// KillDll.cpp : Defines the entry point for the DLL application.
//这是钩子DLL的程序 #include "stdafx.h "
#include "KillDll.h "
#include "..\ApiHook\APIHook.h " #include <stdio.h >
#include "stdarg.h "
#define MAXPATHLEN 1024
#define MaxBuf 1024
#define MIN(x,y) ((x) < (y) ? (x) : (y)) // Defines
#pragma data_seg( ".SHARED ")
HHOOK glhHook = NULL; //安装勾子句柄
#pragma data_seg()
#pragma comment( linker, "/section:shared,rws " ) typedef struct SHWP_STRUCT_ {
DWORD dwProcessId;
BOOL bKill;
} SHWP_STRUCT, *LPSHWP_STRUCT; HINSTANCE glhInstance = NULL; //DLL实例句柄
DWORD hpid;//进程ID
//........................................................................../*
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
glhInstance = (HINSTANCE)hModule;
return TRUE;
}
// This is an example of an exported variable
KILLDLL_API int nKillDll=0; // This is an example of an exported function.
KILLDLL_API int fnKillDll(void)
{
return 42;
} // This is the constructor of a class that has been exported.
// see KillDll.h for the class definition
CKillDll::CKillDll()
{
return;
}
//...............................................................................................*/
typedef HANDLE (WINAPI *PFNOPENPROCESS)(DWORD,BOOL,DWORD);
extern CAPIHook g_OpenProcess;
HANDLE WINAPI Hook_OpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId);// 自定义OpenProcess函数
//.............................................................................................../*
HANDLE WINAPI Hook_OpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId)
{
if(dwDesiredAccess == PROCESS_TERMINATE && dwProcessId == dwProcessId == hpid)
{
char sz[2048];
wsprintf(sz, "%d,%d,%d ",dwDesiredAccess,dwProcessId,hpid);
MessageBox(NULL,sz, "d ",MB_OK);
return NULL;
}
return ((PFNOPENPROCESS)(PROC)g_OpenProcess)(dwDesiredAccess,bInheritHandle,dwProcessId);
}
CAPIHook g_OpenProcess( "kernel32.dll ", "OpenProcess ",(PROC)Hook_OpenProcess,TRUE);
//............................................................................................................*/ static LRESULT WINAPI ShellHookProc(int code, WPARAM wParam, LPARAM lParam)
{
return ::CallNextHookEx(glhHook, code, wParam, lParam);
}
extern "C "__declspec(dllexport) BOOL StartHook()
{
BOOL bResult=FALSE;
if(!glhHook)
{
glhHook = SetWindowsHookEx(WH_SHELL,ShellHookProc,glhInstance, 0);
if(glhHook!=NULL)
{
bResult=TRUE;
}
}
return bResult;
} extern "C "__declspec(dllexport) BOOL StopHook()
{
BOOL bResult=FALSE;
if(glhHook)
{
bResult= UnhookWindowsHookEx(glhHook);
if(bResult)
{
glhHook=NULL;
}
}
return bResult;
}
//......................................................................................................./*
我又新建了个MFC对话框,然后在初始化中加入下面的代码
HWND hwnd = ::FindWindow(NULL, "xiwang ");
DWORD hpid;//进程ID
GetWindowThreadProcessId(hwnd , &hpid); // TODO: Place code here.
HINSTANCE hInst=::LoadLibrary( "D:\\xiwang\\xiwang\\Debug\\KillDll.dll ");
if(hInst)
{
typedef bool (*Hook)(DWORD); //定义一个函数指针类型
Hook pHook=(Hook)::GetProcAddress(hInst, "StartHook ");
if(pHook)
{
pHook(hpid); } }
可是当程序执行 到pHook(hpid);语句时候运行程序界面会一闪而过,不知道为什么,请大家帮帮忙!我的代码主要功能是想把任务管理器中的进程不能人能够让人结束的掉的!!!请尽快回复我好码??加分啊!!!不够再加!!
//这是钩子DLL的程序 #include "stdafx.h "
#include "KillDll.h "
#include "..\ApiHook\APIHook.h " #include <stdio.h >
#include "stdarg.h "
#define MAXPATHLEN 1024
#define MaxBuf 1024
#define MIN(x,y) ((x) < (y) ? (x) : (y)) // Defines
#pragma data_seg( ".SHARED ")
HHOOK glhHook = NULL; //安装勾子句柄
#pragma data_seg()
#pragma comment( linker, "/section:shared,rws " ) typedef struct SHWP_STRUCT_ {
DWORD dwProcessId;
BOOL bKill;
} SHWP_STRUCT, *LPSHWP_STRUCT; HINSTANCE glhInstance = NULL; //DLL实例句柄
DWORD hpid;//进程ID
//........................................................................../*
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
glhInstance = (HINSTANCE)hModule;
return TRUE;
}
// This is an example of an exported variable
KILLDLL_API int nKillDll=0; // This is an example of an exported function.
KILLDLL_API int fnKillDll(void)
{
return 42;
} // This is the constructor of a class that has been exported.
// see KillDll.h for the class definition
CKillDll::CKillDll()
{
return;
}
//...............................................................................................*/
typedef HANDLE (WINAPI *PFNOPENPROCESS)(DWORD,BOOL,DWORD);
extern CAPIHook g_OpenProcess;
HANDLE WINAPI Hook_OpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId);// 自定义OpenProcess函数
//.............................................................................................../*
HANDLE WINAPI Hook_OpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId)
{
if(dwDesiredAccess == PROCESS_TERMINATE && dwProcessId == dwProcessId == hpid)
{
char sz[2048];
wsprintf(sz, "%d,%d,%d ",dwDesiredAccess,dwProcessId,hpid);
MessageBox(NULL,sz, "d ",MB_OK);
return NULL;
}
return ((PFNOPENPROCESS)(PROC)g_OpenProcess)(dwDesiredAccess,bInheritHandle,dwProcessId);
}
CAPIHook g_OpenProcess( "kernel32.dll ", "OpenProcess ",(PROC)Hook_OpenProcess,TRUE);
//............................................................................................................*/ static LRESULT WINAPI ShellHookProc(int code, WPARAM wParam, LPARAM lParam)
{
return ::CallNextHookEx(glhHook, code, wParam, lParam);
}
extern "C "__declspec(dllexport) BOOL StartHook()
{
BOOL bResult=FALSE;
if(!glhHook)
{
glhHook = SetWindowsHookEx(WH_SHELL,ShellHookProc,glhInstance, 0);
if(glhHook!=NULL)
{
bResult=TRUE;
}
}
return bResult;
} extern "C "__declspec(dllexport) BOOL StopHook()
{
BOOL bResult=FALSE;
if(glhHook)
{
bResult= UnhookWindowsHookEx(glhHook);
if(bResult)
{
glhHook=NULL;
}
}
return bResult;
}
//......................................................................................................./*
我又新建了个MFC对话框,然后在初始化中加入下面的代码
HWND hwnd = ::FindWindow(NULL, "xiwang ");
DWORD hpid;//进程ID
GetWindowThreadProcessId(hwnd , &hpid); // TODO: Place code here.
HINSTANCE hInst=::LoadLibrary( "D:\\xiwang\\xiwang\\Debug\\KillDll.dll ");
if(hInst)
{
typedef bool (*Hook)(DWORD); //定义一个函数指针类型
Hook pHook=(Hook)::GetProcAddress(hInst, "StartHook ");
if(pHook)
{
pHook(hpid); } }
可是当程序执行 到pHook(hpid);语句时候运行程序界面会一闪而过,不知道为什么,请大家帮帮忙!我的代码主要功能是想把任务管理器中的进程不能人能够让人结束的掉的!!!请尽快回复我好码??加分啊!!!不够再加!!
typedef bool (*Hook)(DWORD); //定义一个函数指针类型
你那个StartHook函数没有参数的哦。
另外字符串中的空格不知道怎么回事?