einst.cpp

微软提供的截取Win32 API函数的开发包和例子detours-src-1.2.rar

//////////////////////////////////////////////////////////////////////////////
//
//	Module:		einst.exe - Detours Test Program
//	File:		einst.cpp
//	Author:		Galen C. Hunt
//
//  Copyright 1998-1999, Microsoft Corporation
//	http://www.research.microsoft.com/sn/detours
//
#include <stdio.h>
#include <windows.h>
#include <detours.h>

#define arrayof(x)		(sizeof(x)/sizeof(x[0]))

struct CPrivateStuff
{
	DETOUR_SECTION_HEADER	header;
	DETOUR_SECTION_RECORD 	record;
	CHAR					szMessage[32];
};

#ifdef INCLUDE_THIS
#pragma data_seg(".detour")

static CPrivateStuff private_stuff = {
	DETOUR_SECTION_HEADER_DECLARE(sizeof(CPrivateStuff)),
	{
		(sizeof(CPrivateStuff) - sizeof(DETOUR_SECTION_HEADER)),
		0,
		{ /* d9ab8a40-f4cc-11d1-b6d7-006097b010e3 */
			0xd9ab8a40,
			0xf4cc,
			0x11d1,
			{0xb6, 0xd7, 0x00, 0x60, 0x97, 0xb0, 0x10, 0xe3}
		}
	},
	"The Application!"
};
#pragma data_seg()
#endif

GUID my_guid =
{ /* d9ab8a40-f4cc-11d1-b6d7-006097b010e3 */
	0xd9ab8a40,
	0xf4cc,
	0x11d1,
	{0xb6, 0xd7, 0x00, 0x60, 0x97, 0xb0, 0x10, 0xe3}
};

__declspec(dllimport) VOID WINAPI EDll1Function(VOID);
__declspec(dllimport) VOID WINAPI EDll2Function(VOID);
__declspec(dllimport) VOID WINAPI EDll3Function(VOID);

void FindPayload(HINSTANCE hinst)
{
	CHAR szModuleName[256];
	GetModuleFileName(hinst, szModuleName, arrayof(szModuleName));
	printf("  %08lx : %s\n", hinst, szModuleName);

	PDETOUR_LOADED_BINARY pBinary = DetourBinaryFromInstance(hinst);

	if (pBinary) {
		ULONG cbData = 0;
		PBYTE pbData = DetourFindPayloadInBinary(pBinary, my_guid, &cbData);

		if (pbData) {
			printf("  %08p..%08p : %50.50s\n",
				   pbData,
				   pbData + cbData,
				   pbData);
		}
	}
}

int WINAPI WinMain(HINSTANCE hinst, HINSTANCE hprev, LPSTR lpszCmdLine, int nCmdShow)
{
	printf("Source .EXE:\n");
	FindPayload(NULL);
	printf("\n");
	
	printf("DLL and EXE binaries loaded:\n");

	EDll1Function();
	EDll2Function();
	EDll3Function();

	for (HINSTANCE hiter = NULL; hiter = DetourEnumerateInstances(hiter);) {
		FindPayload(hiter);
	}

	if ((PVOID)hinst == (PVOID)lpszCmdLine) {
		DispatchMessage(NULL);							// Force load of gdi32.dll
	}
	
	return 0;
}

//
///////////////////////////////////////////////////////////////// End of File.