mhook v2.4-乐在此

Mhook是个免费的hook库与微软的Detours差不多不多不过免费的Detours仅支持x86，而mhook支持x86和x64，而且使用更简单，看示例代码

//=========================================================================
#include “stdafx.h”
#include “mhook.h”

//=========================================================================
// Define _NtOpenProcess so we can dynamically bind to the function
//
typedefULONG (WINAPI* _NtOpenProcess)(OUT PHANDLE ProcessHandle,
IN ACCESS_MASK AccessMask, IN PVOID ObjectAttributes,
IN PCLIENT_ID ClientId );

//=========================================================================
// Get the current (original) address to the function to be hooked
//
_NtOpenProcess TrueNtOpenProcess = (_NtOpenProcess)
GetProcAddress(GetModuleHandle(L“ntdll”), “NtOpenProcess”);

//=========================================================================
// This is the function that will replace NtOpenProcess once the hook
// is in place
//
ULONG WINAPI MyNtOpenProcess(OUT PHANDLE ProcessHandle,
IN ACCESS_MASK AccessMask,
IN PVOID ObjectAttributes,
IN PCLIENT_ID ClientId )

{
// do any processing here if needed
// …
// punt the call to the the OS in the end
returnTrueNtOpenProcess(ProcessHandle, AccessMask,
ObjectAttributes, ClientId);

}

//=========================================================================
// This is how you go about putting the hook in place. When you’re done,
// any calls to NtOpenProcess will be redirected to MyNtOpenProcess.

// If you need to access the original, unmodified API, call
// TrueNtOpenProcess from your code, just like the hook function above does.
//
BOOL WINAPI SetHooksAndDoWork () {

BOOL bHook = Mhook_SetHook((PVOID*)&TrueNtOpenProcess,
MyNtOpenProcess));

// Minimalist error handling
if(!bHook)returnFALSE;

// … any calls to NtOpenProcess within this process are now

// rerouted to MyNtOpenProcess.

// For example, this call will end up in our hook function since
// kernel32!OpenProcess just calls ntdll!NtOpenProcess internally
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE,

GetCurrentProcessId());

// …

// This call will bypass the hook:
// (parameter initialization omitted for brevity)
TrueNtOpenProcess(&hProc, &accessMask, &objAttrs, &clientId);

// …

// Remove the hook when we’re done.
returnMhook_Unhook((PVOID*)&TrueNtOpenProcess);

}

//=========================================================================