library hook;
uses
SysUtils,windows,Classes;
type
TImportCode = packed record
JumpInstruction: Word;
AddressOfPointerToFunction: PPointer;
end;
PImportCode = ^TImportCode;
TLongJmp = packed record
JmpCode: ShortInt; {指令，用$E9来代替系统的指令}
FuncAddr: DWORD; {函数地址}
end;
{$R *.res}
var
g_hhook:integer;
Newcode: TLongJmp;
OldFunction,NewFunction:Pointer;{被截函数、自定义函数}
msgold:pointer;
//hookapiaddr:pointer;
////////////////////////////////////////////////////////////////////
{取函数的实际地址。如果函数的第一个指令是Jmp，则取出它的跳转地址（实际地址），这往往是由于程序中含有Debug调试信息引起的}
function FinalFunctionAddress(Code: Pointer): Pointer;
Var
func: PImportCode;
begin
Result:=Code;
if Code=nil then exit;
try
func:=code;
if (func.JumpInstruction=$25FF) then
{指令二进制码FF 25 汇编指令jmp [...]}
Func:=func.AddressOfPointerToFunction^;
result:=Func;
except
Result:=nil;
end;
end;
////////////////////////////////////////////////////////////////////////////
//MessageBoxW的代理函数
function messageboxc(a:thandle;b:pchar;c:pchar;d:integer):integer;stdcall;
var
hmode:thandle;
phookfunc:pointer;
hproc:thandle;
dwflag:dword;
begin
hmode:=loadlibrary('user32.dll');
pHookFunc:=GetProcAddress(hmode,'MessageBoxW'); //获取原API地址
hProc:=GetCurrentProcess(); //获得当前进程句柄
WriteProcessMemory(hProc,pHookFunc,@(msgold), 5,dwflag); //从phookfunc写入5字节
//msgold保存MESSAGEBOXW的原始地址
result:=messageboxa(0,'成功Hook','呵呵',mb_ok);
asm
mov eax,phookfunc
add eax,5
jmp eax //这里愿意是显示完我的对话框之后就将控制权交还给原来函数
//记事本应该显示一个你的文件尚未保存，你是保存还是退出还是取消的对话框
//我这里也能把原来的对话框显示出来，可是显示完以后，记事本就崩溃了
ret
end;
end;
//替换函数
function mydeletefilew(filename:pchar):boolean;stdcall;
begin
messageboxa(0,'成功Hook了DELETEFILEW',filename,mb_ok);
RESULT:=true;
end;
///////////////////////////////////////////////////////////
function modulefromaddress(pv:pointer):dword;
var
mbi:MEMORY_BASic_INFORMATION;
begin
if virtualquery(pv,mbi,sizeof(mbi))<>0 then result:=DWORD(mbi.AllocationBase)
else result:=0;
end;
///////////////////////////////////////////////////////////////////
function getmsgproc(code:integer;wparam:wparam;lparam:lparam):lresult;
begin
result:=callnexthookex(g_hhook,code,wparam,lparam);
end;
/////////////////////////////////////////////////////////////////////
function setmessagehook(binstall:boolean;dwthreadid:dword):boolean;stdcall;
begin
if binstall then begin
g_hhook:=setwindowshookex(WH_getMESSAGE,@getmsgproc,modulefromaddress(@getmsgproc),dwthreadid);
result:=(g_hhook<>0);
end else begin
result:=unhookwindowshookex(g_hhook);
g_hhook:=0;
end;
end;
////////////////////////////////////////////////////////////////////////////////////////
function HookAPI(DllName:pchar;ApiName:pchar;lpNewFunc:pointer):boolean;stdcall;
var
hproc:thandle;
hmode:thandle;
phookfunc:pointer;
dwflag:dword;
begin
try
hmode:=loadlibrary(dllname);
pHookFunc:=GetProcAddress(hmode,ApiName); //获取原API地址
hProc:=GetCurrentProcess(); //获得当前进程句柄
{求被截函数、自定义函数的实际地址}
OldFunction:=FinalFunctionAddress(phookfunc);
if apiname='MessageBoxW' then msgold:=oldfunction;
NewFunction:=FinalFunctionAddress(lpNewFunc);
Newcode.JmpCode := ShortInt($E9); {jmp指令的十六进制代码是E9}
NewCode.FuncAddr := DWORD(NewFunction) - DWORD(OldFunction) - 5;
WriteProcessMemory(hProc,pHookFunc,@(Newcode), 5,dwflag); //从phookfunc写入5字节
result:=true;
except
result:=false;
end;
end;
////////////////////////////////////////////////////////////////////////
exports
setmessagehook;
begin
HookAPI('user32.dll','MessageBoxW',@messageboxc) ;
HookAPI('kernel32.dll','DeleteFileW',@mydeletefilew) ;
end.
