Windows 使用 Detours 进行 HOOK

一、detours 的下载和编译

1、下载 Detours：​​GitHub - microsoft/Detours: Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form. - GitHub - microsoft/Detours: Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.https://github.com/microsoft/Detours​​

2、编译

cd Detours\vc
打开 Detours.sln 编译运行

如果编译失败，重定向一下解决方案 

3、编译运行成功之后会生成 detours.lib

4、使用头文件和 detours.lib

二、使用 detours.lib 进行 Hook

这里我们进行 SendMessage 的 Hook，Hook 新定义的输出函数要和原函数参数是一样的

1、进行 API 的 Hook

主要函数

LONG WINAPI DetourAttach(_Inout_ PVOID *ppPointer,
                         _In_ PVOID pDetour);

第一个参数是原来的函数的地址，第二个参数是 Hook 之后的函数名称

void Hook() {
    DetourRestoreAfterWith();
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    //这里可以连续多次调用DetourAttach，表明HOOK多个函数
    DetourAttach(&(PVOID&)OldSendMessage, NewSendMessage);
    DetourTransactionCommit();
}

2、取消 Hook

void UnHook() {
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    //这里可以连续多次调用DetourDetach,表明撤销多个函数HOOK
    DetourDetach(&(PVOID&)OldSendMessage, NewSendMessage);
    DetourTransactionCommit();
}

3、具体代码

#include <Windows.h>
#include <iostream>
#include <thread>

#include "detours.h"

HWND hwnd;

static LRESULT(WINAPI* OldSendMessage)(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam) = SendMessage;
LRESULT WINAPI NewSendMessage(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam) {
MessageBox(hwnd, TEXT("就不关闭!"), TEXT("关闭程序"), MB_OK | MB_ICONINFORMATION);
return 0;
}

void Hook() {
DetourRestoreAfterWith();
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
//这里可以连续多次调用DetourAttach，表明HOOK多个函数
DetourAttach(&(PVOID&)OldSendMessage, NewSendMessage);
DetourTransactionCommit();
}

void UnHook() {
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
//这里可以连续多次调用DetourDetach,表明撤销多个函数HOOK
DetourDetach(&(PVOID&)OldSendMessage, NewSendMessage);
DetourTransactionCommit();
}

LRESULT CALLBACK WndProc(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam) {
switch (message) {
case WM_CLOSE:
DestroyWindow(hwnd);
break;
case WM_DESTROY:
// MessageBox(hwnd, TEXT("关闭程序!"), TEXT("结束"), MB_OK | MB_ICONINFORMATION);
PostQuitMessage(0);
break;
default:
return DefWindowProc(hwnd, message, wParam, lParam);
    }
return 0;
}

int main(void) {
Hook();
static TCHAR szAppName[] = TEXT("TextWindow");
MSG msg;
WNDCLASS wndclass;
// wndclass.cbSize = sizeof(WNDCLASSEX);
wndclass.style = CS_HREDRAW | CS_VREDRAW;                         //窗口样式
wndclass.lpszClassName = szAppName;                               //窗口类名
wndclass.lpszMenuName = NULL;                                     //窗口菜单:无
wndclass.hbrBackground = (HBRUSH)GetStockObject(WHITE_BRUSH);    //窗口背景颜色
wndclass.lpfnWndProc = WndProc;                                   //窗口处理函数
wndclass.cbWndExtra = 0;                                          //窗口实例扩展:无
wndclass.cbClsExtra = 0;                                          //窗口类扩展:无
wndclass.hInstance = GetModuleHandle(0);                                   //窗口实例句柄
wndclass.hIcon = LoadIcon(NULL, IDI_APPLICATION);               //窗口最小化图标:使用缺省图标
wndclass.hCursor = LoadCursor(NULL, IDC_ARROW);                 //窗口采用箭头光标
UnregisterClass(wndclass.lpszClassName, GetModuleHandle(0));
if (!RegisterClass(&wndclass)) {    
MessageBox(NULL, TEXT("窗口注册失败"), TEXT("错误"), MB_OK | MB_ICONERROR);
return 0;
    }

hwnd = CreateWindow(szAppName, TEXT("测试窗口"), WS_OVERLAPPEDWINDOW,
0, 0, 500, 400, NULL, NULL, GetModuleHandle(0), NULL);

ShowWindow(hwnd, SW_SHOW);
UpdateWindow(hwnd);
std::thread close_work = std::thread([&]() {
for (int i = 0; i < 5; ++i) {
std::cout << "close work: " << 5 - i << std::endl;
std::this_thread::sleep_for(std::chrono::milliseconds(1000));
        }
        ::SendMessage(hwnd, WM_CLOSE, 0, 0);
        });
while (GetMessage(&msg, NULL, 0, 0)) {
TranslateMessage(&msg);
DispatchMessage(&msg);
    }
if (close_work.joinable()) {
close_work.join();
    }
std::cout << "Finish" << std::endl;
UnHook();
getchar();
return 0;
}

4、运行结果

正常情况下如果不 Hook 的话，5s 过后窗口就退出了，使用 Hook 的话 5s 过后程序也不会退出