Question

需要一个API HOOK的实例

希望能是C语言的实例，
至于方式是采用更改iat还是jmp 先由你们来看看我描述的情况：
我需要hook的是系统进程spoolsv.exe中的EndDocPrinter函数。该进程是系统打印服务程序，我不清楚运行中的程序可不可以通过更改iat来办到
我现在自己还写不出来，网上搜了好多资料，感觉好乱，虽然有点理解大体是咋回事了，可是代码还是写不出来。
希望明白的朋友大至给我说说用C语言调api方式如何实现这个。
就算不给实例，给我说说方案也好

Answer 1

API HOOK的实例参考如下：
#include <windows.h>
#include "APIHook.h"

extern CAPIHook g_OpenProcess;

// 自定义OpenProcess函数
#pragma data_seg("YCIShared")
HHOOK g_hHook = NULL;
DWORD dwCurrentProcessId=0;
#pragma data_seg()

HANDLE WINAPI Hook_OpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId)
{
typedef HANDLE (WINAPI *PFNTERMINATEPROCESS)(DWORD, BOOL,DWORD);

if(dwProcessId != dwCurrentProcessId)
{
return ((PFNTERMINATEPROCESS)(PROC)g_OpenProcess)(dwDesiredAccess,bInheritHandle,dwProcessId);
}
return 0;
}

// 挂钩OpenProcess函数
CAPIHook g_OpenProcess("kernel32.dll", "OpenProcess",
(PROC)Hook_OpenProcess);

///////////////////////////////////////////////////////////////////////////

static HMODULE ModuleFromAddress(PVOID pv)
{
MEMORY_BASIC_INFORMATION mbi;
if(::VirtualQuery(pv, &mbi, sizeof(mbi)) != 0)
{
return (HMODULE)mbi.AllocationBase;
}
else
{
return NULL;
}
}

static LRESULT WINAPI GetMsgProc(int code, WPARAM wParam, LPARAM lParam)
{
return ::CallNextHookEx(g_hHook, code, wParam, lParam);
}

BOOL WINAPI SetSysHook(BOOL bInstall, DWORD dwThreadId)
{
BOOL bOk;
dwCurrentProcessId=dwThreadId;
if(bInstall)
{
g_hHook = ::SetWindowsHookEx(WH_GETMESSAGE, GetMsgProc,
ModuleFromAddress(GetMsgProc), 0);
bOk = (g_hHook != NULL);
}
else
{
bOk = ::UnhookWindowsHookEx(g_hHook);
g_hHook = NULL;
}
return bOk;
}

Answer 2

KHELPER_API BOOL WINAPI kFixupCallEx(HANDLE hProcess,FARPROC srcproc,FARPROC dstproc,FARPROC *realProc){
char *src=(char*)srcproc;
char *offset=(char*)dstproc;
offset-=*(DWORD*)&srcproc;
//orig nop nop nop nop nop; mov edi,edi
//jmp disp; jmp short -7 (0xf9)
char code[]={'\xe9',0,0,0,0,'\xeb','\xf9'};
memcpy(code+1,&offset,4);

DWORD oldProt;
if(FALSE==VirtualProtectEx(hProcess,src-5,sizeof(code),PAGE_READWRITE,&oldProt)){
ReturnFalse( L"VirtualProtect Failed");
}
if(FALSE==WriteProcessMemory(hProcess,src-5,code,sizeof(code),0)){
ReturnFalse(L"WriteProcessMemory Failed");
}
if(FALSE==VirtualProtectEx(hProcess,src-5,sizeof(code),oldProt,&oldProt)){
ReturnFalse(L"VirtualProtect Failed");
}
if(realProc){
*realProc=(FARPROC)(src+2);
}
return TRUE;
}

KHELPER_API BOOL WINAPI kCleanFixupCallEx(HANDLE hProcess,FARPROC srcproc){
char *src=(char*)srcproc;
//nop nop nop nop nop mov edi,edi
char code[]="\x90\x90\x90\x90\x90\x8b\xff";
DWORD oldProt;
if(FALSE==VirtualProtectEx(hProcess,src-5,sizeof(code),PAGE_READWRITE,&oldProt)){
ReturnFalse( L"VirtualProtect Failed");
}
if(FALSE==WriteProcessMemory(hProcess,src-5,code,sizeof(code),0)){
ReturnFalse(L"WriteProcessMemory Failed");
}
if(FALSE==VirtualProtectEx(hProcess,src-5,sizeof(code),oldProt,&oldProt)){
ReturnFalse(L"VirtualProtect Failed");
}
return TRUE;
}