绕道 3.0 钩子崩溃消息框 A.

Detours 3.0 Hook Crashes MessageBoxA

本文关键字：消息 崩溃 绕道      更新时间：2023-10-16

我正在尝试将 MessageBoxA 函数与 MS Detours 3.0 挂钩，但当我尝试时，我的程序崩溃了。我不确定是什么导致程序崩溃。当我运行测试程序并按 shift 时，会出现消息框，但是当我注入 dll 并按 shift 时，我的程序崩溃了。

测试程序

#include <Windows.h>
int main()
{
    for(;;)
    {
        if(GetAsyncKeyState(VK_SHIFT))
        {
            MessageBoxA(0,"NOT HOOKED","HOOK STATUS",0);
        }
    }
}

钩子 DLL

#include <Windows.h>
#include <detours.h>
#pragma comment(lib,"detours.lib")
BOOL (WINAPI* oMessageBoxA)(HWND,LPCTSTR,LPCTSTR,UINT);
BOOL WINAPI hMessageBoxA( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType) 
{ 
        return oMessageBoxA(hWnd,"HOOKED",lpCaption,uType);
} 
void patch()
{
    HMODULE user32 = GetModuleHandle("user32.dll");
    if(user32 != NULL)
    {
        DWORD MessageBoxAddress = (DWORD)GetProcAddress(user32,"MessageBoxA");
        oMessageBoxA = (BOOL (WINAPI*)(HWND, LPCTSTR, LPCTSTR, UINT))MessageBoxAddress;
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)oMessageBoxA, hMessageBoxA);
        DetourTransactionCommit();
    }
}
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
{
    if(fdwReason==DLL_PROCESS_ATTACH)
    {
        patch();
    }
}

您错误地声明了MessageBoxA()的签名，并且您对DWORD MessageBoxAddress的使用在 64 位 DLL 中不起作用。

请尝试以下 DLL 代码：

#include <Windows.h>
#include <detours.h>
#pragma comment(lib,"detours.lib")
typedef int (WINAPI* LPFN_MBA)(HWND, LPCSTR, LPCSTR, UINT);
LPFN_MBA oMessageBoxA = NULL;
int WINAPI hMessageBoxA( HWND hWnd, LPCSTR lpText, LPCSTR lpCaption,UINT uType) 
{ 
    return oMessageBoxA(hWnd,"HOOKED",lpCaption,uType);
} 
void patch()
{
    HMODULE user32 = GetModuleHandle(TEXT("user32.dll"));
    if (user32 != NULL)
    {
        oMessageBoxA = (LPFN_MBA) GetProcAddress(user32, "MessageBoxA");
        if (oMessageBoxA != NULL)
        { 
            DetourTransactionBegin();
            DetourUpdateThread(GetCurrentThread());
            DetourAttach((PVOID*)&oMessageBoxA, hMessageBoxA);
            DetourTransactionCommit();
        } 
    }
}
void unpatch()
{
    if (oMessageBoxA != NULL)
    {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach((PVOID*)&oMessageBoxA, hMessageBoxA);
        DetourTransactionCommit();
    }
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    if (fdwReason == DLL_PROCESS_ATTACH)
    {
        DisableThreadLibraryCalls(hinstDLL);
        patch();
    }
    else if (fdwReason == DLL_PROCESS_DETACH)
    {
        unpatch();
    }
}

有关更多详细信息，请阅读以下内容：

带有 MS 绕道的 API 挂钩

相关文章：