修改输入表 HOOK.doc

修改输入表 HOOK unit ImportHook; interface uses Windows; function HookAPI(TargetModule, TargetProc:Pchar; NewProc: Pointer; var OldProc: Pointer): integer; stdcall; implementation type TModuleList = array of cardinal; TImportFunction = packed record JumpInstruction: Word; AddressOfPointerToFunction: ^Pointer; end; TImageImportEntry = record Characteristics: dword; TimeDateStamp: dword; MajorVersion: word; MinorVersion: word; Name: dword; LookupTable: dword; end; // function GetModuleList: TModuleList; stdcall; //枚举模块列表 貌似用HelpAPI弄个快照效果差不多 var Module, Base: pointer; ModuleCount: integer; lpModuleName: array [0..MAX_PATH] of char; MemoryBasicInformation: TMemoryBasicInformation; begin SetLength(Result, 10); ModuleCount := 0; Module := nil; Base := nil; while VirtualQueryEx(GetCurrentProcess, Module, MemoryBasicInformation, SizeOf(MemoryBasicInformation)) = SizeOf(MemoryBasicInformation) do begin if (MemoryBasicInformation.State = MEM_COMMIT) and (MemoryBasicInformation.AllocationBase Base) and (MemoryBasicInformation.AllocationBase = MemoryBasicInformation.BaseAddress) and (GetModuleFileName(dword(MemoryBasicInformation.AllocationBase), lpModuleName, MAX_PATH) 0) then begin if ModuleCount = Length(Result) then SetLength(Result, ModuleCount * 2); Result[ModuleCount] := dword(MemoryBasicInformation.AllocationBase); Inc(ModuleCount); end; Base := MemoryBasicInformation.AllocationBase; dword(Module) := dword(Module) + MemoryBasicInformation.RegionSize; end; SetLength(Result, ModuleCount); end; function FunctionAddress(Code: Pointer): Pointer;stdcall; //获得函数真实地址 begin Result := Code; if TImportFunction(Code^).JumpInstruction = $25FF then Result := TImportFunction(Code^).AddressOfPointerToFunction^; end; function HookModules(ImageDosHeader: PImageDosHeader; TargetAddress, NewAddress: Pointer; var OldAddress: Pointer):integer;stdcall; //修改一个模块来HookAPI var ImageNTHe