void CxdApiHookBasic::ReplaceAllModuleIATEntry( HANDLE hProcess, LPCSTR lpszDllName, LPVOID pfnCurrent, LPVOID pfnNew )
{
HMODULE hMods[1024] = {0};
DWORD cbNeeded;
if ( 0 == hProcess )
{
hProcess = ::GetCurrentProcess();
}
if( ::EnumProcessModules( hProcess, hMods, sizeof(hMods), &cbNeeded))
{
for ( UINT i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
{
ReplaceIATEntryInImageImportTable( hProcess, hMods[i], lpszDllName, pfnCurrent, pfnNew );
}
}
}BOOL CxdApiHookBasic::ReplaceIATEntryInImageImportTable( HANDLE hProcess, HANDLE hModCaller, LPCSTR lpszDllName, LPVOID pfnCurrent, LPVOID pfnNew )
{
ASSERT(hModCaller && lpszDllName && pfnCurrent && pfnNew );
//PIMAGE_IMPORT_DESCRIPTOR -> IMAGE_DIRECTORY_ENTRY_IMPORT
if ( 0 == hProcess )
{
hProcess = ::GetCurrentProcess();
}
DWORD dwSize = 0;
PIMAGE_SECTION_HEADER pFoundHeader = NULL;
PIMAGE_IMPORT_DESCRIPTOR pImgImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToDataEx( hModCaller, TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT, &dwSize, &pFoundHeader );
if( pImgImportDescriptor == NULL )
{
return FALSE;
} while (pImgImportDescriptor->Name)
{
if ( _strcmpi((CHAR*)((PBYTE)hModCaller+pImgImportDescriptor->Name), lpszDllName) == 0 )
{
break; // found
}
++pImgImportDescriptor;
}
// NOTE:
// If the special module can not be found in IMAGE_DIRECTORY_ENTRY_IMPORT
// Then should try to search it in IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT
if( !pImgImportDescriptor->Name )
{
return ReplaceIATEntryInDelayImageImportTable( hProcess, hModCaller, lpszDllName, pfnCurrent, pfnNew);
} // retrieve IAT
PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)(((LPBYTE)hModCaller) + pImgImportDescriptor->FirstThunk); // enumerate functions in the IAT
while( pThunk->u1.Function )
{
PDWORD lpAddr = (PDWORD)&(pThunk->u1.Function);
if(*lpAddr == (DWORD)pfnCurrent)
{
// modify the address
::WriteProcessMemory( hProcess, lpAddr, &pfnNew, sizeof(DWORD), NULL );
return TRUE;
}
pThunk++;
}
return FALSE;
}
想要的功能 Hook自己程序的wb 并修改 数据包 WB有多线程下不冲突 谢谢
{
HMODULE hMods[1024] = {0};
DWORD cbNeeded;
if ( 0 == hProcess )
{
hProcess = ::GetCurrentProcess();
}
if( ::EnumProcessModules( hProcess, hMods, sizeof(hMods), &cbNeeded))
{
for ( UINT i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
{
ReplaceIATEntryInImageImportTable( hProcess, hMods[i], lpszDllName, pfnCurrent, pfnNew );
}
}
}BOOL CxdApiHookBasic::ReplaceIATEntryInImageImportTable( HANDLE hProcess, HANDLE hModCaller, LPCSTR lpszDllName, LPVOID pfnCurrent, LPVOID pfnNew )
{
ASSERT(hModCaller && lpszDllName && pfnCurrent && pfnNew );
//PIMAGE_IMPORT_DESCRIPTOR -> IMAGE_DIRECTORY_ENTRY_IMPORT
if ( 0 == hProcess )
{
hProcess = ::GetCurrentProcess();
}
DWORD dwSize = 0;
PIMAGE_SECTION_HEADER pFoundHeader = NULL;
PIMAGE_IMPORT_DESCRIPTOR pImgImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToDataEx( hModCaller, TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT, &dwSize, &pFoundHeader );
if( pImgImportDescriptor == NULL )
{
return FALSE;
} while (pImgImportDescriptor->Name)
{
if ( _strcmpi((CHAR*)((PBYTE)hModCaller+pImgImportDescriptor->Name), lpszDllName) == 0 )
{
break; // found
}
++pImgImportDescriptor;
}
// NOTE:
// If the special module can not be found in IMAGE_DIRECTORY_ENTRY_IMPORT
// Then should try to search it in IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT
if( !pImgImportDescriptor->Name )
{
return ReplaceIATEntryInDelayImageImportTable( hProcess, hModCaller, lpszDllName, pfnCurrent, pfnNew);
} // retrieve IAT
PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)(((LPBYTE)hModCaller) + pImgImportDescriptor->FirstThunk); // enumerate functions in the IAT
while( pThunk->u1.Function )
{
PDWORD lpAddr = (PDWORD)&(pThunk->u1.Function);
if(*lpAddr == (DWORD)pfnCurrent)
{
// modify the address
::WriteProcessMemory( hProcess, lpAddr, &pfnNew, sizeof(DWORD), NULL );
return TRUE;
}
pThunk++;
}
return FALSE;
}
想要的功能 Hook自己程序的wb 并修改 数据包 WB有多线程下不冲突 谢谢
解决方案 »
- 求VC的数据类型Delphi怎么声明
- 急!线程内动态创建Adoquery出错
- 请教ListView控件怎样可以一项赋两个值?
- 菜鸟求救,当EDIT控件获得焦点的时候触发事件如何写啊?
- 参数combobox1没有默认值 怎么回事
- 请帮我看一下这段程序,谢谢
- 神啊!!!救救我吧!!关于 TCheckbox的问题?
- 藏起来~~藏起来~~藏起来~
- 高手请进来,帮帮忙!dbgrideg的打印问题——打印预览是数据网格全部挤在了一起!
- 各位大侠,请问怎么删除控件???------------》我是菜鸟!!
- TIdTCPServer的客户端断开的问题
- delphi7中如何利用qreport实现的报表中单页小结
有现成的Delphi API Hook库