c#使用easyhook庫進行API鈎取

 

•  目標：使calc程序輸入的數自動加1

　（當別人使用時，總會得不到正確的結果，哈哈）

• 編寫注入程序

　　　　　

—————————————————————————————————
class Program中的方法，注入dll到目標進程
——————————————————————-——————————
static String ChannelName = null;

        static void Main(string[] args)
        {
            Int32.TryParse(args[0], out TargetPID) ;
            RemoteHooking.IpcCreateServer<FileMonInterface>(ref ChannelName, WellKnownObjectMode.SingleCall);
            string injectionLibrary = Path.Combine(Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location), "Inject.dll");
            RemoteHooking.Inject(
                        TargetPID,
                        injectionLibrary,
                        injectionLibrary,
                        ChannelName);
            Console.WriteLine("Injected to process {0}", TargetPID);
            Console.WriteLine("<Press any key to exit>");
            Console.ReadKey();
            }
__________________________________________________
MarshalByRefObject的實現，供dll進行調用，判斷是否正常
__________________________________________________
 public class FileMonInterface : MarshalByRefObject
    {
        public void IsInstalled(Int32 InClientPID)
        {
            Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID);
        }
    }

 

 

• 編寫注入使用的dll程序

—————————————————————————————————
注入成功后，調用Run方法，鈎取SetWindowTextW  API，修改為DSetWindowText的委托
—————————————————————————————————
 public void Run(
            RemoteHooking.IContext InContext,
            String InChannelName)
        {
            // install hook...
                Hook = LocalHook.Create(
                    LocalHook.GetProcAddress("user32.dll", "SetWindowTextW"),
                    new DSetWindowText(SetWindowText_Hooked),
                    this);

                Hook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
         Interface.IsInstalled(RemoteHooking.GetCurrentProcessId());
            RemoteHooking.WakeUpProcess();while (true)
                {
                    Thread.Sleep(500);
                }
        }

—————————————————————————————————
委托
—————————————————————————————————
        [UnmanagedFunctionPointer(CallingConvention.StdCall,
            CharSet = CharSet.Ansi,
            SetLastError = true)]
        delegate bool DSetWindowText(
         IntPtr hWnd, //對於句柄采用IntPtr類型
         string text
     );
—————————————————————————————————
API
—————————————————————————————————
        [DllImport("user32.dll", 
        CharSet = CharSet.Ansi,
        SetLastError = true,
        CallingConvention = CallingConvention.StdCall)]
        static extern bool SetWindowText(
         IntPtr hWnd,    string text
         );
—————————————————————————————————
 傀儡API
—————————————————————————————————
    static bool SetWindowText_Hooked(
            IntPtr hWnd,
             string text)
        {
            text = (int.Parse(text.Remove(text.Length-2))+1).ToString();//修改要顯示的數據
            return SetWindowText( hWnd, text);//調用API
        }                

 

• 效果圖