淺談APIHOOK技術（二）

淺談API HOOK技術（二）

       在這裡我將要實現轉跳。有人說修改內存內容要進入Ring 0 才可以。可是Windows本身提供了一個寫內存的指令WriteProcessMemory。有了這把利器，我們幾乎無所不能。如游戲的修改等在這裡我們只談APIHOOK。
function RepointFunction(OldFunc, NewFunc: Pointer): Integer;
var
   IsDone: TList;
   function RepointAddrInModule(hModule: THandle; OldFunc, NewFunc: Pointer): Integer;
   var
      Dos: PImageDosHeader;
      NT: PImageNTHeaders;
      ImportDesc: PImage_Import_Entry;
      RVA: DWORD;
      Func: ^Pointer;
      DLL: string;
      f: Pointer;
      written: DWORD;
   begin
      Result := 0;
      Dos := Pointer(hModule);
      if IsDone.IndexOf(Dos) >= 0 then exit;
      IsDone.Add(Dos);

      OldFunc := LocateFunctionAddress(OldFunc);

      if IsBadReadPtr(Dos, SizeOf(TImageDosHeader)) then exit;
      if Dos.e_magic <> IMAGE_DOS_SIGNATURE then exit;
      NT := Pointer(Integer(Dos) + dos._lfanew);

      RVA := NT^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]
         .VirtualAddress;

      if RVA = 0 then exit;
      ImportDesc := pointer(integer(Dos) + RVA);
      while (ImportDesc^.Name <> 0) do
      begin
         DLL := PChar(Integer(Dos) + ImportDesc^.Name);
         RepointAddrInModule(GetModuleHandle(PChar(DLL)), OldFunc, NewFunc);
         Func := Pointer(Integer(DOS) + ImportDesc.LookupTable);
         while Func^ <> nil do
         begin
            f := LocateFunctionAddress(Func^);
            if f = OldFunc then
            begin
               WriteProcessMemory(GetCurrentProcess, Func, @NewFunc, 4, written);
               if Written > 0 then Inc(Result);
            end;
            Inc(Func);
         end;
         Inc(ImportDesc);
      end;
   end;

begin
   IsDone := TList.Create;
   try
      Result := RepointAddrInModule(GetModuleHandle(nil), OldFunc, NewFunc);
   finally
      IsDone.Free;
   end;
end;
有了這兩個函數我們幾乎可以更改任何API函數。
我們可以先寫一個DLL文件。我這裡以修改Text相關函數為例：
先定義幾個函數：
type
   TTextOutA = function(DC: HDC; X, Y: Integer; Str: PAnsiChar; Count: Integer): BOOL; stdcall;
   TTextOutW = function(DC: HDC; X, Y: Integer; Str: PWideChar; Count: Integer): BOOL; stdcall;
   TTextOut = function(DC: HDC; X, Y: Integer; Str: PChar; Count: Integer): BOOL; stdcall;
   TDrawTextA = function(hDC: HDC; lpString: PAnsiChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;
   TDrawTextW = function(hDC: HDC; lpString: PWideChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;
   TDrawText = function(hDC: HDC; lpString: PChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;
var
   OldTextOutA: TTextOutA;
   OldTextOutW: TTextOutW;
   OldTextOut: TTextOut;
   OldDrawTextA: TDrawTextA;
   OldDrawTextW: TDrawTextW;
   OldDrawText: TDrawText;
......
function MyTextOutA(DC: HDC; X, Y: Integer; Str: PAnsiChar; Count: Integer): BOOL; stdcall;
begin
   OldTextOutA(DC, X, Y, ABC, length(ABC));
end;

function MyTextOutW(DC: HDC; X, Y: Integer; Str: PWideChar; Count: Integer): BOOL; stdcall;
begin
   OldTextOutW(DC, X, Y, ABC, length(ABC));
end;

function MyTextOut(DC: HDC; X, Y: Integer; Str: PChar; Count: Integer): BOOL; stdcall;
begin
   OldTextOut(DC, X, Y, ABC, length(ABC));
end;

function MyDrawTextA(hDC: HDC; lpString: PAnsiChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;
begin
   OldDrawTextA(hDC, ABC, length(ABC), lpRect, uFormat);
end;

function MyDrawTextW(hDC: HDC; lpString: PWideChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;
begin
   OldDrawTextW(hDC, ABC, length(ABC), lpRect, uFormat);
end;

function MyDrawText(hDC: HDC; lpString: PChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;
begin
   OldDrawText(hDC, ABC, length(ABC), lpRect, uFormat);
end;

調用時我們要把原來的函數地址保存下來：
   if @OldTextOutA = nil then
      @OldTextOutA := LocateFunctionAddress(@TextOutA);
   if @OldTextOutW = nil then
      @OldTextOutW := LocateFunctionAddress(@TextOutW);
   if @OldTextOut = nil then
      @OldTextOut := LocateFunctionAddress(@TextOut);
   if @OldDrawTextA = nil then
      @OldDrawTextA := LocateFunctionAddress(@DrawTextA);
   if @OldDrawTextW = nil then
      @OldDrawTextW := LocateFunctionAddress(@DrawTextW);
   if @OldDrawText = nil then
      @OldDrawText := LocateFunctionAddress(@DrawText);
然後很順其自然的用自己的函數替換掉原來的函數
   RepointFunction(@OldTextOutA, @MyTextOutA);
   RepointFunction(@OldTextOutW, @MyTextOutW);
   RepointFunction(@OldTextOut, @MyTextOut);
   RepointFunction(@OldDrawTextA, @MyDrawTextA);
   RepointFunction(@OldDrawTextW, @MyDrawTextW);
   RepointFunction(@OldDrawText, @MyDrawText);
        在結束時不要忘記恢復原來函數的入口，要不然你會死得很難看喲！好了我們在寫一個Demo程序。你會說怎麼文字沒有變成ABC呀？是呀，你要刷新一下才行。最小化然後在最大化。看看變了沒有。  
        要不然你就寫代碼刷新一下好了。至於去攔截其他進程的API那就用SetWindowsHookEx寫一個其他的鉤子將DLL映射進去就行了，我就不再浪費口水了。
掌握了該方法你幾乎無所不能。你可以修改其它程序。你可以攔截Createwindow等窗口函數改變其他程序的窗口形狀、你還可以入侵其它的程序，你還可以......嘿嘿。干了壞事別招出我來就行了。
我還寫了個例子，請在CSDN上下載。