用VC编程阻止全局钩子的加载[组图](2)

时间:2009-12-30 15:42来源:未知作者:admin 点击: 次

分享到：

修改后：以下是封装的一个类，使用时定义一个该类的全局变量，调用一下PatchLoadLibrary函数即可。 //******************************************************************

　　修改后：

　　以下是封装的一个类，使用时定义一个该类的全局变量，调用一下PatchLoadLibrary函数即可。

//***********************************************************************************//
// FileName : GBlockHookDll.h
// Author ：耿海增
// Date : 2006.10.07
//***********************************************************************************//

#pragma once

#include
#pragma comment(lib,"psapi.lib")

class GBlockHookDll
{
public:
GBlockHookDll()
{
MODULEINFO user32ModInfo = {0};

//获取user32.dll的加载基址和映象大小
GetModuleInformation(GetCurrentProcess(),GetModuleHandle("user32.dll"),&user32ModInfo,sizeof(user32ModInfo));
m_dwUser32Low = (DWORD)user32ModInfo.lpBaseOfDll;
m_dwUser32Hi = (DWORD)user32ModInfo.lpBaseOfDll+user32ModInfo.SizeOfImage;
}
void PatchLoadLibrary()
{
//LoadLibraryExW
//7C801AF1 6A 34                push        34h
//7C801AF3 68 88 E2 80 7C       push        7C80E288h
LPVOID* pfnRaw = (LPVOID*)&rawLoadLibraryExW;
LPVOID fnNew = (LPVOID)newLoadLibraryExW;
BYTE* fnRaw = (BYTE*)*pfnRaw;

//1 save the first 7 bytes
const int nFirstBytes = 7;
BYTE* fnFake = (BYTE*)fakeLoadLibraryExW;
memcpy(fnFake,*pfnRaw,nFirstBytes);
fnFake[nFirstBytes] = 0xE9; //jmp to rawAddr+nFirstBytes
*(UINT32*)(fnFake + nFirstBytes+1) = (UINT32)fnRaw+nFirstBytes - (UINT32)(fnFake + nFirstBytes + 5);
//2 modify the raw to jmp to fnNew
DWORD dwOldProtect = 0;
VirtualProtect(fnRaw,nFirstBytes,PAGE_READWRITE,&dwOldProtect); //修改该代码段的属性为可写
*fnRaw = 0xE9;
*(UINT32*)(fnRaw+1) = (UINT32)fnNew - (UINT32)(fnRaw + 5);
VirtualProtect(fnRaw,nFirstBytes,dwOldProtect,0);
//3 change the rawPointer
*pfnRaw = fnFake;
}