apihook.cpp

API Hook的源代码文件 大家一定想剥除钩子函数的神秘感吧 请下载

// APIHook.cpp : 希望是我的APIHOOK的最后一个测试程序，我开始有点儿厌烦了，没准儿该写个Delphi版的。
//

#include "stdafx.h"
#include "apihook32.h"




HMODULE hModDLL;
HHOOK hHook;
APIHOOK32_ENTRY hkA,hkW;


LRESULT CALLBACK GetMsgProc(int code,WPARAM wParam,LPARAM lParam)
{
	return CallNextHookEx(hHook,code,wParam,lParam);
} 

int WINAPI MyMessageBoxA(HWND hwnd,LPCSTR lpText,LPCSTR lpCaption,UINT uType)
{
	return MessageBoxA(hwnd,"It's coming from MyMessageBoxA",lpCaption,uType);
}


int WINAPI MyMessageBoxW(HWND hwnd,LPCWSTR lpText,LPCWSTR lpCaption,UINT uType)
{
	return MessageBoxW(hwnd,L"It's coming from MyMessageBoxW",lpCaption,uType);
}


HHOOK InsertDll ()
{
	hHook = SetWindowsHookEx(WH_GETMESSAGE,&GetMsgProc,hModDLL,0);
	return hHook;
}
BOOL APIENTRY DllMain( HANDLE hModule, 
					  DWORD  ul_reason_for_call, 
					  LPVOID lpReserved
					  )
{ 
	hModDLL = (HMODULE)hModule;
	
	hkA.hModCallerModule = NULL;
	hkA.pszAPIName = "MessageBoxA";
	hkA.pszCalleeModuleName = "user32.dll";
	hkA.pfnDummyFuncAddress = (PROC) & MyMessageBoxA;
	hkA.pfnOriginApiAddress = GetProcAddress(GetModuleHandle("user32.dll"),"MessageBoxA");
	
	
	hkW.hModCallerModule = 0;
	hkW.pfnOriginApiAddress = GetProcAddress(GetModuleHandle("user32.dll"),"MessageBoxW");
	hkW.pszAPIName = "MessageBoxW";
	hkW.pszCalleeModuleName = "user32.dll";
	hkW.pfnDummyFuncAddress = (PROC) & MyMessageBoxW;
	
	
	
	switch(ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		SetWindowsAPIHook(&hkW);
		SetWindowsAPIHook(&hkA);	
		return TRUE;
	case DLL_PROCESS_DETACH:
		UnhookWindowsAPIHooks(hkW);
		UnhookWindowsAPIHooks(hkA);
	}
	return TRUE;
	
}