void CxdApiHookBasic::ReplaceAllModuleIATEntry( HANDLE hProcess, LPCSTR lpszDllName, LPVOID pfnCurrent, LPVOID pfnNew )
{
    HMODULE hMods[1024] = {0};  
    DWORD cbNeeded; 
    if ( 0 == hProcess )
    {
        hProcess = ::GetCurrentProcess();  
    }
    if( ::EnumProcessModules( hProcess, hMods, sizeof(hMods), &cbNeeded))  
    {  
        for ( UINT i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )  
        {  
            ReplaceIATEntryInImageImportTable( hProcess, hMods[i], lpszDllName, pfnCurrent, pfnNew );  
        }  
    }  
}BOOL CxdApiHookBasic::ReplaceIATEntryInImageImportTable( HANDLE hProcess, HANDLE hModCaller, LPCSTR lpszDllName, LPVOID pfnCurrent, LPVOID pfnNew )
{
    ASSERT(hModCaller && lpszDllName && pfnCurrent && pfnNew );  
    //PIMAGE_IMPORT_DESCRIPTOR -> IMAGE_DIRECTORY_ENTRY_IMPORT
    if ( 0 == hProcess )
    {
        hProcess = ::GetCurrentProcess();
    }
    DWORD dwSize = 0;  
    PIMAGE_SECTION_HEADER pFoundHeader = NULL;  
    PIMAGE_IMPORT_DESCRIPTOR pImgImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToDataEx( hModCaller, TRUE, 
        IMAGE_DIRECTORY_ENTRY_IMPORT, &dwSize, &pFoundHeader );  
    if( pImgImportDescriptor == NULL )
    { 
        return FALSE; 
    }    while (pImgImportDescriptor->Name)  
    {  
        if ( _strcmpi((CHAR*)((PBYTE)hModCaller+pImgImportDescriptor->Name), lpszDllName) == 0 )  
        {  
            break; // found  
        }  
        ++pImgImportDescriptor;  
    }  
    // NOTE:
    // If the special module can not be found in IMAGE_DIRECTORY_ENTRY_IMPORT
    // Then should try to search it in IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT
    if( !pImgImportDescriptor->Name )  
    {
        return ReplaceIATEntryInDelayImageImportTable( hProcess, hModCaller, lpszDllName, pfnCurrent, pfnNew);  
    }    // retrieve IAT  
    PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)(((LPBYTE)hModCaller) + pImgImportDescriptor->FirstThunk);      // enumerate functions in the IAT
    while( pThunk->u1.Function )
    {    
        PDWORD lpAddr = (PDWORD)&(pThunk->u1.Function);    
        if(*lpAddr == (DWORD)pfnCurrent)    
        {  
            // modify the address
            ::WriteProcessMemory( hProcess, lpAddr, &pfnNew, sizeof(DWORD), NULL );
            return TRUE;  
        }     
        pThunk++;
    }  
    return FALSE;  
}
想要的功能 Hook自己程序的wb 并修改 数据包 WB有多线程下不冲突 谢谢