代码:
BOOL Set_EAT_Hook(LPCWSTR lpModuleName,LPCSTR lpFuncName,LPVOID lpHookFunction,LPVOID* lpTrueFunction)
{
LPVOID pBase = NULL;
pBase = GetModuleHandleW(lpModuleName);
if (NULL == pBase)
{
pBase = LoadLibraryW(lpModuleName);
if (NULL == pBase)
{
return FALSE;
}
}
PIMAGE_DOS_HEADER pDosHeader = NULL;
PIMAGE_NT_HEADERS pNtHeader = NULL;
PIMAGE_OPTIONAL_HEADER pOpHeader = NULL;
PIMAGE_EXPORT_DIRECTORY pExportDes = NULL;
pDosHeader = (PIMAGE_DOS_HEADER)pBase;
if (IMAGE_DOS_SIGNATURE != pDosHeader->e_magic)
{
return FALSE;
}
pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pBase + pDosHeader->e_lfanew);
if (IMAGE_NT_SIGNATURE != pNtHeader->Signature)
{
return FALSE;
}
pOpHeader = (PIMAGE_OPTIONAL_HEADER)(&pNtHeader->OptionalHeader);
pExportDes = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)pBase + pOpHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
PUCHAR pFuncName = NULL;
PULONG pAddressOfFunctions=(ULONG*)((PBYTE)pBase + pExportDes->AddressOfFunctions);
PULONG pAddressOfNames=(ULONG*)((PBYTE)pBase + pExportDes->AddressOfNames);
PUSHORT pAddressOfNameOrdinals=(USHORT*)((PBYTE)pBase + pExportDes->AddressOfNameOrdinals);
ULONG uMax = pExportDes->NumberOfNames;
USHORT index=0 ;
ULONG addr;
for (ULONG uIndex = 0; uIndex <uMax; uIndex++)
{
index=pAddressOfNameOrdinals[uIndex];
addr=pAddressOfFunctions[index];
pFuncName = (PUCHAR)( (PBYTE)pBase + pAddressOfNames[uIndex]);
addr = pAddressOfFunctions[index];
if(!_stricmp((const char*)pFuncName,lpFuncName))
{
*lpTrueFunction = (LPVOID)(pFuncName);
ULONG uOldProtect;
VirtualProtectEx(GetCurrentProcess(),&pAddressOfFunctions[index],4,PAGE_EXECUTE_READWRITE,&uOldProtect);
pAddressOfFunctions[index]=(ULONG)((PBYTE)lpHookFunction - (PBYTE)pBase);
}
}
return TRUE;
}
typedef int (WINAPI* P_MessageBoxW)(
_In_opt_ HWND hWnd,
_In_opt_ LPCWSTR lpText,
_In_opt_ LPCWSTR lpCaption,
_In_ UINT uType
);
typedef int (WINAPI* P_SHFileOperationW)(
_Inout_ LPSHFILEOPSTRUCTW lpFileOp
);
P_SHFileOperationW g_pSHFileOperationW = NULL;
P_MessageBoxW g_pMessageBoxW = NULL;
int WINAPI Fake_SHFileOperationW(
_Inout_ LPSHFILEOPSTRUCTW lpFileOp
)
{
OutputDebugStringW(L"Fake_SHFileOperationW");
return g_pSHFileOperationW(lpFileOp);
}
int WINAPI Fake_MessageBoxW(
_In_opt_ HWND hWnd,
_In_opt_ LPCWSTR lpText,
_In_opt_ LPCWSTR lpCaption,
_In_ UINT uType
)
{
return g_pMessageBoxW(NULL,lpText,L"eat hook",uType);
}
BOOL MyShCopyFile(LPCWSTR lpInPath,LPCWSTR lpOutPath)
{
SHFILEOPSTRUCTW shFile;
ZeroMemory (&shFile ,sizeof (shFile));
shFile.pFrom = lpInPath;
shFile.pTo = lpOutPath;
shFile.wFunc = FO_COPY;
shFile.fFlags = FOF_SILENT |FOF_ALLOWUNDO |FOF_NOCONFIRMATION;
if (SHFileOperationW(&shFile) != 0 )
{
return FALSE ;
}
else
{
return TRUE ;
}
}
int _tmain(int argc, _TCHAR* argv[])
{
BOOL bRet = Set_EAT_Hook(L"Shell32.dll","SHFileOperationW",Fake_SHFileOperationW,(LPVOID*)&g_pSHFileOperationW);
bRet = Set_EAT_Hook(L"user32.dll","MessageBoxW",Fake_MessageBoxW,(LPVOID*)&g_pMessageBoxW);
FARPROC address = GetProcAddress(GetModuleHandleW(L"shell32.dll"),"SHFileOperationW");
FARPROC address2 = GetProcAddress(GetModuleHandleW(L"user32.dll"),"MessageBoxW");
MyShCopyFile(L"c:\\1.txt",L"e:\\1.txt");
MessageBoxW(NULL,L"xxxx",NULL,MB_OK);
return 0;
}