导入表注入（iathook）

头文件（hookMain.h）内容

#pragma once
#include<Windows.h>
 
DWORD* g_iatAddr = NULL;
DWORD* g_unHookAddr = NULL;
 
BOOL InstallHook(); //安装钩子
BOOL UninstallHook(); //卸载钩子
DWORD* GetIatAddr(const char* dllName, const char* dllFuncName);

源文件(iatHookMain.cpp)内容

#include "hookMain.h"
 
int WINAPI HookMessageBoxW( //必须指定调用约定，否则注入时会弹错误窗口
	HWND    hWnd,
	LPCWSTR lpText,
	LPCWSTR lpCaption,
	UINT    uType
)
{
	int result = MessageBoxA(0, "51hook", "提示", MB_OK);
	return result;
}
 
BOOL InstallHook() //安装钩子
{
	DWORD  dwOldProtect = 0;
	VirtualProtect(g_iatAddr, 4, PAGE_EXECUTE_READWRITE, &dwOldProtect);
	*g_iatAddr = (DWORD)HookMessageBoxW;
	VirtualProtect(g_iatAddr, 4, dwOldProtect, &dwOldProtect);
	return TRUE;
}
 
BOOL UninstallHook() //卸载钩子
{
	DWORD  dwOldProtect = 0;
	VirtualProtect(g_iatAddr, 4, PAGE_EXECUTE_READWRITE, &dwOldProtect);
	*g_iatAddr = (DWORD)g_unHookAddr;
	VirtualProtect(g_iatAddr, 4, dwOldProtect, &dwOldProtect);
	return TRUE;
}
 
DWORD* GetIatAddr(const char* dllName, const char* dllFuncName)
{
	HMODULE hModule = GetModuleHandleA(0); //获取当前进程exe文件模块句柄
	DWORD dwhModule = (DWORD)hModule;
 
	PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule; //获取dos头
	PIMAGE_NT_HEADERS  pNtHeader = (PIMAGE_NT_HEADERS)(pDosHeader->e_lfanew + dwhModule); //获取NT头
	PIMAGE_OPTIONAL_HEADER pOptionHeader = &pNtHeader->OptionalHeader; //获取可选PE头
	IMAGE_DATA_DIRECTORY dataDirectory = pOptionHeader->DataDirectory[1]; //获取数据目录表
	PIMAGE_IMPORT_DESCRIPTOR pImageImportTable = (PIMAGE_IMPORT_DESCRIPTOR)(
		dataDirectory.VirtualAddress + dwhModule); //获取导入表
	while (pImageImportTable->Name) //	遍历导入表获取符合条件的函数
	{
		char* iatDllName = (char*)(pImageImportTable->Name + dwhModule);
		if (_stricmp(iatDllName, dllName) == 0)
		{
			PIMAGE_THUNK_DATA pInt = (PIMAGE_THUNK_DATA)(pImageImportTable->OriginalFirstThunk
				+ dwhModule); //获取导入名称表
			PIMAGE_THUNK_DATA pIat = (PIMAGE_THUNK_DATA)(pImageImportTable->FirstThunk
				+ dwhModule); //获取导入地址表
 
			while (pInt->u1.Function)
			{
				if ((pInt->u1.Ordinal & 0x8000000) == 0)
				{
					PIMAGE_IMPORT_BY_NAME pImportName = (PIMAGE_IMPORT_BY_NAME)(pInt->u1.Function + dwhModule);
					if (_stricmp(pImportName->Name, dllFuncName) == 0)
					{
						return (DWORD*)pIat;
					}
				}
				++pInt;
			}
 
		}
 
		++pImageImportTable;
	}
	return NULL;
}
 
 
BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD callReason, LPVOID lpReservered)
{
	if (callReason == DLL_PROCESS_ATTACH)
	{
		/**
		 * 1 获取iat表
		 * 2 保存要hook的函数地址
		 * 3 安装钩子
		 */
		g_iatAddr = GetIatAddr("user32.dll", "MessageBoxW");
		g_unHookAddr = (DWORD*)* g_iatAddr;
		InstallHook();
	}
	else if (callReason == DLL_PROCESS_DETACH)
	{
		UninstallHook();
	}
	return TRUE;
}