BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch ( ul_reason_for_call )
{
case DLL_PROCESS_ATTACH:
{
g_hInst = (HINSTANCE)hModule;
RegSetValueExWHook.Hook("advapi32.dll", "RegSetValueExW", (PROC)MyRegSetValueExA);
RegDeleteValueWHook.Hook("advapi32.dll", "RegDeleteValueW", (PROC)MyRegDeleteValueW);
CreateProcessWHook.Hook("kernel32.dll", "CreateProcessW", (PROC)MyCreateProcessW);
break;
}
case DLL_PROCESS_DETACH:
{
RegSetValueExWHook.UnHook();
RegDeleteValueWHook.UnHook();
CreateProcessWHook.UnHook();
if ( g_hHook != NULL )
{
SetHookOff();
}
break;
}
}
return TRUE;
}
int main(){
//不进行HOOK的MessageBox
MessageBox(NULL, "test", "test", MB_OK);
//HOOK后
MsgHook.Hook("User32.dll", "MessageBoxA", (PROC)MyMessageBoxA);
MessageBox(NULL, "test", "test", MB_OK);
MsgHook.UnHook();
return 0;
}
BOOL
WINAPI
MyCreateProcessW(
__in_opt LPCWSTR lpApplicationName,
__inout_opt LPWSTR lpCommandLine,
__in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes,
__in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes,
__in BOOL bInheritHandles,
__in DWORD dwCreationFlags,
__in_opt LPVOID lpEnvironment,
__in_opt LPCWSTR lpCurrentDirectory,
__in LPSTARTUPINFOW lpStartupInfo,
__out LPPROCESS_INFORMATION lpProcessInformation
)
{
// WCHAR sz[0x200] = { 0 };
// if ( wcslen(lpCommandLine) != 0 )
// {
// wcscpy(sz, lpCommandLine);
// }
// else
// {
// wcscpy(sz, lpApplicationName);
// }
HIPS_INFO sz = { 0 };
if ( wcslen(lpCommandLine) != 0 )
{
wcscpy(sz.wProcessName, lpCommandLine);
}
else
{
wcscpy(sz.wProcessName, lpApplicationName);
}
sz.dwHipsClass = HIPS_CREATEPROCESS;
COPYDATASTRUCT cds = { NULL, sizeof(HIPS_INFO), (void *)&sz };
BOOL bRet = FALSE;
if ( SendMessage(FindWindow(NULL, "Easy Hips For R3"), WM_COPYDATA, GetCurrentProcessId(), (LPARAM)&cds) != -1 )
{
CreateProcessWHook.UnHook();
bRet = CreateProcessW(lpApplicationName, lpCommandLine,
lpProcessAttributes, lpThreadAttributes,
bInheritHandles, dwCreationFlags,
lpEnvironment, lpCurrentDirectory,
lpStartupInfo, lpProcessInformation);
CreateProcessWHook.ReHook();
}
return bRet;
}
//自定义MessageBoxA
WINAPI
MyMessageBoxA(
HWND hWnd,
LPCSTR lpText,
LPCSTR lpCaption,
UINT uType
)
{
//恢复HOOK
MsgHook.UnHook();
MessageBox(hWnd, "HOOk", lpCaption, uType);
MessageBox(hWnd, lpText, lpCaption, uType);
//重新HOOK
MsgHook.ReHook();
MessageBox(NULL, "test", "test", MB_OK);
return 0;
}