#ifndef __ILHOOK_H_1_
#define __ILHOOK_H_1_#include <Windows.h>class CILHook{
public:CILHook();~CILHook();BOOL Hook(LPSTR pszModuleName, LPSTR pszFuncName, PROC pfnHookFunc);VOID UnHook();BOOL ReHook();private:PROC m_pfnOrig;//函数地址BYTE m_bOldBytes[5];//函数入口代码BYTE m_bNewBytes[5];//Inline代码
};#endif

#include "ILHook.h"CILHook::CILHook(){m_pfnOrig=NULL;ZeroMemory(m_bOldBytes, 5);ZeroMemory(m_bNewBytes, 5);
}
CILHook::~CILHook(){UnHook();
}/*
函数名称：Hook
函数功能：对指定模块中的函数进行挂钩
参数说明：pszModuleName：模块名称pszFuncName：函数名称pfnHookFunc：钩子函数
*/
BOOL CILHook::Hook(LPSTR pszModuleName,LPSTR pszFuncName,PROC pfnHookFunc){BOOL bRet=FALSE;//获取指定模块中函数的地址m_pfnOrig=(PROC)GetProcAddress(GetModuleHandle(pszModuleName),pszFuncName);if(m_pfnOrig!=NULL){//保存该地址处5个字节的内容DWORD dwNum=0;ReadProcessMemory(GetCurrentProcess(),m_pfnOrig,m_bOldBytes,5,&dwNum);//构造JMP指令m_bNewBytes[0]='\xe9';//jmp Opcode//pfnHookFunc是HOOK后的目标地址//m_pfnOrig是原来的地址//5是指令长度*(DWORD*)(m_bNewBytes+1)=(DWORD)pfnHookFunc-(DWORD)m_pfnOrig-5;//将构造好的地址写入该地址处WriteProcessMemory(GetCurrentProcess(),m_pfnOrig,m_bNewBytes,5,&dwNum);bRet=TRUE;}return bRet;
}/*
函数名称：UnHook
函数功能：取消函数的挂钩
*/
VOID CILHook::UnHook(){if(m_pfnOrig!=0){DWORD dwNum=0;WriteProcessMemory(GetCurrentProcess(),m_pfnOrig,m_bOldBytes,5,&dwNum);}
}/*
函数名称：ReHook
函数功能：重新对函数进行挂钩
*/
BOOL CILHook::ReHook(){BOOL bRet=FALSE;if(m_pfnOrig!=0){DWORD dwNum=0;WriteProcessMemory(GetCurrentProcess(),m_pfnOrig,m_bNewBytes,5,&dwNum);bRet=TRUE;}return bRet;
}

#include "ILHook.h"CILHook MsgHook;int WINAPI MyMessageBoxA(HWND hWnd,LPCSTR lpText,LPCSTR lpCaption,UINT uType){MsgHook.UnHook();MessageBox(hWnd,"Hook",lpCaption,uType);MessageBox(hWnd,lpText,lpCaption,uType);MsgHook.ReHook();return 0;
}int main(){MessageBox(NULL,"test","test",MB_OK);MsgHook.Hook("User32.dll","MessageBoxA",(PROC)MyMessageBoxA);MessageBox(NULL,"test","test",MB_OK);MsgHook.UnHook();return 0;
}