hookapi.h

一个可以拦截DeviceIoControl的程序

// hookapi.h
#ifndef _INC_HOOKAPI
#define _INC_HOOKAPI

#include <windows.h>
//#include "public.h"
/*
#define PC_WRITEABLE	0x00020000
#define PC_USER			0x00040000
#define PC_STATIC		0x20000000
*/
#define HOOK_NEED_CHECK 0
#define HOOK_CAN_WRITE	1
#define HOOK_ONLY_READ	2

#define BUFFERLEN		7

typedef struct _tagApiHookStruct
{
	LPSTR  lpszApiModuleName;
	LPSTR  lpszApiName;
	DWORD  dwApiOffset;
	LPVOID lpWinApiProc;
	BYTE   WinApiFiveByte[7];

	LPSTR  lpszHookApiModuleName;
	LPSTR  lpszHookApiName;
	LPVOID lpHookApiProc;
	BYTE   HookApiFiveByte[7];
	
	HINSTANCE hInst;

	BYTE   WinApiBakByte[7];
}
APIHOOKSTRUCT, *LPAPIHOOKSTRUCT;

FARPROC WINAPI NHGetFuncAddress(HINSTANCE hInst, LPCSTR lpMod, LPCSTR lpFunc);
void MakeJMPCode(LPBYTE lpJMPCode, LPVOID lpCodePoint);
void HookWin32Api(LPAPIHOOKSTRUCT lpApiHook, int nSysMemStatus);
void RestoreWin32Api(LPAPIHOOKSTRUCT lpApiHook, int nSysMemStatus);

LRESULT CALLBACK GetMsgProc(int nCode, WPARAM wParam, LPARAM lParam);

#endif // _INC_HOOKAPI