Мастера DELPHI (документация, исходники, скачать)

Основная («Начинающим»)/ Базы / WinAPI / Компоненты / Сети / Media / Игры / Corba и COM / KOL / FreePascal / .Net / Прочее / RSDN.ORG

« предыдущая ветвь | форум | следующая ветвь »

LastMsgBoxInfo. Переват API-вызовов [D6, Win95/98, WinME, NT4, Win2k, WinXP]

Страницы: < 1 2
StAL © (2002-05-29 19:33:00)
В книге Рихтера приводится утилита LastMsgBoxInfo, которая перехватывает функции MessageBoxA и MessageBoxW.
А мне бы такое на DELPHI! Пожалуйста, помогите перевести!

Вот исходники на с++ из 4-го издания:

/****************************************************************************** Module: APIHook.cpp Notices: Copyright (c) 2000 Jeffrey Richter ******************************************************************************/ #include "..\CmnHdr.h" #include #pragma comment(lib, "ImageHlp") #include "APIHook.h" #include "..\04-ProcessInfo\Toolhelp.h" /////////////////////////////////////////////////////////////////////////////// // When an application runs on Windows 98 under a debugger, the debugger // makes the module"s import section point to a stub that calls the desired // function. To account for this, the code in this module must do some crazy // stuff. These variables are needed to help with the crazy stuff. // The highest private memory address (used for Windows 98 only) PVOID CAPIHook::sm_pvMaxAppAddr = NULL; const BYTE cPushOpCode = 0x68; // The PUSH opcode on x86 platforms /////////////////////////////////////////////////////////////////////////////// // The head of the linked-list of CAPIHook objects CAPIHook* CAPIHook::sm_pHead = NULL; /////////////////////////////////////////////////////////////////////////////// CAPIHook::CAPIHook(PSTR pszCalleeModName, PSTR pszFuncName, PROC pfnHook, BOOL fExcludeAPIHookMod) { if (sm_pvMaxAppAddr == NULL) { // Functions with address above lpMaximumApplicationAddress require // special processing (Windows 98 only) SYSTEM_INFO si; GetSystemInfo(&si); sm_pvMaxAppAddr = si.lpMaximumApplicationAddress; } m_pNext = sm_pHead; // The next node was at the head sm_pHead = this; // This node is now at the head // Save information about this hooked function m_pszCalleeModName = pszCalleeModName; m_pszFuncName = pszFuncName; m_pfnHook = pfnHook; m_fExcludeAPIHookMod = fExcludeAPIHookMod; m_pfnOrig = GetProcAddressRaw( GetModuleHandleA(pszCalleeModName), m_pszFuncName); chASSERT(m_pfnOrig != NULL); // Function doesn"t exist if (m_pfnOrig > sm_pvMaxAppAddr) { // The address is in a shared DLL; the address needs fixing up PBYTE pb = (PBYTE) m_pfnOrig; if (pb[0] == cPushOpCode) { // Skip over the PUSH op code and grab the real address PVOID pv = * (PVOID*) &pb[1]; m_pfnOrig = (PROC) pv; } } // Hook this function in all currently loaded modules ReplaceIATEntryInAllMods(m_pszCalleeModName, m_pfnOrig, m_pfnHook, m_fExcludeAPIHookMod); } /////////////////////////////////////////////////////////////////////////////// CAPIHook::~CAPIHook() { // Unhook this function from all modules ReplaceIATEntryInAllMods(m_pszCalleeModName, m_pfnHook, m_pfnOrig, m_fExcludeAPIHookMod); // Remove this object from the linked list CAPIHook* p = sm_pHead; if (p == this) { // Removing the head node sm_pHead = p->m_pNext; } else { BOOL fFound = FALSE; // Walk list from head and fix pointers for (; !fFound && (p->m_pNext != NULL); p = p->m_pNext) { if (p->m_pNext == this) { // Make the node that points to us point to the our next node p->m_pNext = p->m_pNext->m_pNext; break; } } chASSERT(fFound); } } /////////////////////////////////////////////////////////////////////////////// // NOTE: This function must NOT be inlined FARPROC CAPIHook::GetProcAddressRaw(HMODULE hmod, PCSTR pszProcName) { return(::GetProcAddress(hmod, pszProcName)); } /////////////////////////////////////////////////////////////////////////////// // Returns the HMODULE that contains the specified memory address static HMODULE ModuleFromAddress(PVOID pv) { MEMORY_BASIC_INFORMATION mbi; return((VirtualQuery(pv, &mbi, sizeof(mbi)) != 0) ? (HMODULE) mbi.AllocationBase : NULL); } section }
См. следующее сообщение

Gluka (2002-05-30 02:37:00) [21]
Уважаемый СТАЛ (или кто-нить) если есть ета глава с книги рихтера в електронном виде, то можно мне на мыло или Линк!!!!

С Ув. -=[Gluka]=-

VuDZ (2002-05-29 22:10:00) [22]
а что именно вызывает сложность?

RV (2002-05-29 20:55:00) [23]
Присоединяюсь к просьбе....

или даже как можно сделать:
есть dll1.dll, в крой есть функция function1
//
function1(x,y:integer):integer;
begin
result:=x+y;
end;
//

Задача: перехватить вызов
и в вызывающую прогу передать (result+1)

StAL (2002-05-29 19:51:00) [24]
DLL:
/****************************************************************************** Module: LastMsgBoxInfoLib.cpp Notices: Copyright (c) 2000 Jeffrey Richter ******************************************************************************/ #define WINVER 0x0500 #include "..\CmnHdr.h" #include #include #include #include "APIHook.h" #define LASTMSGBOXINFOLIBAPI extern "C" __declspec(dllexport) #include "LastMsgBoxInfoLib.h" /////////////////////////////////////////////////////////////////////////////// // Prototypes for the hooked functions typedef int (WINAPI *PFNMESSAGEBOXA)(HWND hWnd, PCSTR pszText, PCSTR pszCaption, UINT uType); typedef int (WINAPI *PFNMESSAGEBOXW)(HWND hWnd, PCWSTR pszText, PCWSTR pszCaption, UINT uType); // We need to reference these variables before we create them. extern CAPIHook g_MessageBoxA; extern CAPIHook g_MessageBoxW; /////////////////////////////////////////////////////////////////////////////// // This function sends the MessageBox info to our main dialog box void SendLastMsgBoxInfo(BOOL fUnicode, PVOID pvCaption, PVOID pvText, int nResult) { // Get the pathname of the process displaying the message box char szProcessPathname[MAX_PATH]; GetModuleFileNameA(NULL, szProcessPathname, MAX_PATH); // Convert the return value into a human-readable string PCSTR pszResult = "(Unknown)"; switch (nResult) { case IDOK: pszResult = "Ok"; break; case IDCANCEL: pszResult = "Cancel"; break; case IDABORT: pszResult = "Abort"; break; case IDRETRY: pszResult = "Retry"; break; case IDIGNORE: pszResult = "Ignore"; break; case IDYES: pszResult = "Yes"; break; case IDNO: pszResult = "No"; break; case IDCLOSE: pszResult = "Close"; break; case IDHELP: pszResult = "Help"; break; case IDTRYAGAIN: pszResult = "Try Again"; break; case IDCONTINUE: pszResult = "Continue"; break; } // Construct the string to send to the main dialog box char sz[2048]; wsprintfA(sz, fUnicode ? "Process: (%d) %s\r\nCaption: %S\r\nMessage: %S\r\nResult: %s" : "Process: (%d) %s\r\nCaption: %s\r\nMessage: %s\r\nResult: %s", GetCurrentProcessId(), szProcessPathname, pvCaption, pvText, pszResult); // Send the string to the main dialog box COPYDATASTRUCT cds = { 0, lstrlenA(sz) + 1, sz }; FORWARD_WM_COPYDATA(FindWindow(NULL, TEXT("Last MessageBox Info")), NULL, &cds, SendMessage); } /////////////////////////////////////////////////////////////////////////////// // This is the MessageBoxW replacement function int WINAPI Hook_MessageBoxW(HWND hWnd, PCWSTR pszText, LPCWSTR pszCaption, UINT uType) { // Call the original MessageBoxW function int nResult = ((PFNMESSAGEBOXW)(PROC) g_MessageBoxW) (hWnd, pszText, pszCaption, uType); // Send the information to the main dialog box SendLastMsgBoxInfo(TRUE, (PVOID) pszCaption, (PVOID) pszText, nResult); // Return the result back to the caller return(nResult); } /////////////////////////////////////////////////////////////////////////////// // This is the MessageBoxA replacement function int WINAPI Hook_MessageBoxA(HWND hWnd, PCSTR pszText, PCSTR pszCaption, UINT uType) { // Call the original MessageBoxA function int nResult = ((PFNMESSAGEBOXA)(PROC) g_MessageBoxA) (hWnd, pszText, pszCaption, uType); // Send the infomration to the main dialog box SendLastMsgBoxInfo(FALSE, (PVOID) pszCaption, (PVOID) pszText, nResult); // Return the result back to the caller return(nResult); } /////////////////////////////////////////////////////////////////////////////// // Hook the MessageBoxA and MessageBoxW functions CAPIHook g_MessageBoxA("User32.dll", "MessageBoxA", (PROC) Hook_MessageBoxA, TRUE); CAPIHook g_MessageBoxW("User32.dll", "MessageBoxW", (PROC) Hook_MessageBoxW, TRUE); // Since we do DLL injection with Windows" hooks, we need to save the hook // handle in a shared memory block (Windows 2000 actually doesn"t need this) #pragma data_seg("Shared") HHOOK g_hhook = NULL; #pragma data_seg() #pragma comment(linker, "/Section:Shared,rws") ///////////////////////////////////////////////////////////////////////////////

StAL (2002-05-29 19:46:00) [25]
/////////////////////////////////////////////////////////////////////////////// void CAPIHook::FixupNewlyLoadedModule(HMODULE hmod, DWORD dwFlags) { // If a new module is loaded, hook the hooked functions if ((hmod != NULL) && ((dwFlags & LOAD_LIBRARY_AS_DATAFILE) == 0)) { for (CAPIHook* p = sm_pHead; p != NULL; p = p->m_pNext) { ReplaceIATEntryInOneMod(p->m_pszCalleeModName, p->m_pfnOrig, p->m_pfnHook, hmod); } } } /////////////////////////////////////////////////////////////////////////////// HMODULE WINAPI CAPIHook::LoadLibraryA(PCSTR pszModulePath) { HMODULE hmod = ::LoadLibraryA(pszModulePath); FixupNewlyLoadedModule(hmod, 0); return(hmod); } /////////////////////////////////////////////////////////////////////////////// HMODULE WINAPI CAPIHook::LoadLibraryW(PCWSTR pszModulePath) { HMODULE hmod = ::LoadLibraryW(pszModulePath); FixupNewlyLoadedModule(hmod, 0); return(hmod); } /////////////////////////////////////////////////////////////////////////////// HMODULE WINAPI CAPIHook::LoadLibraryExA(PCSTR pszModulePath, HANDLE hFile, DWORD dwFlags) { HMODULE hmod = ::LoadLibraryExA(pszModulePath, hFile, dwFlags); FixupNewlyLoadedModule(hmod, dwFlags); return(hmod); } /////////////////////////////////////////////////////////////////////////////// HMODULE WINAPI CAPIHook::LoadLibraryExW(PCWSTR pszModulePath, HANDLE hFile, DWORD dwFlags) { HMODULE hmod = ::LoadLibraryExW(pszModulePath, hFile, dwFlags); FixupNewlyLoadedModule(hmod, dwFlags); return(hmod); } /////////////////////////////////////////////////////////////////////////////// FARPROC WINAPI CAPIHook::GetProcAddress(HMODULE hmod, PCSTR pszProcName) { // Get the true address of the function FARPROC pfn = GetProcAddressRaw(hmod, pszProcName); // Is it one of the functions that we want hooked? CAPIHook* p = sm_pHead; for (; (pfn != NULL) && (p != NULL); p = p->m_pNext) { if (pfn == p->m_pfnOrig) { // The address to return matches an address we want to hook // Return the hook function address instead pfn = p->m_pfnHook; break; } } return(pfn); } //////////////////////////////// End of File //////////////////////////////////

StAL (2002-05-29 19:39:00) [26]
Какое-то section влезло. Его там нет. Дальше:
/////////////////////////////////////////////////////////////////////////////// void CAPIHook::ReplaceIATEntryInAllMods(PCSTR pszCalleeModName, PROC pfnCurrent, PROC pfnNew, BOOL fExcludeAPIHookMod) { HMODULE hmodThisMod = fExcludeAPIHookMod ? ModuleFromAddress(ReplaceIATEntryInAllMods) : NULL; // Get the list of modules in this process CToolhelp th(TH32CS_SNAPMODULE, GetCurrentProcessId()); MODULEENTRY32 me = { sizeof(me) }; for (BOOL fOk = th.ModuleFirst(&me); fOk; fOk = th.ModuleNext(&me)) { // NOTE: We don"t hook functions in our own module if (me.hModule != hmodThisMod) { // Hook this function in this module ReplaceIATEntryInOneMod( pszCalleeModName, pfnCurrent, pfnNew, me.hModule); } } } /////////////////////////////////////////////////////////////////////////////// void CAPIHook::ReplaceIATEntryInOneMod(PCSTR pszCalleeModName, PROC pfnCurrent, PROC pfnNew, HMODULE hmodCaller) { // Get the address of the module"s import section ULONG ulSize; PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR) ImageDirectoryEntryToData(hmodCaller, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize); if (pImportDesc == NULL) return; // This module has no import section // Find the import descriptor containing references to callee"s functions for (; pImportDesc->Name; pImportDesc++) { PSTR pszModName = (PSTR) ((PBYTE) hmodCaller + pImportDesc->Name); if (lstrcmpiA(pszModName, pszCalleeModName) == 0) break; // Found } if (pImportDesc->Name == 0) return; // This module doesn"t import any functions from this callee // Get caller"s import address table (IAT) for the callee"s functions PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA) ((PBYTE) hmodCaller + pImportDesc->FirstThunk); // Replace current function address with new function address for (; pThunk->u1.Function; pThunk++) { // Get the address of the function address PROC* ppfn = (PROC*) &pThunk->u1.Function; // Is this the function we"re looking for? BOOL fFound = (*ppfn == pfnCurrent); if (!fFound && (*ppfn > sm_pvMaxAppAddr)) { // If this is not the function and the address is in a shared DLL, // then maybe we"re running under a debugger on Windows 98. In this // case, this address points to an instruction that may have the // correct address. PBYTE pbInFunc = (PBYTE) *ppfn; if (pbInFunc[0] == cPushOpCode) { // We see the PUSH instruction, the real function address follows ppfn = (PROC*) &pbInFunc[1]; // Is this the function we"re looking for? fFound = (*ppfn == pfnCurrent); } } if (fFound) { // The addresses match, change the import section address WriteProcessMemory(GetCurrentProcess(), ppfn, &pfnNew, sizeof(pfnNew), NULL); return; // We did it, get out } } // If we get to here, the function is not in the caller"s import section } /////////////////////////////////////////////////////////////////////////////// // Hook LoadLibrary functions and GetProcAddress so that hooked functions // are handled correctly if these functions are called. CAPIHook CAPIHook::sm_LoadLibraryA ("Kernel32.dll", "LoadLibraryA", (PROC) CAPIHook::LoadLibraryA, TRUE); CAPIHook CAPIHook::sm_LoadLibraryW ("Kernel32.dll", "LoadLibraryW", (PROC) CAPIHook::LoadLibraryW, TRUE); CAPIHook CAPIHook::sm_LoadLibraryExA("Kernel32.dll", "LoadLibraryExA", (PROC) CAPIHook::LoadLibraryExA, TRUE); CAPIHook CAPIHook::sm_LoadLibraryExW("Kernel32.dll", "LoadLibraryExW", (PROC) CAPIHook::LoadLibraryExW, TRUE); CAPIHook CAPIHook::sm_GetProcAddress("Kernel32.dll", "GetProcAddress", (PROC) CAPIHook::GetProcAddress, TRUE);

Страницы: < 1 2

Наверх

	« предыдущая ветвь \| форум \| следующая ветвь »