mhook

  • A+
所属分类:源码

Mhook是个免费的hook与微软的Detours差不多不多不过免费的Detours仅支持x86,而mhook支持x86和x64,而且使用更简单,看示例代码

//=========================================================================
#include "stdafx.h"
#include "mhook.h"

//=========================================================================
// Define _NtOpenProcess so we can dynamically bind to the function
//
typedefULONG (WINAPI* _NtOpenProcess)(OUT PHANDLE ProcessHandle,
IN ACCESS_MASK AccessMask, IN PVOID ObjectAttributes,
IN PCLIENT_ID ClientId );

//=========================================================================
// Get the current (original) address to the function to be hooked
//
_NtOpenProcess TrueNtOpenProcess = (_NtOpenProcess)
GetProcAddress(GetModuleHandle(L"ntdll"), "NtOpenProcess");

//=========================================================================
// This is the function that will replace NtOpenProcess once the hook
// is in place
//
ULONG  WINAPI MyNtOpenProcess(OUT PHANDLE ProcessHandle,
IN ACCESS_MASK AccessMask,
IN PVOID ObjectAttributes,
IN PCLIENT_ID ClientId )

{
// do any processing here if needed
// ...
// punt the call to the the OS in the end
returnTrueNtOpenProcess(ProcessHandle, AccessMask,
ObjectAttributes, ClientId);

}

//=========================================================================
// This is how you go about putting the hook in place. When you're done,
// any calls to NtOpenProcess will be redirected to MyNtOpenProcess.

// If you need to access the original, unmodified API, call
// TrueNtOpenProcess from your code, just like the hook function above does.
//
BOOL WINAPI SetHooksAndDoWork () {

BOOL bHook = Mhook_SetHook((PVOID*)&TrueNtOpenProcess,
MyNtOpenProcess));

// Minimalist error handling
if(!bHook)returnFALSE;

// ... any calls to NtOpenProcess within this process are now

// rerouted to MyNtOpenProcess.

// For example, this call will end up in our hook function since
// kernel32!OpenProcess just calls ntdll!NtOpenProcess internally
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE,

GetCurrentProcessId());

// ...

// This call will bypass the hook:
// (parameter initialization omitted for brevity)
TrueNtOpenProcess(&hProc, &accessMask, &objAttrs, &clientId);

// ...

// Remove the hook when we're done.
returnMhook_Unhook((PVOID*)&TrueNtOpenProcess);

}

//=========================================================================

mhook下载:

mhook2.4.zip

mhook-2.3.zip

 

mhook-1.0.zip

avatar
  • 版权声明:本站原创文章,于2015年5月1日11:57:51,由 发表,共 2157 字。
  • 转载请注明:mhook | 乐在此

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: