C++基于hook iat改变Messagebox实例(2)

#include <windows.h> 
#include <stdio.h> 
 
//定义函数原型 
typedef int (WINAPI *PFNMESSAGEBOX)(HWND hWnd,  LPCTSTR lpText,  LPCTSTR lpCaption,  UINT uType); 
//保存原始的MessageBox地址,注意这里 
PROC g_orgProc = (PROC)MessageBox; 
 
int MyMessageBox(HWND hWnd,  LPCTSTR lpText,  LPCTSTR lpCaption,  UINT uType) 
{ 
    return ((PFNMESSAGEBOX)g_orgProc)(hWnd, "mymessagebox", lpCaption, uType); 
} 
 
void SetHook() 
{ 
    HMODULE hModule = ::GetModuleHandleA(NULL); 
    IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)hModule; 
    IMAGE_OPTIONAL_HEADER* pOpNtHeader = (IMAGE_OPTIONAL_HEADER*)((BYTE*)hModule + pDosHeader->e_lfanew + 24); //这里加24 
    IMAGE_IMPORT_DESCRIPTOR* pImportDesc = (IMAGE_IMPORT_DESCRIPTOR*)((BYTE*)hModule + pOpNtHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); 
 
    BOOL bFindDll = FALSE; 
    while (pImportDesc->FirstThunk) 
    { 
        char* pszDllName = (char*)((BYTE*)hModule + pImportDesc->Name); 
        printf("模块名称:%s\n", pszDllName); 
         
        if (stricmp(pszDllName, "user32.dll") == 0)//如果是user32.dll 
        { 
            bFindDll = TRUE; 
            break; 
        } 
        pImportDesc++;   
    } 
 
    if (bFindDll) 
    { 
        DWORD n = 0; 
        //一个IMAGE_THUNK_DATA就是一个导入函数 
        IMAGE_THUNK_DATA* pThunk = (IMAGE_THUNK_DATA*)((BYTE*)hModule + pImportDesc->OriginalFirstThunk); 
        while (pThunk->u1.Function) 
        { 
            //取得函数名称 
            char* pszFuncName = (char*)((BYTE*)hModule+pThunk->u1.AddressOfData+2); //函数名前面有两个.. 
            printf("function name:%-25s,  ", pszFuncName); 
            //取得函数地址 
            PDWORD lpAddr = (DWORD*)((BYTE*)hModule + pImportDesc->FirstThunk) + n; //从第一个函数的地址，以后每次+4字节 
            printf("addrss:%X\n", lpAddr); 
            //在这里是比较的函数地址 
            if (*lpAddr == (DWORD)g_orgProc) 
            {                                
                DWORD* lpNewProc = (DWORD*)MyMessageBox; 
                ::WriteProcessMemory(GetCurrentProcess(), lpAddr, &lpNewProc, sizeof(DWORD), NULL); 
                return; 
            }            
            n++; //每次增加一个DWORD 
        } 
        printf("\n");        
    } 
     
} 
int main(int argc, char* argv[]) 
{ 
    ::MessageBoxA(NULL, "before hook", "", MB_OK); 
    SetHook(); 
    ::MessageBoxA(NULL, "AFTERE hook", "", MB_OK); 
    return 0; 
}