c#使用easyhook库进行API钩取
-
目标:使calc程序输入的数自动加1
(当别人使用时,总会得不到正确的结果,哈哈)
-
编写注入程序
————————————————————————————————— class Program中的方法,注入dll到目标进程 ——————————————————————-—————————— static String ChannelName = null; static void Main(string[] args) { Int32.TryParse(args[0], out TargetPID) ; RemoteHooking.IpcCreateServer<FileMonInterface>(ref ChannelName, WellKnownObjectMode.SingleCall); string injectionLibrary = Path.Combine(Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location), "Inject.dll"); RemoteHooking.Inject( TargetPID, injectionLibrary, injectionLibrary, ChannelName); Console.WriteLine("Injected to process {0}", TargetPID); Console.WriteLine("<Press any key to exit>"); Console.ReadKey(); } __________________________________________________ MarshalByRefObject的实现,供dll进行调用,判断是否正常 __________________________________________________ public class FileMonInterface : MarshalByRefObject { public void IsInstalled(Int32 InClientPID) { Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID); } }
-
编写注入使用的dll程序
————————————————————————————————— 注入成功后,调用Run方法,钩取SetWindowTextW API,修改为DSetWindowText的委托 ————————————————————————————————— public void Run( RemoteHooking.IContext InContext, String InChannelName) { // install hook... Hook = LocalHook.Create( LocalHook.GetProcAddress("user32.dll", "SetWindowTextW"), new DSetWindowText(SetWindowText_Hooked), this); Hook.ThreadACL.SetExclusiveACL(new Int32[] { 0 }); Interface.IsInstalled(RemoteHooking.GetCurrentProcessId()); RemoteHooking.WakeUpProcess();while (true) { Thread.Sleep(500); } } ————————————————————————————————— 委托 ————————————————————————————————— [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Ansi, SetLastError = true)] delegate bool DSetWindowText( IntPtr hWnd, //对于句柄采用IntPtr类型 string text ); ————————————————————————————————— API ————————————————————————————————— [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true, CallingConvention = CallingConvention.StdCall)] static extern bool SetWindowText( IntPtr hWnd, string text ); ————————————————————————————————— 傀儡API ————————————————————————————————— static bool SetWindowText_Hooked( IntPtr hWnd, string text) { text = (int.Parse(text.Remove(text.Length-2))+1).ToString();//修改要显示的数据 return SetWindowText( hWnd, text);//调用API }
-
效果图