Simple C + + implementation method of Inline Hook (ring3) _c language

C + + inline hook code, using the method of backing up the DLL, so in the custom function can directly call in memory backup DLL code, without the need to change the function head to change. The stability of the SETWINDOWSHOOKEX program should be increased by a lot.

It is important to note that the example does not change the head of the original function several bytes back because the program is very simple, only to test the effect can exit, there is no other function. In the actual application, but also in your injected DLL module uninstall, the original function of the first few bytes back, so as not to affect the stability of the program continue to run. (Because the injected program is not our own, we certainly cannot know when and how many of the functions we hook.)

The specific implementation code is as follows:

#include <ntifs.h> #include <windef.h> #include <stdio.h> #pragma comment (lib, "PSAPI.lib")//byte Org
_code[7];//Backup DLL method so that you do not need BYTE new_code[7]; hmodule hdllhandle = NULL; The Hook's DLL handle HANDLE hprocess = NULL; Process handle LPVOID _messageboxa = NULL; MessageBoxA () original address DWORD _showmessage = NULL;
Custom Function address void Inlinehook (); void Uninlinehook ();
Backup DLL method so that void Backupdll () may not be required;
Custom Function int WINAPI ShowMessage (HWND, LPTSTR, LPTSTR, UINT);
  void Main () {hprocess =:: GetCurrentProcess ();
  Hdllhandle =:: LoadLibrary ("user32.dll");
  if (Hdllhandle = NULL) return;
  _messageboxa = (LPVOID):: GetProcAddress (Hdllhandle, "MessageBoxA");
  if (_messageboxa = NULL) return;
  Backupdll ();
  Inlinehook ();
  Char sztext[256];
  Char sztitle[256];
  memset (Sztext, 0x0, sizeof (Sztext));
  memset (SzTitle, 0x0, sizeof (SzTitle)); The following loops receive characters from user input and use MessageBoxA ()//To display, try to see what's going on.
    :) while (TRUE) {printf (' message Text: '); scanf ("%s"), Sztext);
    printf ("Message Title:");
    scanf ("%s", SzTitle);
    MessageBoxA (NULL, Sztext, SzTitle, 0);
  printf ("\ n");
} return;
  } void Inlinehook () {DWORD _jmpaddr = (DWORD) showmessage;            Construct new head code new_code[0] = 0xb8;    memcpy (&new_code[1], &_jmpaddr, 4);            mov eax, _jmpaddr new_code[5] = 0xFF;            NEW_CODE[6] = 0xe0;
  jmp eax DWORD dwoldprotect = 0;
  Go to memory Protection:: VirtualProtect (_messageboxa, 7, Page_execute_readwrite, &dwoldprotect);
  Write the new code to the head of MessageBoxA (), which is the core of inline Hook//.
  :: WriteProcessMemory (hprocess, _messageboxa, New_code, sizeof (New_code), NULL);
  Write memory protection:: VirtualProtect (_messageboxa, 7, Dwoldprotect, &dwoldprotect);
Return }/* void Uninlinehook ()//backup DLL method, so you do not need {return;} */int WINAPI ShowMessage (HWND hwnd, LPTSTR Lptext, LPTSTR lpti
  Tle, UINT utype) {typedef int WINAPI ShowMsg (HWND hwnd, LPTSTR Lptext, LPTSTR lptitle, UINT utype);ShowMsg *pshowmsg = (showmsg*) _showmessage;
  Discard the previously passed parameters and define the dialog box text Char buf[1024];
  :: wsprintf (BUF, "The Text:"%s "is hacked by Miku_fl", Lptext); Return pshowmsg (HWnd, buf, Lptitle, Mb_iconinformation |
Mb_topmost);
  } void Backupdll () {Moduleinfo mdl_info;
  LPVOID Lpnewdll = NULL;
  Get module Information:: Getmoduleinformation (hprocess, Hdllhandle, &mdl_info, sizeof (Mdl_info));
  Allocates memory space to back up the DLL (so that you do not need to restore the original header code, call//finish and then write the custom header code again).
  Lpnewdll =:: VirtualAllocEx (hprocess, NULL, Mdl_info.sizeofimage, Mem_commit, Page_execute_readwrite
  );
  if (Lpnewdll = NULL) return;
  Write the contents of the DLL file in the allocated memory:: WriteProcessMemory (hprocess, Lpnewdll, Mdl_info.lpbaseofdll, Mdl_info.sizeofimage, NULL);
  Calculates the address of the custom function. Formula: Custom address = Original API function address-module base + allocation Memory Base Address _showmessage = (DWORD) _messageboxa-(DWORD) Mdl_info.lpbaseofdll + (DWORD) lpnew
  DLL;
Return

 }

You want the program examples described in this article to be helpful.