Перехват API функций, на примере MessageBoxA

Code:

program Project2;

uses windows;

var

  sethook:procedure(flag:bool)stdcall;

  hDll:hModule;

begin

hDll:=LoadLibrary('Mouse_mes.dll');

@sethook:=GetProcAddress(hDll, 'sethook');

sethook(true);

messagebox(0,'Не закрывай, пока идет работа','',0);

sethook(false);

FreeLibrary(hDll);

end.

Code:

library Mouse_mes;

uses

sysutils,

windows,

messages;

type

  TImageImportDescriptor=packed record

   OriginalFirstThunk    : DWORD;

   TimeDateStamp         : DWORD;

   ForwarderChain        : DWORD;

   Name                  : DWORD;

   FirstThunk            : DWORD;

end;

PImageImportDescriptor=^TImageImportDescriptor;

var filename:array[0..max_path-1] of char;

   hook:HHook=0;

   PEHeader:PImageNtHeaders;

   ImageBase:cardinal;

function MyHookProcedure(hWnd: HWND; lpText, lpCaption: PWideChar; uType: UINT): Integer;

stdcall;

begin

result:=MessageBoxA(0, 'Notepad', 'my hook', 0);

//Но уже через нашу табл. импорта

end;

procedure ProcessImports(PImports:PImageImportDescriptor);

   Var

       PImport:PImageImportDescriptor;

       PRVA_Import:LPDWORD;

       ProcAddress:pointer;

       Temp_Cardinal:cardinal;

   begin{1}

     ProcAddress:=GetProcAddress(GetModuleHandle('USER32.DLL'), 'MessageBoxA');

     PImport:=PImports;

     while PImport.Name<>0 do

       begin{2}

         PRVA_Import:=LPDWORD(pImport.FirstThunk+ImageBase);

         while PRVA_Import^<>0 do

         begin{3}

           if PPointer(PRVA_Import)^=ProcAddress

              then

                begin{4}

                  VirtualProtect(PPointer(PRVA_Import),4,PAGE_READWRITE,Temp_Cardinal);

                  PPointer(PRVA_Import)^:=@MyHookProcedure; //пишем свою...

                 VirtualProtect(PPointer(PRVA_Import),4,Temp_Cardinal,Temp_Cardinal);

                end;{1}

           Inc(PRVA_Import);

         end;{2}

      Inc(PImport);

  end;{3}

end;{4}

procedure DllEntryPoint(reson:longint);stdcall;

begin

case reson of

DLL_PROCESS_ATTACH:

    begin

     DisableThreadLibraryCalls(hInstance);

     ZeroMemory(@FileName, SizeOf(FileName));

     GetModuleFileName(GetModuleHandle(nil), @FileName, SizeOf(FileName));

        if Pos('NOTEPAD.EXE',AnsiUpper(@FileName))<>0 then //сейчас я хочу попробовать все это дело надо  нотепадом

        begin

          ImageBase:=GetModuleHandle(nil);

          PEHeader:=pointer(int64(ImageBase)+PImageDosHeader(ImageBase)._lfanew);//pe header

         ProcessImports(pointer(PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress+ImageBase));

         end;

     end;

end;

end;

function nexthook(code:integer;wParam,lParam:longint):longint;stdcall;

begin

result:=callnexthookex(hook,code,wParam,lParam);

end;

procedure sethook(flag:bool);export; stdcall;

begin

if flag then

   hook:=setwindowshookex(wh_getmessage,@nexthook,hInstance,0)

else

  begin

   unhookwindowshookex(hook);

   hook:=0;

  end;

end;

exports sethook;

begin

DLLProc:=@DllEntryPoint;

DllEntryPoint(DLL_PROCESS_ATTACH)

end.