我写的IAT HOOK

wzb

HOOK是一个比较有趣的技术，这些代码是我以前学了PE结构后写的PE分析工具改了改，改成IAT HOOK的。
废话不说，看代码吧：
// IAT.cpp : Defines the entry point for the application.
//
#include "stdafx.h"
HWND HookProc(void);
BOOL IATHook(LPCSTR pDLLName, PDWORD pOldAddr, PDWORD pNewAddr);
int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
  // TODO: Place code here.
HMODULE hmod=GetModuleHandle("USER32.dll");
FARPROC hold=GetProcAddress(hmod,"GetForegroundWindow");

if(IATHook("USER32.dll",(PDWORD)hold,(PDWORD)HookProc))
{
GetForegroundWindow();
}
else
  MessageBox(NULL,"Not Hook","MesageBox",MB_OK);
return 0;
}

HWND HookProc(void)
{
MessageBox(NULL,"I have hooked by IAT","IAT HOOK",MB_OK);
return NULL;
}

BOOL IATHook(LPCSTR pDLLName, PDWORD pOldAddr, PDWORD pNewAddr)
{
HMODULE hModule=NULL;
PIMAGE_DOS_HEADER pIMAGE_DOS_HEADER=NULL;
PIMAGE_NT_HEADERS pNTHeader=NULL;
PIMAGE_OPTIONAL_HEADER32 pOptionalHeader=NULL;
PIMAGE_DATA_DIRECTORY DataDirectory=NULL;
PIMAGE_IMPORT_DESCRIPTOR pImportHeader=NULL;
PIMAGE_IMPORT_DESCRIPTOR pDllModule=NULL;
LPSTR pModuleLabel=NULL;
PIMAGE_THUNK_DATA pThunkData=NULL;
DWORD OldProtect;
LPVOID lpaddr;

hModule=GetModuleHandle(NULL);
pIMAGE_DOS_HEADER=(PIMAGE_DOS_HEADER)hModule;

if(pIMAGE_DOS_HEADER->e_magic==IMAGE_DOS_SIGNATURE)
{
  pNTHeader=(PIMAGE_NT_HEADERS)((DWORD)pIMAGE_DOS_HEADER+(DWORD)pIMAGE_DOS_HEADER->e_lfanew);
  if (pNTHeader->Signature==IMAGE_NT_SIGNATURE)
  {
   pOptionalHeader=(PIMAGE_OPTIONAL_HEADER32)&(pNTHeader->OptionalHeader);
   DataDirectory=pOptionalHeader->DataDirectory;
   pImportHeader=(PIMAGE_IMPORT_DESCRIPTOR)((DWORD)hModule+DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
  }
  else
   return FALSE;
}
else
  return FALSE;
while(pImportHeader->Name!=NULL)
{
  pModuleLabel=(LPSTR)((DWORD)hModule+(DWORD)pImportHeader->Name);
  if(*pModuleLabel==*pDLLName)
  {
   pDllModule=pImportHeader;
   pThunkData=(PIMAGE_THUNK_DATA)((DWORD)hModule+(DWORD)pDllModule->FirstThunk);
   while(pThunkData->u1.Function!=NULL)
   {
    if(pOldAddr==(PVOID)pThunkData->u1.Function)
    {
     MEMORY_BASIC_INFORMATION  mbi;
     lpaddr=&pThunkData->u1.Function;
     VirtualQuery(lpaddr,&mbi,sizeof(mbi));
     VirtualProtect(lpaddr,sizeof(PDWORD),PAGE_READWRITE,&OldProtect);
     WriteProcessMemory(GetCurrentProcess(),lpaddr,&pNewAddr, sizeof(PDWORD), NULL);
     VirtualProtect(&pThunkData->u1.Function,sizeof(PDWORD),OldProtect,&OldProtect);
     return TRUE;
    }
    else
     pThunkData++;
   }
  }
  pImportHeader++;
}
return FALSE;
}


// stdafx.cpp : source file that includes just the standard includes
// IAT.pch will be the pre-compiled header
// stdafx.obj will contain the pre-compiled type information
#include "stdafx.h"
// TODO: reference any additional headers you need in STDAFX.H
// and not in this file


// stdafx.h : include file for standard system include files,
//  or project specific include files that are used frequently, but
//      are changed infrequently
//
#if !defined(AFX_STDAFX_H__A9DB83DB_A9FD_11D0_BFD1_444553540000__INCLUDED_)
#define AFX_STDAFX_H__A9DB83DB_A9FD_11D0_BFD1_444553540000__INCLUDED_
#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000
#define WIN32_LEAN_AND_MEAN  // Exclude rarely-used stuff from Windows headers
#include <windows.h>

// TODO: reference additional headers your program requires here
//{{AFX_INSERT_LOCATION}}
// Microsoft Visual C++ will insert additional declarations immediately before the previous line.
#endif // !defined(AFX_STDAFX_H__A9DB83DB_A9FD_11D0_BFD1_444553540000__INCLUDED_)

wzb

我忘了传附件

125096

多谢楼主分享，能提供学习PE的视频地址不，哦去学学

hu007

谢谢分享，学习了

hrgs666666

学习了，牛人

wzb

回复 125096 的帖子

视频是没有，文章有一大堆。看雪上自己找吧。
不管是破解还是脱壳PE结构都是学习的第一步。
不精通PE结构，是不能玩逆向的

ZeNiX

這個可以有，
源碼下載回來學習下。

謝謝。

hkc2000

嗯，，不错，，正在学习，，下载看是否是源码，，

wawqwqq

希望带上注释

314589595

不会易语言没人教我