想在你的程式中截住API函式嗎？那就快看吧！ (轉)

想在你的程式中截住API函式嗎？那就快看吧！ (轉)[@more@]

在你的中做一個func(...)

func1 = Spy(NULL,"GDI32.DLL","TextOutA",(PROC)func)

那麼你的程式沒次呼叫TextOut時，就會呼叫func 為了不破壞原有功能

請在func中呼叫func1。如果想截獲整個的api，你需要做一個全域性HOOK

在HOOK的DLL裡的初始化時呼叫本函式。主要程式碼如下：

PROC WINAPI

ApiSpy(PSTR pDllUse,PSTR pDllName,PSTR pApiName,PROC pNewPorc)
{
  PIMAGE_DOS_HEADER pDosHeader;
  PIMAGE_NT_HEADERS pNTHeader;
  PIMAGE_IMPORT_DESCRIPTOR pImportDesc;
  PIMAGE_THUNK_DATA pThunk;
  PROC pOldProc;
   D oldpr;
  static int Layer = 0;
  if ( pDllUse == NULL )
  Layer = 0;
  pOldProc = GetProcAddress( GetModuleHandle(pDllName),pApiName );
  if ( pOldProc == NULL )
  return NULL;
  pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandle(pDllUse); 
   if ( IsBadReadPtr(pDosHeader, sizeof(IMAGE_DOS_HEADER)) )
  return NULL;
  if ( pDosHeader->e_magic != IMAGE_DOS_SIGNATURE )
  return NULL;
  pNTHeader = MakePtr(PIMAGE_NT_HEADERS, pDosHeader, pDosHeader->e_lfanew);
  if ( IsBadReadPtr(pNTHeader, sizeof(IMAGE_NT_HEADERS)) )
  return NULL;
  if ( pNTHeader->Signature != IMAGE_NT_SIGNATURE )
  return NULL;
  pImportDesc = MakePtr(PIMAGE_IMPORT_DESCRIPTOR, pDosHeader,
  pNTHeader->OptionalHeader.
  DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].
  VirtualAddress);
  if ( pImportDesc == (PIMAGE_IMPORT_DESCRIPTOR)pNTHeader )
  return NULL;
 __try{
  while ( pImportDesc->Name ){
 PSTR pszModName = MakePtr(PSTR, pDosHeader, pImportDesc->Name);
 REM("[%s]",pszModName);
 if ( stricmp(pszModName, pDllName) == 0 ){
 pThunk = MakePtr(PIMAGE_THUNK_DATA, pDosHeader, pImportDesc->FirstThunk);
 while ( pThunk->u1.Function ){ 
 REM("[%s:%s]  ?  %s %8x ==> %8x",pDllName,pApiName,pszModName,
 // (DWORD)pOldProc,(DWORD)pThunk->u1.Function);
 if ( pThunk->u1.Function == (PDWORD)pOldProc ){
 if (!VirtualProtect(pThunk, 16, PAGE_READWRITE,&oldpr)){
 REM("VirtualProtect False");
 }
 REM("ApiSpy [%s:%s] OK !",pDllName,pApiName);
 pThunk->u1.Function=(PDWORD)pNewPorc;
 return pOldProc;
 }
 pThunk++; 
 } 
 return NULL;
 }
 else{
 if ( Layer < __Layer ){
 Layer ++;
 ApiSpy(pszModName,pDllName,pApiName,pNewPorc); 
 }
 }
 pImportDesc++;
 }
  }
 __except(TRUE){
 return NULL;
 }
  return NULL; 
}