#include?“StdAfx.h“
#include?“APIHook.h“

//////////////////////////////////////////////////////////////??
//?APIHook.cpp文件??
#include?“stdafx.h“??
#include?“APIHook.h“??
#include?“Tlhelp32.h“??
??
#include??//?為了調用ImageDirectoryEntryToData函數??
#pragma?comment（lib?“ImageHlp“）??
??
??
//?CAPIHook對象鏈表的頭指針??
CAPIHook*?CAPIHook::sm_pHeader?=?NULL;??
??
CAPIHook::CAPIHook（LPSTR?pszModName?LPSTR?pszFuncName?PROC?pfnHook?BOOL?bExcludeAPIHookMod）??
{??
????//?保存這個Hook函數的信息??
????m_bExcludeAPIHookMod?=?bExcludeAPIHookMod;??
????m_pszModName?=?pszModName;??
????m_pszFuncName?=?pszFuncName;??
????m_pfnHook?=?pfnHook;??
????m_pfnOrig?=?::GetProcAddress（::GetModuleHandle（pszModName）?pszFuncName）;??
??
????//?將此對象添加到鏈表中??
????m_pNext?=?sm_pHeader;??
????sm_pHeader?=?this;??
??????
????//?在所有當前已加載的模塊中HOOK這個函數??
????ReplaceIATEntryInAllMods（m_pszModName?m_pfnOrig?m_pfnHook?bExcludeAPIHookMod）;???
}??
??
CAPIHook::~CAPIHook（）??
{??
????//?取消對所有模塊中函數的HOOK??
????ReplaceIATEntryInAllMods（m_pszModName?m_pfnHook?m_pfnOrig?m_bExcludeAPIHookMod）;??
??
????CAPIHook?*p?=?sm_pHeader;??
??
????//?從鏈表中移除此對象??
????if（p?==?this）??
????{??
????????sm_pHeader?=?p->m_pNext;??
????}??
????else??
????{??
????????while（p?!=?NULL）??
????????{??
????????????if（p->m_pNext?==?this）??
????????????{??
????????????????p->m_pNext?=?this->m_pNext;??
????????????????break;??
????????????}??
????????????p?=?p->m_pNext;??
????????}??
????}??
??
}??
??
void?CAPIHook::ReplaceIATEntryInOneMod（LPSTR?pszExportMod???
???????????????????PROC?pfnCurrent?PROC?pfnNew?HMODULE?hModCaller）??
{??
????//?取得模塊的導入表（import?descriptor）首地址。ImageDirectoryEntryToData函數可以直接返回導入表地址??
????ULONG?ulSize;??
????PIMAGE_IMPORT_DEscriptOR?pImportDesc?=?（PIMAGE_IMPORT_DEscriptOR）??
????????????????::ImageDirectoryEntryToData（hModCaller?TRUE???
????????????????????IMAGE_DIRECTORY_ENTRY_IMPORT?&ulSize）;??
????if（pImportDesc?==?NULL）?//?這個模塊沒有導入節表??
????{??
????????return;??
????}??
??
????//?查找包含pszExportMod模塊中函數導入信息的導入表項??
????while（pImportDesc->Name?!=?0）??
????{??
????????LPSTR?pszMod?=?（LPSTR）（（DWORD）hModCaller?+?pImportDesc->Name）;??
????????if（lstrcmpiA（pszMod?pszExportMod）?==?0）?//?找到??
????????????break;??
??
????????pImportDesc++;??
????}??
????if（pImportDesc->Name?==?0）?//?hModCaller模塊沒有從pszExportMod模塊導入任何函數??
????{??
????????return;??
????}??
??
????//?取得調用者的導入地址表（import?address?table?IAT）??
????PIMAGE_THUNK_DATA?pThunk?=?（PIMAGE_THUNK_DATA）（pImportDesc->FirstThunk?+?（DWORD）hModCaller）;??
??
????//?查找我們要HOOK的函數，將它的地址用新函數的地址替換掉??
????while（pThunk->u1.Function）??
????{??
????????//?lpAddr指向的內存保存了函數的地址??
????????PDWORD?lpAddr?=?（PDWORD）&（pThunk->u1.Function）;??
????????if（*lpAddr?==?（DWORD）pfnCurrent）??
????????{??
??
????????????::WriteProcessMemory（::GetCurrentProcess（）???
????????????????????????lpAddr?&pfnNew?sizeof（DWORD）?NULL）;??
??
????????????//::VirtualProtect（lpAddr?sizeof（DW

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件???????6992??2013-06-20?20:19??帖子中的代碼\APIHook.cpp

?????文件???????2111??2013-06-20?20:19??帖子中的代碼\APIHook.h

?????文件???????1883??2013-06-20?12:44??帖子中的代碼\HookTerminateProcess.cpp

?????文件???????5413??2013-06-20?12:50??帖子中的代碼\lxh_hookapi_testDlg.cpp

?????目錄??????????0??2013-06-20?20:47??帖子中的代碼

-----------?---------??----------?-----??----

????????????????16399????????????????????5