中文翻译-Easyook - The reinvention of Windows API hooking.docxVIP

 HYPERLINK /Doc?id=dc43n79n_139g4dsmzgr /Doc?id=dc43n79n_139g4dsmzgr 1 Continuing Detours: the reinvention of Windows API Hooking1继续截获:重新改造Windows API 挂钩 Microsoft? Detours latest release was in December 2006. Now times have changed and the NET Framework has become more and more popular. Besides the well known unmanaged code hooking, EasyHook provides a way to hook unmanaged code from a managed environment. This implies several advantages:微软的Detours最新的版本是在2006年12月发布。而现在.Net框架越来越流行，除了大家知道的非托管理代码挂接，EasyHook提供一个从托管环境挂接非托管代码的方法。这意味着几个优点： No resource or memory leaks are left in the target 在目标中不会有资源和内存泄漏。 You can write pure managed hook handlers for unmanaged APIs 为非托管API写存托管的挂钩处理。 All hooks are installed and automatically removed in a stable manner 在稳定的意义上所有的挂构自动安装的移除。 You can use all the convenience managed code provides, like NET Remoting, WCF and WPF 你可以使用所有托管代码的便利,象Net Rmoting, WCF 和 WPF。 You will be able to write injection libraries and host processes compiled for AnyCPU, which will allow you to inject your code into 32- and 64-Bit processes from 64- and 32-Bit processes by using the very same assembly in all cases. 你可以为各种CPU写注入库和托管进程，你可以用相同的汇编将你的代码注入32和64位进程。 This way hooking has become a simple task and you can now write hooking applications like FileMon or RegMon with a few lines of code. Further EasyHook 2.5 provides additional features like: Experimental stealth injection for unmanaged code not raising attention of any current AV 32- and 64-Bit Kernel mode hooking support, since Windows XP. A pure unmanaged hooking core which will improve performance, stability and compatibility. A solid unmanaged API for writing hooking apps and libraries without the NET Framework The unmanaged core does not require CRT bindings and thus will reduce deployment size about some megabytes. Also Windows 2000 SP4 and Windows Server 2008 SP1 can now be targeted with the same EasyHook binary. Minimal software requirements for end-users to execute applications using Ea