detours 2.1 怎么用的？求示例代码，谢谢！

Question

RT

Answer 1

// FirstDetours.cpp : 定义 DLL 应用程序的入口点。
//#include "stdafx.h"#include <windows.h>
#include "detours.h"#pragma comment(lib, "detours.lib")
#pragma comment(lib, "detoured.lib")
// must have at lease one export function
_declspec(dllexport) void exportfunc()
{
}
//实现ring3下对进程的创建访问拦截  ANSI
BOOL (WINAPI * Real_CreateProcessA)( LPCTSTR lpApplicationName,
                                    LPTSTR lpCommandLine,
                                    LPSECURITY_ATTRIBUTES lpProcessAttributes,
                                    LPSECURITY_ATTRIBUTES lpThreadAttributes,
                                    BOOL bInheritHandles,
                                    DWORD dwCreationFlags,
                                    LPVOID lpEnvironment,
                                    LPCTSTR lpCurrentDirectory,
                                    LPSTARTUPINFO lpStartupInfo,
                                    LPPROCESS_INFORMATION lpProcessInformation) 
                                    = CreateProcessA;//实现ring3下对进程的创建访问拦截  Unicode
BOOL (WINAPI * Real_CreateProcessW)( LPCWSTR lpApplicationName, 
                                    LPWSTR lpCommandLine,
                                    LPSECURITY_ATTRIBUTES lpProcessAttributes,
                                    LPSECURITY_ATTRIBUTES lpThreadAttributes,
                                    BOOL bInheritHandles,
                                    DWORD dwCreationFlags,
                                    LPVOID lpEnvironment,
                                    LPCWSTR lpCurrentDirectory,
                                    LPSTARTUPINFOW lpStartupInfo,
                                    LPPROCESS_INFORMATION lpProcessInformation)
                                    = CreateProcessW;
BOOL WINAPI Mine_CreateProcessA( LPCSTR lpApplicationName, 
                                LPSTR lpCommandLine, 
                                LPSECURITY_ATTRIBUTES lpProcessAttributes,
                                LPSECURITY_ATTRIBUTES lpThreadAttributes, 
                                BOOL bInheritHandles, 
                                DWORD dwCreationFlags,
                                LPVOID lpEnvironment, 
                                LPCSTR lpCurrentDirectory,
                                LPSTARTUPINFOA lpStartupInfo,
                                LPPROCESS_INFORMATION lpProcessInformation)
{
    if(IDYES == MessageBox( GetForegroundWindow(), "有新进程要启动?", "拦截!", MB_YESNO|MB_ICONINFORMATION ))
        return Real_CreateProcessA( lpApplicationName, 
        lpCommandLine, 
        lpProcessAttributes,
        lpThreadAttributes, 
        bInheritHandles, 
        dwCreationFlags,
        lpEnvironment, 
        lpCurrentDirectory,
        lpStartupInfo,
        lpProcessInformation);
    else
        return FALSE;
}BOOL WINAPI Mine_CreateProcessW( LPCWSTR lpApplicationName, 
                                LPWSTR lpCommandLine,
                                LPSECURITY_ATTRIBUTES lpProcessAttributes,
                                LPSECURITY_ATTRIBUTES lpThreadAttributes,
                                BOOL bInheritHandles,
                                DWORD dwCreationFlags,
                                LPVOID lpEnvironment,
                                LPCWSTR lpCurrentDirectory,
                                LPSTARTUPINFOW lpStartupInfo,
                                LPPROCESS_INFORMATION lpProcessInformation)       
{ 
    if(IDYES == MessageBoxW( GetForegroundWindow(), L"有新进程要启动?", L"拦截!", MB_YESNO|MB_ICONINFORMATION ))
        return Real_CreateProcessW( lpApplicationName, 
        lpCommandLine,
        lpProcessAttributes,
        lpThreadAttributes,
        bInheritHandles,
        dwCreationFlags,
        lpEnvironment,
        lpCurrentDirectory,
        lpStartupInfo,
        lpProcessInformation);
    else
        return FALSE;
}int (WINAPI *Real_MessageBox)(
                              HWND hWnd,          // handle to owner window
                              LPCTSTR lpText,     // text in message box
                              LPCTSTR lpCaption,  // message box title
                              UINT uType          // message box style
                              )
                              =MessageBox;int WINAPI My_MessageBox(
                         HWND hWnd,          // handle to owner window
                         LPCTSTR lpText,     // text in message box
                         LPCTSTR lpCaption,  // message box title
                         UINT uType          // message box style
                         )
{
    return MessageBox(NULL, "Test", "Test", 0);
}                         
//DllMain函数
BOOL WINAPI DllMain(HINSTANCE hInstDll, DWORD fdwReason, LPVOID lpvReserved)
{
    if (DLL_PROCESS_ATTACH == fdwReason)
    {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)Real_CreateProcessA, Mine_CreateProcessA);
        DetourAttach(&(PVOID&)Real_CreateProcessW, Mine_CreateProcessW);
        DetourAttach(&(PVOID&)Real_MessageBox, My_MessageBox);
        DetourTransactionCommit();
    }
    else if (DLL_PROCESS_DETACH == fdwReason)
    {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)Real_CreateProcessA, Mine_CreateProcessA);
        DetourDetach(&(PVOID&)Real_CreateProcessW, Mine_CreateProcessW);
        DetourDetach(&(PVOID&)Real_MessageBox, My_MessageBox);
        DetourTransactionCommit();
    }
    return TRUE;
}