源代碼下載：http://pan.baidu.com/s/1pJPy0IZ
解壓密碼：hook
如題，XP測驗正常，WIN7 64測驗失敗了，其中懷疑是不是
lpAddr := Pointer(hMod + ImportDescriptor^.FirstThunk + (iNum - 1) * 4); //XP正常，Win7 64有問題？？
下面是關鍵的源代碼部分：
function SuperHook(): Boolean;
var
hMod: HMODULE;
pDosHeader: PImageDosHeader;
pNtHeaders: PImageNtHeaders;
ImportDescriptor: PImageImportDescriptor;
ThunkData: PImageThunkData;
dll_name, func_name: PAnsiChar;
iNum: Integer;
lpAddr: Pointer;
myaddr: DWORD;
btw: SIZE_T;
Ordinal: DWORD;
ulSize: DWORD;
pszModName: LPSTR;
begin
Result := False;
hMod := LoadLibrary('mswsock.dll'); //得到目標的模塊基址
if (hMod = 0) then
begin
Exit;
end;
pDosHeader := PImageDosHeader(hMod); //得到DOS頭
if (pDosHeader^.e_magic <> IMAGE_DOS_SIGNATURE) then
begin
Exit;
end;
pNtHeaders := PImageNtHeaders(hMod + DWORD(pDosHeader^._lfanew)); //得到NT頭
if (pNtHeaders^.Signature <> IMAGE_NT_SIGNATURE) then
begin
Exit;
end;
//檢查輸入表資料目錄是否存在
if (pNtHeaders^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = 0)
or (pNtHeaders^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = 0) then
begin
Exit;
end;
//得到輸入表描述指標
ImportDescriptor := PImageImportDescriptor(hMod + pNtHeaders^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
while (ImportDescriptor^.FirstThunk <> 0) do
begin
dll_name := PAnsiChar(hMod + ImportDescriptor^.Name);
//OutputDebugString(PChar(Format('[HOOK] Found "%s" for HOOK.', [StrPas(dll_name)])));
if (StrIComp(dll_name, 'ntdll.dll') <> 0) then //檢查輸入表項是否為ntdll.dll
begin
Inc(ImportDescriptor);
Continue;
end;
OutputDebugString(PChar(Format('[HOOK] OK "%s" for HOOK.', [StrPas(dll_name)])));
ThunkData := PImageThunkData(hMod + ImportDescriptor^.CharacteristicsOrOriginalFirstThunk);
iNum := 1;
while (ThunkData^.Function_ <> nil) do
begin
func_name := PAnsiChar(hMod + ThunkData^.AddressOfData + 2);
//OutputDebugString(PChar(Format('[HOOK] find API: %s', [StrPas(func_name)])));
if (StrIComp(func_name, 'NtDeviceIoControlFile') = 0) then //找到 NtDeviceIoControlFile
begin
OutputDebugString(PChar(Format('[HOOK] Lock "%s" for HOOK.', [StrPas(func_name)])));
myaddr := DWORD(@NewNtDeviceIoControlFile); //自定義程序
OutputDebugString(PChar(Format('[HOOK] FirstThunk=%d,CharacteristicsOrOriginalFirstThunk=%d', [ImportDescriptor^.FirstThunk, ImportDescriptor^.CharacteristicsOrOriginalFirstThunk])));
if ImportDescriptor^.FirstThunk > 0 then
begin
lpAddr := Pointer(hMod + ImportDescriptor^.FirstThunk + (iNum - 1) * 4); //XP正常，Win7 64有問題？？？
end
else
begin
lpAddr := Pointer(hMod + ImportDescriptor^.CharacteristicsOrOriginalFirstThunk + DWORD(iNum - 1) * 4);
end;
OldNtDeviceIoControl := PDWORD(lpAddr)^; //原始地址
OutputDebugString(PChar(Format('[HOOK] Base=%0.8X, Thunk=%0.8X, ID=%X', [hMod, ImportDescriptor^.FirstThunk, iNum - 1])));
OutputDebugString(PChar(Format('[HOOK] Orign[0x%0.8X]=0x%0.8X, new Addr=0x%0.8X', [DWORD(lpAddr), PDWORD(lpAddr)^, myaddr]))); //XP PDWORD(lpAddr)^ 值正常，WI764此值為空
WriteProcessMemory(GetCurrentProcess(), lpAddr, @myaddr, SizeOf(FARPROC), btw);
Result := True;
Exit;
end;
Inc(iNum);
Inc(ThunkData);
end;
Inc(ImportDescriptor);
end;
end;
源代碼已經打包到云盤，改64編譯測驗通過就好，非常感謝各位高手！
uj5u.com熱心網友回復：
先不說你的問題，用這種Hook，是HOOK的匯入表，簡單地GetProcAddress獲取函式地址再呼叫你都HOOK不到uj5u.com熱心網友回復：
在 WinXP，Win2003 系統下是可以正常HOOK的， WIN764的情況下就失敗了，對這方面不是很懂要怎么解決啊
轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/84760.html
下一篇：幫我想一個函式大神