学步园

#include <windows.h>

#ifndef _HOOK_API_JMP_
#define _HOOK_API_JMP_
class CHookApi_Jmp  
{
public: 
    HANDLE hProc; 
    void Unlock(void);
    void Lock(void); 
    BOOL Initialize(LPCTSTR ModuleName, LPCSTR ApiName, FARPROC lpNewFunc);
    void SetHookOn(void); 
    void SetHookOff(void); 
    CHookApi_Jmp(void); 
    virtual ~CHookApi_Jmp();

protected: 
    BYTE m_OldFunc[8]; 
    BYTE m_NewFunc[8]; 
    FARPROC m_lpHookFunc; 
    CRITICAL_SECTION m_cs;
};
#endif


//---------------------------------------------------------------------------
#include "stdafx.h"
#include "ApiHookLib.h"

#pragma warning(disable: 4311)
//---------------------------------------------------------------------------
CHookApi_Jmp::CHookApi_Jmp(void)
{ 
    InitializeCriticalSection(&m_cs);
}
//---------------------------------------------------------------------------
CHookApi_Jmp::~CHookApi_Jmp()
{ 
    CloseHandle(hProc); 
    DeleteCriticalSection(&m_cs);
}
//---------------------------------------------------------------------------
void CHookApi_Jmp::SetHookOn(void)
{ 
    DWORD dwOldFlag;
    if(VirtualProtect(m_lpHookFunc,5,PAGE_READWRITE,&dwOldFlag))
    {  
        if(WriteProcessMemory(hProc,m_lpHookFunc,m_NewFunc,5,0))  
        {   
            if(VirtualProtect(m_lpHookFunc,5,dwOldFlag,&dwOldFlag))    
                return;  
        } 
    }  
    return;
}
//---------------------------------------------------------------------------
void CHookApi_Jmp::SetHookOff(void)
{ 
    DWORD dwOldFlag; 
    if(VirtualProtect(m_lpHookFunc,5,PAGE_READWRITE,&dwOldFlag)) 
    {  
        if(WriteProcessMemory(hProc,m_lpHookFunc,m_OldFunc,5,0))  
        {   
            if(VirtualProtect(m_lpHookFunc,5,dwOldFlag,&dwOldFlag))    
                return;  
        }
    }
    return;
}
//---------------------------------------------------------------------------
BOOL CHookApi_Jmp::Initialize(LPCTSTR ModuleName, LPCSTR ApiName, FARPROC lpNewFunc)
{
    m_lpHookFunc = GetProcAddress(GetModuleHandle(ModuleName),ApiName);
    hProc = GetCurrentProcess();
    DWORD dwOldFlag;
    if(VirtualProtect(m_lpHookFunc,5,PAGE_READWRITE,&dwOldFlag)) 
    {  
        if(ReadProcessMemory(hProc,m_lpHookFunc,m_OldFunc,5,0))  
        {   
            if(VirtualProtect(m_lpHookFunc,5,dwOldFlag,&dwOldFlag))   
            {    
                m_NewFunc[0]=0xe9;    
                DWORD*pNewFuncAddress;    
                pNewFuncAddress=(DWORD*)&m_NewFunc[1];    
                *pNewFuncAddress=(DWORD)lpNewFunc-(DWORD)m_lpHookFunc-5;    
                return TRUE;   
            }  
        }
    }
    return FALSE;
}
//---------------------------------------------------------------------------
void CHookApi_Jmp::Lock(void) //多线程下使用
{
    EnterCriticalSection(&m_cs);
}
//---------------------------------------------------------------------------
void CHookApi_Jmp::Unlock(void)
{ 
    LeaveCriticalSection(&m_cs);
}
//---------------------------------------------------------------------------