必备绝技--Hook大法（上） (3)

雲间烟火分享 2020-06-30 下载文档

// Is this a ListView being created?

if(lstrcmpi(szClass, _T(\ {

HMODULE hModule = GetModuleHandle(_T(\

hwndParent = cw->lpcs->hwndParent;

if(hModule != (HMODULE)GetWindowLong(hwndParent, GWL_HINSTANCE)) hwndParent = GetParent(hwndParent);

// Make sure the parent window (the dialog) was created by // the common-dialog library

if(hModule == (HMODULE)GetWindowLong(hwndParent, GWL_HINSTANCE)) {

PostMessage(cw->lpcs->hwndParent, WM_COMMAND, MAKEWPARAM(28716, 0), 0); } /*else {

GetClassName(cw->lpcs->hwndParent, szClass, 32);

if(lstrcmpi(szClass, _T(\ {

PostMessage(cw->lpcs->hwndParent, WM_COMMAND, MAKEWPARAM(28716, 0), 0); } }*/ } }

return CallNextHookEx(g_hHook, nCode, wParam, lParam); }

void InstallHook(DWORD dwThreadId) {

g_hHook = SetWindowsHookEx(WH_CBT, CBTProc, 0, dwThreadId); }

void RemoveHook(DWORD dwThreadId) {

UnhookWindowsHookEx(g_hHook); g_hHook = 0; }

BOOL WINAPI DllMain(HMODULE hInstance, DWORD dwReason, PVOID lpReserved)

{

switch(dwReason) {

case DLL_PROCESS_ATTACH:

g_hInstance = hInstance;

GetModuleFileName(hInstance, g_szPath, MAX_PATH);

DisableThreadLibraryCalls(hInstance);

InstallHook(GetCurrentThreadId());

return TRUE;

case DLL_PROCESS_DETACH: RemoveHook(GetCurrentThreadId()); break; }

return TRUE; }

#ifdef _DEBUG int main() { return 0; } #endif

BOOL WINAPI _DllMainCRTStartup(HMODULE hInstance, DWORD dwReason, PVOID lpReserved) {

return DllMain(hInstance, dwReason, lpReserved); }

4．局限性：由于这种方法太显而易见，所以很容易被发现。

（二）通过消息钩子

1．基本原理：微软自己定义了一个钩子函数，这个钩子可以钩住系统的任何一类消息，并产生相关的回调函数。比如我们设置的是键盘钩子，如果用户按下键盘的键，就可以触发一个我们自定义功能的回调函数。

2．大体框架：

文件1：产生特定功能的Dll，并设置钩子

SetWindowsHookEx(WH_KEYBOARD, myKeyBrdFuncAd, myDllHandle, 0),

文件2：将Dll设置到特定目录，隐藏等

安装钩子函数，只要另一个进程按下了键，则钩子启动，加载Dll 卸载钩子 3.代码实例：文件1：

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; Sample code for < Win32ASM Programming 2nd Edition> ; by 罗云彬, http://asm.yeah.net

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; Hookdll.asm

; 键盘钩子使用的 dll 程序 ; 用来方置钩子过程

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; 使用 nmake 或下列命令进行编译和链接: ; ml /c /coff Hookdll.asm

; Link /subsystem:windows /section:.bss,S /Def:Hookdll.def /Dll Hookdll.obj

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .386

.model flat, stdcall option casemap :none

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; Include 文件定义

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> include windows.inc include user32.inc includelib user32.lib include kernel32.inc includelib kernel32.lib

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .data hInstance dd ? .data? hWnd dd ? hHook dd ? dwMessage dd ? szAscii db 4 dup (?)

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .code

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; dll 的入口函数

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> DllEntry proc _hInstance,_dwReason,_dwReserved

push _hInstance pop hInstance mov eax,TRUE ret

DllEntry Endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; 键盘钩子回调函数

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> HookProc proc _dwCode,_wParam,_lParam local @szKeyState[256]:byte

invoke CallNextHookEx,hHook,_dwCode,_wParam,_lParam invoke GetKeyboardState,addr @szKeyState invoke GetKeyState,VK_SHIFT mov @szKeyState + VK_SHIFT,al mov ecx,_lParam shr ecx,16

invoke ToAscii,_wParam,ecx,addr @szKeyState,addr szAscii,0 mov byte ptr szAscii [eax],0

invoke SendMessage,hWnd,dwMessage,dword ptr szAscii,NULL xor eax,eax ret

HookProc endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; 安装钩子

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> InstallHook proc _hWnd,_dwMessage

push _hWnd pop hWnd push _dwMessage pop dwMessage

invoke SetWindowsHookEx,WH_KEYBOARD,addr HookProc,hInstance,NULL mov hHook,eax ret

InstallHook endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; 卸载钩子

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> UninstallHook proc

invoke UnhookWindowsHookEx,hHook ret

UninstallHook endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> End DllEntry 文件2：

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; Sample code for < Win32ASM Programming 2nd Edition> ; by 罗云彬, http://asm.yeah.net

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ; Hookdll.asm