IAThook失败

djj

将dll注入到release版exe中，用xuetr发现MessageboxA已经被挂钩但是hook失败，注入到debug版中hook成功，为啥呢？
@小甲鱼 @人造人
dll代码：

1. #include <windows.h>
   
2. #include <imagehlp.h>
   
3. #include <stdio.h>
   
4. #include "process.h"
   
5. #pragma comment(lib,"IMAGEHLP.lib")
   
6. 
   
7. 
   
8. /*
   
9. 
   
10. pDllName [in] - 要HOOK的API所在的DLL
    
11. 
    
12. pApiName [in] - 要HOOK的API的名称
    
13. 
    
14. iNewApi       [in] - 新的API入口地址
    
15. 
    
16. pOldApi       [out]    - 用于输出源API入口地址，
    
17. 
    
18. */
    
19. 
    
20. int ReplaceIAT(const char *pDllName, const char *pApiName, INT_PTR iNewApi, INT_PTR *pOldApi)
    
21. 
    
22. {
    
23. 
    
24.         HANDLE hProcess = ::GetModuleHandle (NULL);
    
25. 
    
26.         DWORD dwSize = 0;
    
27. 
    
28.         PIMAGE_IMPORT_DESCRIPTOR pImageImport = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hProcess,TRUE,
    
29. 
    
30.                 IMAGE_DIRECTORY_ENTRY_IMPORT,&dwSize);
    
31. 
    
32.         if (NULL == pImageImport)
    
33. 
    
34.                 return 1;
    
35. 
    
36.         PIMAGE_IMPORT_BY_NAME pImageImportByName = NULL;
    
37. 
    
38.         PIMAGE_THUNK_DATA   pImageThunkOriginal = NULL;
    
39. 
    
40.         PIMAGE_THUNK_DATA   pImageThunkReal  = NULL;
    
41. 
    
42.         while (pImageImport->Name)
    
43. 
    
44.         {
    
45. 
    
46.                 char *pName = (char*)(PBYTE)hProcess+pImageImport->Name;
    
47. 
    
48.                 if (0 == strcmpi((char*)((PBYTE)hProcess+pImageImport->Name),pDllName))
    
49. 
    
50.                 {
    
51. 
    
52.                         break;
    
53. 
    
54.                 }
    
55. 
    
56.                 ++pImageImport;
    
57. 
    
58.         }
    
59. 
    
60.         if (!pImageImport->Name) return 2;
    
61. 
    
62.         pImageThunkOriginal = (PIMAGE_THUNK_DATA)((PBYTE)hProcess+pImageImport->OriginalFirstThunk);
    
63. 
    
64.         pImageThunkReal = (PIMAGE_THUNK_DATA)((PBYTE)hProcess+pImageImport->FirstThunk);
    
65. 
    
66.         while (pImageThunkOriginal->u1.Function)
    
67. 
    
68.         {
    
69. 
    
70.                 if ((pImageThunkOriginal->u1.Ordinal & IMAGE_ORDINAL_FLAG) != IMAGE_ORDINAL_FLAG)
    
71. 
    
72.                 {
    
73. 
    
74.                         pImageImportByName = (PIMAGE_IMPORT_BY_NAME)((PBYTE)hProcess+pImageThunkOriginal->u1.AddressOfData);
    
75. 
    
76.                         if (0 == strcmpi(pApiName,(char*)pImageImportByName->Name))
    
77. 
    
78.                         {
    
79. 
    
80.                                 MEMORY_BASIC_INFORMATION mbi_thunk;
    
81. 
    
82.                                 VirtualQuery(pImageThunkReal, &mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
    
83. 
    
84.                                 VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE, &mbi_thunk.Protect);
    
85. 
    
86. 
    
87. 
    
88.                                 *pOldApi =(INT_PTR) pImageThunkReal->u1.Function;
    
89. 
    
90.                                 pImageThunkReal->u1.Function = (DWORD)iNewApi;
    
91. 
    
92. 
    
93. 
    
94.                                 DWORD dwOldProtect;
    
95. 
    
96.                                 VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize, mbi_thunk.Protect, &dwOldProtect);
    
97. 
    
98.                                 break;
    
99. 
    
100.                         }
     
101. 
     
102.                 }
     
103. 
     
104.                 ++pImageThunkOriginal;
     
105. 
     
106.                 ++pImageThunkReal;
     
107. 
     
108.         }
     
109. 
     
110.         return 0;
     
111. 
     
112. }
     
113. 
     
114. 
     
115. 
     
116. //自己想hook函数这里
     
117. typedef int (WINAPI *MESSAGEBOXA)(HWND, LPCWSTR, LPCWSTR, UINT);
     
118. 
     
119. // Pointer for calling original MessageBoxW.
     
120. MESSAGEBOXA fpMessageBoxA = NULL;
     
121. 
     
122. // Detour function which overrides MessageBoxW.
     
123. int WINAPI DetourMessageBoxA(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType)
     
124. {
     
125.         return fpMessageBoxA(hWnd, L"Hookedbybybyby!", lpCaption, uType);
     
126. }
     
127. 
     
128. void ThreadProc(void *param)
     
129. {
     
130. 
     
131.         ReplaceIAT("user32.dll","MessageBoxA", (INT_PTR)DetourMessageBoxA, (INT_PTR*)&fpMessageBoxA);
     
132. }
     
133. 
     
134. 
     
135. 
     
136. BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
     
137. {
     
138.         switch (fdwReason)
     
139.         {
     
140.         case DLL_PROCESS_ATTACH:
     
141.                 WinExec("notepad",SW_NORMAL);
     
142.                  _beginthread(ThreadProc,0,NULL);        //创建线程，调用ThreadProc
     
143.                 //SetHook();
     
144.                 //ReplaceIAT("user32.dll","MessageBoxA", (INT_PTR)DetourMessageBoxA, (INT_PTR*)&fpMessageBoxA);
     
145.                 break;
     
146. 
     
147.         case DLL_PROCESS_DETACH:
     
148.                 // Code to run when the DLL is freed
     
149.                 break;
     
150. 
     
151.         case DLL_THREAD_ATTACH:
     
152.                 // Code to run when a thread is created during the DLL's lifetime
     
153.                 break;
     
154. 
     
155.         case DLL_THREAD_DETACH:
     
156.                 // Code to run when a thread ends normally.
     
157.                 break;
     
158.         }
     
159.         return TRUE;
     
160. }
     

复制代码

exe代码:

1. #include "stdafx.h"
   
2. #include "stdio.h"
   
3. #include "windows.h"
   
4. 
   
5. int _tmain(int argc, _TCHAR* argv[])
   
6. {
   
7.         printf("test---/n");
   
8.         while(1)
   
9.         {
   
10.                 getchar();
    
11.                 MessageBoxA(NULL, "原函数", "09HookDemo", 0);
    
12.         }
    
13.         return 0;
    
14. }
    
15. 
    

复制代码

人造人

Windows SDK 我还没有学