be5\u5904
\n if(WriteProcessMemory(GetCurrentProcess(),(LPVOID)pAPIAddress,newByteData,5,&dwNum)==0)
\n return -3;\n<\/p>\n
\n\t \/\/\u8fd8\u539f\u9875\u9762\u4fdd\u62a4\u5c5e\u6027
\n VirtualProtect((void *)pAPIAddress,5,Previous,&Previous);
\n FlushInstructionCache(GetCurrentProcess(),0,0);\n<\/p>\n
\n\t if(dwNum!=5)
\n return -3;\n<\/p>\n
\n\t return 0;
\n}\n<\/p>\n
\n\tint APIHook::UnHook()
\n{
\n DWORD dwNum=0;\n<\/p>\n
\n\t if(pAPIAddress==NULL)
\n return 0;\n<\/p>\n
\n\t VirtualProtect((void *) pAPIAddress,5,PAGE_EXECUTE_READWRITE,&Previous);
\n WriteProcessMemory(GetCurrentProcess(),(LPVOID)pAPIAddress,oldByteData,5,&dwNum);
\n VirtualProtect((void *)pAPIAddress,5,Previous,&Previous);\n<\/p>\n
\n\t return 0;
\n}\n<\/p>\n
\n\t \n<\/p>\n
\n\t
\n \n<\/p>\n
\n\t <\/p>\n","protected":false},"excerpt":{"rendered":"
\n\t\/*—————————————-apihook.h————————————————–*\/\n<\/p>\n
\n\t#ifndef APIHOOK_H_INCLUDED
\n#define APIHOOK_H_INCLUDED\n<\/p>\n
\n\t#include <windows.h>\n<\/p>\n
\n\t…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[324],"tags":[],"class_list":["post-133","post","type-post","status-publish","format-standard","hentry"],"yoast_head":"\n