»áÔ±£º ÃÜÂ룺 ¡¡Ãâ·Ñ×¢²á | Íü¼ÇÃÜÂë | »áÔ±µÇ¼ ÍøÒ³¹¦ÄÜ£º ¼ÓÈëÊÕ²Ø ÉèΪÊ×Ò³ ÍøÕ¾ËÑË÷  
 °²È«¼¼Êõ¼¼ÊõÎĵµ
  ¡¤ °²È«ÅäÖÆ
  ¡¤ ¹¤¾ß½éÉÜ
  ¡¤ ºÚ¿Í½Ìѧ
  ¡¤ ·À»ðǽ
  ¡¤ Â©¶´·ÖÎö
  ¡¤ ÆƽâרÌâ
  ¡¤ ºÚ¿Í±à³Ì
  ¡¤ ÈëÇÖ¼ì²â
 °²È«¼¼ÊõÂÛ̳
  ¡¤ °²È«ÅäÖÆ
  ¡¤ ¹¤¾ß½éÉÜ
  ¡¤ ·À»ðǽ
  ¡¤ ºÚ¿ÍÈëÇÖ
  ¡¤ Â©¶´¼ì²â
  ¡¤ Æƽⷽ·¨
  ¡¤ É±¶¾×¨Çø
 °²È«¼¼Êõ¹¤¾ßÏÂÔØ
  ¡¤ É¨Ã蹤¾ß
  ¡¤ ¹¥»÷³ÌÐò
  ¡¤ ºóÃÅľÂí
  ¡¤ ¾Ü¾ø·þÎñ
  ¡¤ ¿ÚÁîÆƽâ
  ¡¤ ´úÀí³ÌÐò
  ¡¤ ·À»ðǽ
  ¡¤ ¼ÓÃܽâÃÜ
  ¡¤ ÈëÇÖ¼ì²â
  ¡¤ ¹¥·ÀÑÝʾ
¼¼ÊõÎĵµ > Delphi
Êó±êÆÁĻȡ´Ê¼¼ÊõµÄÔ­ÀíºÍʵÏÖ
·¢±íÈÕÆÚ£º2003-05-28 00:00:00×÷Õߣº° ³ö´¦£º  

  ¡°Êó±êÆÁĻȡ´Ê¡±¼¼ÊõÊÇÔÚµç×Ó×ÖµäÖеõ½¹ã·ºµØÓ¦Óõģ¬ÈçËÄͨÀû·½ºÍ½ðɽ´Ê°ÔµÈÈí¼þ£¬Õâ¸ö¼¼Êõ¿´ËƼòµ¥£¬ÆäʵÔÚwindowsϵͳÖÐʵÏÖÈ´ÊǷdz£¸´Ôӵģ¬×ܵÄÀ´ËµÓÐÁ½ÖÖʵÏÖ·½Ê½£º

  µÚÒ»ÖÖ£º²ÉÓýػñ¶Ô²¿·ÖgdiµÄapiµ÷ÓÃÀ´ÊµÏÖ,Èçtextout,textoutaµÈ¡£

  µÚ¶þÖÖ£º¶Ôÿ¸öÉ豸ÉÏÏÂÎÄ(dc)×öÒ»·Öcopy,²¢¸ú×ÙËùÓÐÐÞ¸ÄÉÏÏÂÎÄ(dc)µÄ²Ù×÷¡£   

  µÚ¶þÖÖ·½·¨¸üÇ¿´ó,µ«¼æÈÝÐÔ²»ºÃ£¬¶øµÚÒ»ÖÖ·½·¨Ê¹ÓõĽػñwindowsapiµÄµ÷Óã¬ÕâÏî¼¼ÊõµÄÇ¿´ó¿ÉÄÜÔ¶Ô¶³¬³öÁËÄúµÄÏëÏ󣬺Á²»¿äÕŵÄ˵£¬ÀûÓÃwindowsapiÀ¹½Ø¼¼Êõ£¬Äã¿ÉÒÔ¸ÄÔìÕû¸ö²Ù×÷ϵͳ£¬ÊÂʵÉϺܶàÍâ¹ÒʽwindowsÖÐÎÄƽ̨¾ÍÊÇÕâôʵÏֵģ¡¶øÕâÏî¼¼ÊõÒ²ÕýÊÇÕâƪÎÄÕµÄÖ÷Ìâ¡£

  ½ØwindowsapiµÄµ÷Ó㬾ßÌåµÄ˵À´Ò²¿ÉÒÔ·ÖΪÁ½ÖÖ·½·¨£º

  µÚÒ»ÖÖ·½·¨Í¨¹ýÖ±½Ó¸Äдwinapi ÔÚÄÚ´æÖеÄÓ³Ïñ£¬Ç¶Èë»ã±à´úÂ룬ʹ֮±»µ÷ÓÃʱÌøתµ½Ö¸¶¨µÄµØÖ·ÔËÐÐÀ´½Ø»ñ£»µÚ¶þÖÖ·½·¨Ôò¸Äдiat£¨import address table ÊäÈëµØÖ·±í£©£¬Öض¨Ïòwinapiº¯ÊýµÄµ÷ÓÃÀ´ÊµÏÖ¶ÔwinapiµÄ½Ø»ñ¡£

  µÚÒ»ÖÖ·½·¨µÄʵÏÖ½ÏΪ·±Ëö£¬¶øÇÒÔÚwin95¡¢98ÏÂÃæ¸üÓÐÄѶȣ¬ÕâÊÇÒòΪËäȻ΢Èí˵win16µÄapiÖ»ÊÇΪÁ˼æÈÝÐԲű£ÁôÏÂÀ´£¬³ÌÐòÔ±Ó¦¸Ã¾¡¿ÉÄܵص÷ÓÃ32λµÄapi,ʵ¼ÊÉϸù±¾¾Í²»ÊÇÕâÑù£¡win 9xÄÚ²¿µÄ´ó²¿·Ö32λapi¾­¹ý±ä»»µ÷ÓÃÁËͬÃûµÄ16λapi£¬Ò²¾ÍÊÇ˵ÎÒÃÇÐèÒªÔÚÀ¹½ØµÄº¯ÊýÖÐǶÈë16λ»ã±à´úÂ룡

  ÎÒÃǽ«Òª½éÉܵÄÊǵڶþÖÖÀ¹½Ø·½·¨£¬ÕâÖÖ·½·¨ÔÚwin95¡¢98ºÍntÏÂÃæÔËÐж¼±È½ÏÎȶ¨£¬¼æÈÝÐԽϺá£ÓÉÓÚÐèÒªÓõ½¹ØÓÚwindowsÐéÄâÄÚ´æµÄ¹ÜÀí¡¢´òÆƽø³Ì±ß½çǽ¡¢ÏòÓ¦ÓóÌÐòµÄ½ø³Ì¿Õ¼äÖÐ×¢Èë´úÂë¡¢pe£¨portable executable£©Îļþ¸ñʽºÍiat£¨ÊäÈëµØÖ·±í£©µÈ½Ïµ×²ãµÄ֪ʶ£¬ËùÒÔÎÒÃÇÏȶÔÉæ¼°µ½µÄÕâЩ֪ʶ´ó¸ÅµØ×öÒ»¸ö½éÉÜ£¬×îºó»á¸ø³öÀ¹½Ø²¿·ÖµÄ¹Ø¼ü´úÂë¡£

   ÏÈ˵windowsÐéÄâÄÚ´æµÄ¹ÜÀí¡£windows9x¸øÿһ¸ö½ø³Ì·ÖÅäÁË4gbµÄµØÖ·¿Õ¼ä£¬¶ÔÓÚntÀ´Ëµ£¬Õâ¸öÊý×ÖÊÇ2gb£¬ÏµÍ³±£ÁôÁË2gbµ½ 4gbÖ®¼äµÄµØÖ·¿Õ¼ä½ûÖ¹½ø³Ì·ÃÎÊ£¬¶øÔÚwin9xÖУ¬2gbµ½4gbÕⲿ·ÖÐéÄâµØÖ·¿Õ¼äʵ¼ÊÉÏÊÇÓÉËùÓеÄwin32½ø³ÌËù¹²ÏíµÄ£¬Õⲿ·ÖµØÖ·¿Õ¼ä¼ÓÔØÁ˹²Ïíwin32 dll¡¢ÄÚ´æÓ³ÉäÎļþºÍvxd¡¢ÄÚ´æ¹ÜÀíÆ÷ºÍÎļþϵͳÂ룬win9xÖÐÕⲿ·Ö¶ÔÓÚÿһ¸ö½ø³Ì¶¼ÊǿɼûµÄ£¬ÕâÒ²ÊÇwin9x²Ù×÷ϵͳ²»¹»½¡×³µÄÔ­Òò¡£win9xÖÐΪ16λ²Ù×÷ϵͳ±£ÁôÁË0µ½4mbµÄµØÖ·¿Õ¼ä£¬¶øÔÚ4mbµ½2gbÖ®¼äÒ²¾ÍÊÇwin32½ø³Ì˽ÓеĵØÖ·¿Õ¼ä£¬ÓÉÓÚ Ã¿¸ö½ø³ÌµÄµØÖ·¿Õ¼ä¶¼ÊÇÏà¶Ô¶ÀÁ¢µÄ£¬Ò²¾ÍÊÇ˵£¬Èç¹û³ÌÐòÏë½Ø»ñÆäËü½ø³ÌÖеÄapiµ÷Ó㬾ͱØÐë´òÆƽø³Ì±ß½çǽ£¬ÏòÆäËüµÄ½ø³ÌÖÐ×¢Èë½Ø»ñapiµ÷ÓõĴúÂ룬ÕâÏ×÷ÎÒÃǽ»¸ø¹³×Óº¯Êý£¨setwindowshookex£©À´Íê³É£¬¹ØÓÚÈçºÎ´´½¨Ò»¸ö°üº¬ÏµÍ³¹³×ӵĶ¯Ì¬Á´½Ó¿â£¬¡¶µçÄÔ¸ßÊÖÔÓÖ¾¡·ÔÚµÚ£¿ÆÚÒѾ­ÓйýרÌâ½éÉÜÁË£¬ÕâÀï¾Í²»×¸ÊöÁË¡£ËùÓÐϵͳ¹³×ӵĺ¯Êý±ØÐëÒªÔÚ¶¯Ì¬¿âÀÕâÑùµÄ»°£¬µ±½ø³ÌÒþʽ»òÏÔʽµ÷ÓÃÒ»¸ö¶¯Ì¬¿âÀïµÄº¯Êýʱ£¬ÏµÍ³»á°ÑÕâ¸ö¶¯Ì¬¿âÓ³Éäµ½Õâ¸ö½ø³ÌµÄÐéÄâµØÖ·¿Õ¼äÀÕâʹµÃdll³ÉΪ½ø³ÌµÄÒ»²¿·Ö£¬ÒÔÕâ¸ö½ø³ÌµÄÉí·ÝÖ´ÐУ¬Ê¹ÓÃÕâ¸ö½ø³ÌµÄ¶ÑÕ»£¬Ò²¾ÍÊÇ˵¶¯Ì¬Á´½Ó¿âÖеĴúÂë±»¹³×Óº¯Êý×¢ÈëÁËÆäËügui½ø³ÌµÄµØÖ·¿Õ¼ä£¨·Çgui½ø³Ì£¬¹³×Óº¯Êý¾ÍÎÞÄÜΪÁ¦ÁË£©£¬

µ±°üº¬¹³×ÓµÄdll×¢ÈëÆäËü½ø³Ìºó£¬¾Í¿ÉÒÔÈ¡µÃÓ³Éäµ½Õâ¸ö½ø³ÌÐéÄâÄÚ´æÀïµÄ¸÷¸öÄ£¿é£¨exeºÍdll£©µÄ»ùµØÖ·£¬È磺

hmodule hmodule=getmodulehandle(¡°mypro.exe¡±);

ÔÚmfc³ÌÐòÖÐ,ÎÒÃÇ¿ÉÒÔÓÃafxgetinstancehandle()º¯ÊýÀ´µÃµ½Ä£¿éµÄ»ùµØÖ·¡£exeºÍdll±»Ó³Éäµ½ÐéÄâÄÚ´æ¿Õ¼äµÄʲôµØ·½ÊÇÓÉËüÃǵĻùµØÖ·¾ö¶¨µÄ¡£ËüÃǵĻùµØÖ·ÊÇÔÚÁ´½ÓʱÓÉÁ´½ÓÆ÷¾ö¶¨µÄ¡£µ±Äãн¨Ò»¸öwin32¹¤³Ìʱ£¬vc£«£«Á´½ÓÆ÷ʹÓÃȱʡµÄ»ùµØÖ·0x00400000¡£¿ÉÒÔͨ¹ýÁ´½ÓÆ÷µÄbaseÑ¡Ïî¸Ä±äÄ£¿éµÄ»ùµØÖ·¡£exeͨ³£±»Ó³Éäµ½ÐéÄâÄÚ´æµÄ0x00400000´¦£¬dllÒ²ËæÖ®Óв»Í¬µÄ»ùµØÖ·£¬Í¨³£±»Ó³Éäµ½²»Í¬½ø³Ì

µÄÏàͬµÄÐéÄâµØÖ·¿Õ¼ä´¦¡£

ϵͳ½«exeºÍdllÔ­·â²»¶¯Ó³Éäµ½ÐéÄâÄÚ´æ¿Õ¼äÖУ¬ËüÃÇÔÚÄÚ´æÖеĽṹÓë´ÅÅÌÉϵľ²Ì¬Îļþ½á¹¹ÊÇÒ»ÑùµÄ¡£¼´pe (portable executable) Îļþ¸ñʽ¡£ÎÒÃǵõ½Á˽ø³ÌÄ£¿éµÄ»ùµØÖ·ÒԺ󣬾ͿÉÒÔ¸ù¾ÝpeÎļþµÄ¸ñʽÇî¾ÙÕâ¸öÄ£¿éµÄimage_import_descriptorÊý×飬¿´¿´½ø³Ì¿Õ¼äÖÐÊÇ·ñÒýÈëÁËÎÒÃÇÐèÒª½Ø»ñµÄº¯ÊýËùÔڵĶ¯Ì¬Á´½Ó¿â£¬±ÈÈçÐèÒª½Ø»ñ¡°textouta¡±£¬¾Í±ØÐë¼ì²é¡°gdi32.dll¡±ÊÇ·ñ±»ÒýÈëÁË¡£Ëµµ½ÕâÀÎÒÃÇÓбØÒª½éÉÜÒ»ÏÂpeÎļþµÄ¸ñʽ£¬ÈçÓÒͼ£¬ÕâÊÇpeÎļþ¸ñʽµÄ´óÖ¿òͼ£¬×îÇ°ÃæÊÇÎļþÍ·£¬ÎÒÃDz»±ØÀí»á£¬´Ópe file optional headerºóÃ濪ʼ£¬¾ÍÊÇÎļþÖи÷¸ö¶ÎµÄ˵Ã÷£¬ËµÃ÷ºóÃæ²ÅÊÇÕæÕýµÄ¶ÎÊý¾Ý£¬¶øʵ¼ÊÉÏÎÒÃǹØÐĵÄÖ»ÓÐÒ»¸ö¶Î£¬ÄǾÍÊÇ¡°.idata¡±¶Î£¬Õâ¸ö¶ÎÖаüº¬ÁËËùÓеÄÒýÈ뺯ÊýÐÅÏ¢£¬»¹ÓÐiat£¨import address table£©µÄrva£¨relative virtual address£©µØÖ·¡£

˵µ½ÕâÀ½Ø»ñwindowsapiµÄÕû¸öÔ­Àí¾ÍÒªÕæÏà´ó°×ÁË¡£Êµ¼ÊÉÏËùÓнø³Ì¶Ô¸ø¶¨µÄapiº¯ÊýµÄµ÷ÓÃ×ÜÊÇͨ¹ýpeÎļþµÄÒ»¸öµØ·½À´×ªÒƵģ¬Õâ¾ÍÊÇÒ»¸ö¸ÃÄ£¿é(¿ÉÒÔÊÇexe»òdll)µÄ¡°.idata¡±¶ÎÖеÄiatÊäÈëµØÖ·±í£¨import address table£©¡£ÔÚÄÇÀïÓÐËùÓб¾Ä£¿éµ÷ÓõÄÆäËüdllµÄº¯ÊýÃû¼°µØÖ·¡£¶ÔÆäËüdllµÄº¯Êýµ÷ÓÃʵ¼ÊÉÏÖ»ÊÇÌøתµ½ÊäÈëµØÖ·±í£¬ÓÉÊäÈëµØÖ·±íÔÙÌøתµ½dllÕæÕýµÄº¯ÊýÈë¿Ú¡£

¾ßÌåÀ´Ëµ£¬ÎÒÃǽ«Í¨¹ýimage_import_descriptorÊý×éÀ´·ÃÎÊ¡°.idata¡±¶ÎÖÐÒýÈëµÄdllµÄÐÅÏ¢£¬È»ºóͨ¹ýimage_thunk_dataÊý×éÀ´Õë¶ÔÒ»¸ö±»ÒýÈëµÄdll·ÃÎʸÃdllÖб»ÒýÈëµÄÿ¸öº¯ÊýµÄÐÅÏ¢£¬ÕÒµ½ÎÒÃÇÐèÒª½Ø»ñµÄº¯ÊýµÄÌøתµØÖ·£¬È»ºó¸Ä³ÉÎÒÃÇ×Ô¼ºµÄº¯ÊýµÄµØÖ·¡­¡­¾ßÌåµÄ×ö·¨ÔÚºóÃæµÄ¹Ø¼ü´úÂëÖлáÓÐÏêϸµÄ½²½â¡£

  ½²ÁËÕâô¶àÔ­Àí£¬ÏÖÔÚÈÃÎÒÃǻص½¡°Êó±êÆÁĻȡ´Ê¡±µÄרÌâÉÏÀ´¡£³ýÁËapiº¯ÊýµÄ½Ø»ñ£¬ÒªÊµÏÖ¡°Êó±êÆÁĻȡ´Ê¡±£¬»¹ÐèÒª×öһЩÆäËüµÄ¹¤×÷£¬¼òµ¥µÄ˵À´£¬¿ÉÒÔ°ÑÒ»¸öÍêÕûµÄÈ¡´Ê¹ý³Ì¹éÄɳÉÒÔϼ¸¸ö²½Ö裺

1£® °²×°Êó±ê¹³×Ó£¬Í¨¹ý¹³×Óº¯Êý»ñµÃÊó±êÏûÏ¢¡£

ʹÓõ½µÄapiº¯Êý£ºsetwindowshookex

2£® µÃµ½Êó±êµÄµ±Ç°Î»Öã¬ÏòÊó±êϵĴ°¿Ú·¢ÖØ»­ÏûÏ¢£¬ÈÃËüµ÷ÓÃϵͳº¯ÊýÖØ»­´°¿Ú¡£

   ʹÓõ½µÄapiº¯Êý£ºwindowfrompoint£¬screentoclient£¬invalidaterect

3£® ½Ø»ñ¶Ôϵͳº¯ÊýµÄµ÷Óã¬È¡µÃ²ÎÊý£¬Ò²¾ÍÊÇÎÒÃÇҪȡµÄ´Ê¡£

¶ÔÓÚ´ó¶àÊýµÄwindowsÓ¦ÓóÌÐòÀ´Ëµ£¬Èç¹ûҪȡ´Ê£¬ÎÒÃÇÐèÒª½Ø»ñµÄÊÇ¡°gdi32.dll¡±Öеġ°textouta¡±º¯Êý¡£

ÎÒÃÇÏÈ·ÂÕÕtextoutaº¯Êýдһ¸ö×Ô¼ºµÄmytextoutaº¯Êý£¬È磺

bool winapi mytextouta(hdc hdc, int nxstart, int nystart, lpcstr lpszstring,int cbstring)

{

    // ÕâÀï½øÐÐÊä³ölpszstringµÄ´¦Àí

      // È»ºóµ÷ÓÃÕý°æµÄtextoutaº¯Êý

}

°ÑÕâ¸öº¯Êý·ÅÔÚ°²×°Á˹³×ӵĶ¯Ì¬Á¬½Ó¿âÖУ¬È»ºóµ÷ÓÃÎÒÃÇ×îºó¸ø³öµÄhookimportfunctionº¯ÊýÀ´½Ø»ñ½ø³Ì

¶Ôtextoutaº¯ÊýµÄµ÷Óã¬Ìøתµ½ÎÒÃǵÄmytextoutaº¯Êý£¬Íê³É¶ÔÊä³ö×Ö·û´®µÄ²¶×½¡£hookimportfunctionµÄ

Ó÷¨£º

hookfuncdesc hd;

proc     porigfuns;

hd.szfunc="textouta";

hd.pproc=(proc)mytextouta;

hookimportfunction (afxgetinstancehandle(),"gdi32.dll",&hd,porigfuns);

ÏÂÃæ¸ø³öÁËhookimportfunctionµÄÔ´´úÂ룬ÏàÐÅÏ꾡µÄ×¢ÊÍÒ»¶¨²»»áÈÃÄú¾õµÃÀí½â½Ø»ñµ½µ×ÊÇÔõôʵÏÖµÄ

ºÜÄÑ£¬ok,let¡¯s go£º

///////////////////////////////////////////// begin ///////////////////////////////////////////////////////////////

#include <crtdbg.h>

// ÕâÀﶨÒåÁËÒ»¸ö²úÉúÖ¸ÕëµÄºê

#define makeptr(cast, ptr, addvalue) (cast)((dword)(ptr)+(dword)(addvalue))

// ¶¨ÒåÁËhookfuncdesc½á¹¹,ÎÒÃÇÓÃÕâ¸ö½á¹¹×÷Ϊ²ÎÊý´«¸øhookimportfunctionº¯Êý

typedef struct tag_hookfuncdesc

{

 lpcstr szfunc; // the name of the function to hook.

 proc pproc;  // the procedure to blast in.

} hookfuncdesc , * lphookfuncdesc;

// Õâ¸öº¯Êý¼à²âµ±Ç°ÏµÍ³ÊÇ·ñÊÇwindownt

bool isnt();

// Õâ¸öº¯ÊýµÃµ½hmodule -- ¼´ÎÒÃÇÐèÒª½Ø»ñµÄº¯ÊýËùÔÚµÄdllÄ£¿éµÄÒýÈëÃèÊö·û(import descriptor)

pimage_import_descriptor getnamedimportdescriptor(hmodule hmodule, lpcstr szimportmodule);

// ÎÒÃǵÄÖ÷º¯Êý

bool hookimportfunction(hmodule hmodule, lpcstr szimportmodule,

             lphookfuncdesc pahookfunc, proc* paorigfuncs)

{

/////////////////////// ÏÂÃæµÄ´úÂë¼ì²â²ÎÊýµÄÓÐЧÐÔ ////////////////////////////

_assert(szimportmodule);

_assert(!isbadreadptr(pahookfunc, sizeof(hookfuncdesc)));

#ifdef _debug

if (paorigfuncs) _assert(!isbadwriteptr(paorigfuncs, sizeof(proc)));

_assert(pahookfunc.szfunc);

_assert(*pahookfunc.szfunc != '\0');

    _assert(!isbadcodeptr(pahookfunc.pproc));

#endif

if ((szimportmodule == null) || (isbadreadptr(pahookfunc, sizeof(hookfuncdesc))))

{

 _assert(false);

 setlasterrorex(error_invalid_parameter, sle_error);

 return false;

}

//////////////////////////////////////////////////////////////////////////////

// ¼à²âµ±Ç°Ä£¿éÊÇ·ñÊÇÔÚ2gbÐéÄâÄÚ´æ¿Õ¼äÖ®ÉÏ

// Õⲿ·ÖµÄµØÖ·ÄÚ´æÊÇÊôÓÚwin32½ø³Ì¹²ÏíµÄ

if (!isnt() && ((dword)hmodule >= 0x80000000))

{

 _assert(false);

 setlasterrorex(error_invalid_handle, sle_error);

 return false;

}

   // ÇåÁã

if (paorigfuncs) memset(paorigfuncs, null, sizeof(proc));

// µ÷ÓÃgetnamedimportdescriptor()º¯Êý,À´µÃµ½hmodule -- ¼´ÎÒÃÇÐèÒª

// ½Ø»ñµÄº¯ÊýËùÔÚµÄdllÄ£¿éµÄÒýÈëÃèÊö·û(import descriptor)

pimage_import_descriptor pimportdesc = getnamedimportdescriptor(hmodule, szimportmodule);

if (pimportdesc == null)

return false; // ÈôΪ¿Õ,ÔòÄ£¿éδ±»µ±Ç°½ø³ÌËùÒýÈë

// ´ÓdllÄ£¿éÖеõ½Ô­Ê¼µÄthunkÐÅÏ¢,ÒòΪpimportdesc->firstthunkÊý×éÖеÄԭʼÐÅÏ¢ÒѾ­

// ÔÚÓ¦ÓóÌÐòÒýÈë¸Ãdllʱ¸²¸ÇÉÏÁËËùÓеÄÒýÈëÐÅÏ¢,ËùÒÔÎÒÃÇÐèҪͨ¹ýÈ¡µÃpimportdesc->originalfirstthunk

// Ö¸ÕëÀ´·ÃÎÊÒýÈ뺯ÊýÃûµÈÐÅÏ¢

pimage_thunk_data porigthunk = makeptr(pimage_thunk_data, hmodule,

                        pimportdesc->originalfirstthunk);

// ´Ópimportdesc->firstthunkµÃµ½image_thunk_dataÊý×éµÄÖ¸Õë,ÓÉÓÚÕâÀïÔÚdll±»ÒýÈëʱÒѾ­Ìî³äÁË

// ËùÓеÄÒýÈëÐÅÏ¢,ËùÒÔÕæÕýµÄ½Ø»ñʵ¼ÊÉÏÕýÊÇÔÚÕâÀï½øÐеÄ

pimage_thunk_data prealthunk = makeptr(pimage_thunk_data, hmodule, pimportdesc->firstthunk);

// Çî¾Ùimage_thunk_dataÊý×é,Ñ°ÕÒÎÒÃÇÐèÒª½Ø»ñµÄº¯Êý,ÕâÊÇ×î¹Ø¼üµÄ²¿·Ö!

while (porigthunk->u1.function)

{

 // ֻѰÕÒÄÇЩ°´º¯ÊýÃû¶ø²»ÊÇÐòºÅÒýÈëµÄº¯Êý

 if (image_ordinal_flag != (porigthunk->u1.ordinal & image_ordinal_flag))

 {

  // µÃµ½ÒýÈ뺯ÊýµÄº¯ÊýÃû

  pimage_import_by_name pbyname = makeptr(pimage_import_by_name, hmodule,

        porigthunk->u1.addressofdata);

  // Èç¹ûº¯ÊýÃûÒÔnull¿ªÊ¼,Ìø¹ý,¼ÌÐøÏÂÒ»¸öº¯Êý 

  if ('\0' == pbyname->name[0])

  continue;

  // bdohookÓÃÀ´¼ì²éÊÇ·ñ½Ø»ñ³É¹¦

  bool bdohook = false;

  // ¼ì²éÊÇ·ñµ±Ç°º¯ÊýÊÇÎÒÃÇÐèÒª½Ø»ñµÄº¯Êý

  if ((pahookfunc.szfunc[0] == pbyname->name[0]) &&

  (strcmpi(pahookfunc.szfunc, (char*)pbyname->name) == 0))

  {

  // ÕÒµ½ÁË!

  if (pahookfunc.pproc)

  bdohook = true;

  }

  if (bdohook)

  {

  // ÎÒÃÇÒѾ­ÕÒµ½ÁËËùÒª½Ø»ñµÄº¯Êý,ÄÇô¾Í¿ªÊ¼¶¯ÊÖ°É

  // Ê×ÏÈÒª×öµÄÊǸıäÕâÒ»¿éÐéÄâÄÚ´æµÄÄÚ´æ±£»¤×´Ì¬,ÈÃÎÒÃÇ¿ÉÒÔ×ÔÓÉ´æÈ¡

  memory_basic_information mbi_thunk;

  virtualquery(prealthunk, &mbi_thunk, sizeof(memory_basic_information));

  _assert(virtualprotect(mbi_thunk.baseaddress, mbi_thunk.regionsize,

            page_readwrite, &mbi_thunk.protect));

  // ±£´æÎÒÃÇËùÒª½Ø»ñµÄº¯ÊýµÄÕýÈ·ÌøתµØÖ·

  if (paorigfuncs)

   paorigfuncs = (proc)prealthunk->u1.function;

  // ½«image_thunk_dataÊý×éÖеĺ¯ÊýÌøתµØÖ·¸ÄдΪÎÒÃÇ×Ô¼ºµÄº¯ÊýµØÖ·!

  // ÒÔºóËùÓнø³Ì¶ÔÕâ¸öϵͳº¯ÊýµÄËùÓе÷Óö¼½«³ÉΪ¶ÔÎÒÃÇ×Ô¼º±àдµÄº¯ÊýµÄµ÷ÓÃ

  prealthunk->u1.function = (pdword)pahookfunc.pproc;

  // ²Ù×÷Íê±Ï!½«ÕâÒ»¿éÐéÄâÄÚ´æ¸Ä»ØÔ­À´µÄ±£»¤×´Ì¬

  dword dwoldprotect;

  _assert(virtualprotect(mbi_thunk.baseaddress, mbi_thunk.regionsize,

            mbi_thunk.protect, &dwoldprotect));

  setlasterror(error_success);

  return true;

  }

 }

 // ·ÃÎÊimage_thunk_dataÊý×éÖеÄÏÂÒ»¸öÔªËØ

 porigthunk++;

 prealthunk++;

}

return true;

}

// getnamedimportdescriptorº¯ÊýµÄʵÏÖ

pimage_import_descriptor getnamedimportdescriptor(hmodule hmodule, lpcstr szimportmodule)

{

// ¼ì²â²ÎÊý

_assert(szimportmodule);

_assert(hmodule);

if ((szimportmodule == null) || (hmodule == null))

{

 _assert(false);

 setlasterrorex(error_invalid_parameter, sle_error);

 return null;

}

// µÃµ½dosÎļþÍ·

pimage_dos_header pdosheader = (pimage_dos_header) hmodule;

// ¼ì²âÊÇ·ñmzÎļþÍ·

if (isbadreadptr(pdosheader, sizeof(image_dos_header)) ||

 (pdosheader->e_magic != image_dos_signature))

{

 _assert(false);

 setlasterrorex(error_invalid_parameter, sle_error);

 return null;

}

// È¡µÃpeÎļþÍ·

pimage_nt_headers pntheader = makeptr(pimage_nt_headers, pdosheader, pdosheader->e_lfanew);

// ¼ì²âÊÇ·ñpeÓ³ÏñÎļþ

if (isbadreadptr(pntheader, sizeof(image_nt_headers)) ||

  (pntheader->signature != image_nt_signature))

{

 _assert(false);

 setlasterrorex(error_invalid_parameter, sle_error);

 return null;

}

// ¼ì²épeÎļþµÄÒýÈë¶Î(¼´ .idata section)

if (pntheader->optionalheader.datadirectory[image_directory_entry_import].virtualaddress == 0)

 return null;

// µÃµ½ÒýÈë¶Î(¼´ .idata section)µÄÖ¸Õë

pimage_import_descriptor pimportdesc = makeptr(pimage_import_descriptor, pdosheader,

 pntheader->optionalheader.datadirectory[image_directory_entry_import].virtualaddress);

// Çî¾Ùpimage_import_descriptorÊý×éÑ°ÕÒÎÒÃÇÐèÒª½Ø»ñµÄº¯ÊýËùÔÚµÄÄ£¿é

while (pimportdesc->name)

{

 pstr szcurrmod = makeptr(pstr, pdosheader, pimportdesc->name);

 if (stricmp(szcurrmod, szimportmodule) == 0)

   break; // ÕÒµ½!ÖжÏÑ­»·

 // ÏÂÒ»¸öÔªËØ

 pimportdesc++;

}

// Èç¹ûûÓÐÕÒµ½,˵Ã÷ÎÒÃÇÑ°ÕÒµÄÄ£¿éûÓб»µ±Ç°µÄ½ø³ÌËùÒýÈë!

if (pimportdesc->name == null)

 return null;

// ·µ»Øº¯ÊýËùÕÒµ½µÄÄ£¿éÃèÊö·û(import descriptor)

return pimportdesc;

}

// isnt()º¯ÊýµÄʵÏÖ

bool isnt()

{

osversioninfo stosvi;

memset(&stosvi, null, sizeof(osversioninfo));

stosvi.dwosversioninfosize = sizeof(osversioninfo);

bool bret = getversionex(&stosvi);

_assert(true == bret);

if (false == bret) return false;

return (ver_platform_win32_nt == stosvi.dwplatformid);

}

/////////////////////////////////////////////// end //////////////////////////////////////////////////////////////////////

  ²»ÖªµÀÔÚÕâƪÎÄÕÂÎÊÊÀ֮ǰ£¬ÓжàÉÙÅóÓѳ¢ÊÔ¹ýȥʵÏÖ¡°Êó±êÆÁĻȡ´Ê¡±ÕâÏî³äÂúÁËÌôÕ½µÄ¼¼Êõ£¬Ò²Ö»Óг¢ÊÔ¹ýµÄÅóÓѲÅÄÜÌå»áµ½Æä¼äµÄ²»Ò×£¬ÓÈÆäÔÚ̽Ë÷apiº¯ÊýµÄ½Ø»ñʱ£¬ÊÖÍ·µÄ¼¸Æª×ÊÁÏûÓÐһƪÊÇÉæ¼°µ½¹Ø¼ü´úÂëµÄ£¬ÖØÒªµÄµØ·½¶¼ÊÇÒ»±Ê´ú¹ý£¬msdn¸üÊÇÏԵò԰׶øÎÞÁ¦£¬Ò²²»ÖªµÀ³ýÁËimage_import_descriptorºÍimage_thunk_data£¬Î¢Èí»¹Òþ²ØÁ˶àÉÙÃØÃÜ£¬ºÃÔÚÓ²×ÅͷƤ»¹ÊÇ°ÑËü¸ø¹¥¿ËÁË£¬Ï£ÍûÕâƪÎÄÕ¶Դó¼ÒÄÜÓÐËù°ïÖú¡£

¡¾·µ»Ø¶¥²¿¡¿ ¡¾´òÓ¡±¾Ò³¡¿ ¡¾¹Ø±Õ´°¿Ú¡¿

¹ØÓÚÎÒÃÇ / ¸øÎÒÁôÑÔ / °æȨ¾Ù±¨ / Òâ¼û½¨Òé / ÍøÕ¾±à³ÌQQȺ   
Copyright ©2003- 2024 Lihuasoft.net webmaster(at)lihuasoft.net ¼ÓÔØʱ¼ä 0.00167