hookbeep.c

Cracker终结者——提供最优秀的软件保护技术

/* HookBeep.c: Intercept calls to KERNEL32.Beep made by all modules in all processes
   in Windows9x.
   True global hook is possible because Beep function resides in KERNEL32.dll module
   which is in Win9x shared (present in every process always).

   Application:

   ApiHooks -o HookBeep KERNEL32.dll   ;KERNEL32.dll is the name of "main" process in Win9x

   or (from 3rd party application) via 
   EstablishApiHooks(pRCI, "HookBeep", KERNEL32PID, 30000);
   or
   hEstablishApiHooks(pRCI, "HookBeep",  hKERNEL32, 30000);

*/


// Win9x Hooks_DLL CAN'T use HANDLES in its NewAPI procedures.
// It can use only global handles or temporary handles (created
// and closed in NewAPI).

#include <windows.h>

// 9x global DLL must have base > 0x80000000 && all writable sections marked as sharable

#include <ApiHooks.h>           // ApiHooks.h   from HDK\INC

#ifdef _NEWONLY
BOOL WINAPI NewBeep(DWORD dwFreq, DWORD dwDuration)  {
  MessageBoxA(NULL, "KERNEL32.Beep called.", "NewBeep", MB_OK | MB_ICONINFORMATION);
  return Beep(dwFreq, dwDuration);  // call original Beep with original parameters and return its return value
}

__EXPORT API_HOOK ApiHookChain[2] = {
  {"KERNEL32.dll", "Beep", HOOK_EXPORT | HOOK_HARD, ALL_MODULES, NULL, NewBeep},
  {HOOKS_END}
};

#else

// We're above 2GB, routine must be above 2GB:
static BYTE OriginalRoutine[32];
typedef BOOL (WINAPI *TBeep)(DWORD, DWORD);
static TBeep OrigAddress = (TBeep)&OriginalRoutine;

BOOL WINAPI NewBeep(DWORD dwFreq, DWORD dwDuration)  {
  MessageBoxA(NULL, "KERNEL32.Beep called.", "NewBeep", MB_OK | MB_ICONINFORMATION);
  return OrigAddress(dwFreq, dwDuration);  // call original Beep with original parameters and return its return value
}

__EXPORT API_HOOK ApiHookChain[2] = {
  {"KERNEL32.dll", "Beep", HOOK_OVERWRITE | HOOK_HARD, &OrigAddress, NULL, NewBeep},
  {HOOKS_END}
};

#endif

#ifdef __TURBOC__
  BOOL APIENTRY DllEntryPoint(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
#else
  #ifdef _MSC_VER
    BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
  #else
    BOOL APIENTRY LibMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
  #endif
#endif
{ 
  if(ul_reason_for_call == DLL_PROCESS_ATTACH)
    if((int)GetVersion() < 0) //is 9x?
      if((int)hModule > 0)    //then I must be >= 2GB
        return FALSE;
  return TRUE;
}