学步园

Windows 驱动开发库里面提供了函数 LdrRegisterDllNotification , LdrUnregisterDllNotification ， 可以让你监视进程装载/卸载DLL 的事件。 当你想在某个DLL被加载的时候Hook它的函数； 或者当你想在某个DLL推出之前做一些保存清理工作； 或者当你想阻止某个DLL 被加载（比如外挂） .... 这个机制正可以派上用场 。

以下是代码示例如何使用 LdrRegisterDllNotification , LdrUnregisterDllNotification 监听DLL装载/卸载。

 #include <Ntsecapi.h> // DDK<br /> typedef const UNICODE_STRING* PCUNICODE_STRING;</p> <p>typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA {<br /> ULONG Flags; //Reserved.<br /> PCUNICODE_STRING FullDllName; //The full path name of the DLL module.<br /> PCUNICODE_STRING BaseDllName; //The base file name of the DLL module.<br /> PVOID DllBase; //A pointer to the base address for the DLL in memory.<br /> ULONG SizeOfImage; //The size of the DLL image, in bytes.<br /> } LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;</p> <p>typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA {<br /> ULONG Flags; //Reserved.<br /> PCUNICODE_STRING FullDllName; //The full path name of the DLL module.<br /> PCUNICODE_STRING BaseDllName; //The base file name of the DLL module.<br /> PVOID DllBase; //A pointer to the base address for the DLL in memory.<br /> ULONG SizeOfImage; //The size of the DLL image, in bytes.<br /> } LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;</p> <p>typedef union _LDR_DLL_NOTIFICATION_DATA {<br /> LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;<br /> LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;<br /> } LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA;</p> <p>typedef const PLDR_DLL_NOTIFICATION_DATA PCLDR_DLL_NOTIFICATION_DATA;</p> <p>typedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)(ULONG NotificationReason, PCLDR_DLL_NOTIFICATION_DATA NotificationData, PVOID Context);<br /> typedef NTSTATUS (NTAPI *pfnLdrRegisterDllNotification)(ULONG Flags, PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction, void* Context, void **Cookie);<br /> typedef NTSTATUS (NTAPI *pfnLdrUnregisterDllNotification)(void *Cookie);</p> <p>#define LDR_DLL_NOTIFICATION_REASON_LOADED 1<br /> #define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2</p> <p>VOID NTAPI MyLdrDllNotification(<br /> ULONG NotificationReason,<br /> PCLDR_DLL_NOTIFICATION_DATA NotificationData,<br /> PVOID Context<br /> )<br /> {<br /> switch (NotificationReason)<br /> {<br /> case LDR_DLL_NOTIFICATION_REASON_LOADED:<br /> printf ("Dll Loaded: %S/n", NotificationData->Loaded.FullDllName->Buffer);<br /> break;<br /> case LDR_DLL_NOTIFICATION_REASON_UNLOADED:<br /> printf ("Dll Unloaded: %S/n", NotificationData->Unloaded.FullDllName->Buffer);<br /> break;<br /> }<br /> }</p> <p>int _tmain(int argc, _TCHAR* argv[])<br /> {</p> <p> HMODULE hModule = GetModuleHandleW(L"NTDLL.DLL");</p> <p> // 取得函数指针<br /> pfnLdrRegisterDllNotification pLdrRegisterDllNotification = (pfnLdrRegisterDllNotification)GetProcAddress(hModule, "LdrRegisterDllNotification");<br /> pfnLdrUnregisterDllNotification pLdrUnregisterDllNotification = (pfnLdrUnregisterDllNotification)GetProcAddress(hModule, "LdrUnregisterDllNotification");<br /> void *pvCookie = NULL;</p> <p> // 初始化<br /> pLdrRegisterDllNotification(0, MyLdrDllNotification, NULL, &pvCookie);</p> <p> // 测试DLL 装载<br /> HMODULE hLoad = ::LoadLibraryW(L"mshtml.dll");<br /> Sleep(1000);<br /> // 测试 DLL 卸载<br /> ::FreeLibrary(hLoad);</p> <p> // 清除<br /> if (pvCookie)<br /> {<br /> pLdrUnregisterDllNotification(pvCookie);<br /> pvCookie = NULL;<br /> }</p> <p> return 0;<br /> }<br />  

运行程序， 输出如下。可以证实以上代码监听了 mshtml.dll 的装载和卸载。 而且系统自动装载的其他DLL也被监视到。

Dll Loaded: C:/Windows/system32/mshtml.dll
Dll Loaded: C:/Windows/system32/msls31.dll
Dll Loaded: C:/Windows/system32/VERSION.dll
Dll Unloaded: C:/Windows/system32/mshtml.dll
Dll Unloaded: C:/Windows/system32/VERSION.dll
Dll Unloaded: C:/Windows/system32/msls31.dll

>> 原创文章的版权属于作者，转载请注明出处和作者信息(http://blog.csdn.net/WinGeek/)， 谢谢。 <<