//www.yjxsoft.com 2010.6.26 //文件名 IAT.H #include <windows.h> VOID __stdcall mySleep(DWORD m) {MessageBoxA(0,"Hook 成功","IAT hook",MB_OK); }PVOID EnumAPI() { PBYTE ImageBase;PIMAGE_THUNK_DATA r; PIMAGE_NT_HEADERS pNtHeader; PIMAGE_IMPORT_DESCRIPTOR pImport; //取得DOS頭基址ImageBase=(PBYTE)GetModuleHandle(NULL);//0x400000//PE頭=ImageBase+[ImageBase+3c]pNtHeader = (PIMAGE_NT_HEADERS) (ImageBase + ((PIMAGE_DOS_HEADER) ImageBase)->e_lfanew); //IMAGE_DIRECTORY_ENTRY_IMPORT值為1 表示import tabalepImport = (PIMAGE_IMPORT_DESCRIPTOR) (ImageBase + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); 遍歷整個 輸入表 for (; pImport->Name; pImport++) { printf("導(dǎo)入模塊:%s\n",ImageBase+pImport->Name); //遍歷IAT信息 PIMAGE_THUNK_DATA基址for (r = (PIMAGE_THUNK_DATA) (ImageBase + pImport->FirstThunk); r->u1.Function; r++) //枚舉函數(shù)地址{ if (Sleep==(PVOID)r->u1.Function){ DWORD pSleep=(DWORD)(&r->u1.Function);__asm{mov ebx,pSleep /// mov ebx,0x42A190lea eax,mySleepmov [ebx],eax}}printf("Function=%x \n", &(r->u1.Function)); } } return NULL; } int main(int argc, char* argv[]) { //MessageBoxA(0,NULL,NULL,MB_OK) ;//MessageBoxW(0,NULL,NULL,MB_OK);EnumAPI();Sleep(111);return 0; }

總結(jié)

以上是生活随笔為你收集整理的应用层勾子IAT HOOK（源码）的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。