MHOOK的使用

jimmy肖明

之前写辅助都用的是网上的帖子HOOK目标程序的send和recv，然后采用WriteProcessMemory替换我们的函数和Windows API函数，不断的来回切换，这个其实数据密集的时候容易出错也不稳定，不提倡！并且代码输写很容易出错。这里我贴出我自己写过的HOOK库，用过攻城略地和大皇帝等等游戏，均通过测试，非常之稳定

1. 把MHOOK封装成动态链接库，直接调用DLL文件进行HOOK目标函数，也可以实现远程注入。
   
2. 并且不会被游戏反辅助发觉。动态链接库代码如下：
   
3. 
   
4. #ifdef _M_IX86
   
5. #define _M_IX86_X64
   
6. #elif defined _M_X64
   
7. #define _M_IX86_X64
   
8. #endif
   
9. 
   
10. BOOL Mhook_SetHook(PVOID *ppSystemFunction, PVOID pHookFunction);
    
11. BOOL Mhook_Unhook(PVOID *ppHookedFunction);
    
12. 
    
13. #define MHOOKS_MAX_SUPPORTED_HOOKS 64
    
14. 我这里只针对HOOK socket的send和recv
    
15. 
    
16. #include "stdafx.h"
    
17. #include "mhook-lib/mhook.h"
    
18. 
    
19. extern mhook_func _msend;
    
20. extern mhook_func _mrecv;
    
21. extern mhook_func _mwsend;
    
22. extern mhook_func _mwrecv;
    
23. 
    
24. //ppSystemFunction为系统API,pHookFunction为自己定义的API
    
25. BOOL t001(PVOID *ppSystemFunction, PVOID pHookFunction)
    
26. {
    
27. return Mhook_SetHook(ppSystemFunction,pHookFunction);
    
28. }
    
29. 
    
30. //pHookFunction为自己定义的API
    
31. BOOL t002(PVOID *ppHookedFunction)
    
32. {
    
33. return Mhook_Unhook(ppHookedFunction);
    
34. }
    
35. 
    
36. //设置1.0函数地址
    
37. BOOL t003(mhook_func pHookSendFunc,mhook_func pHookRecvFuc)
    
38. {
    
39. _msend = pHookSendFunc;
    
40. _mrecv = pHookRecvFuc;
    
41. return TRUE;
    
42. }
    
43. 
    
44. //设置2.0函数地址
    
45. BOOL t004(mhook_func pHookSendFunc,mhook_func pHookRecvFuc)
    
46. {
    
47. _mwsend = pHookSendFunc;
    
48. _mwrecv = pHookRecvFuc;
    
49. return TRUE;
    
50. }
    
51. 
    
52. 
    
53. DLL入口文件
    
54. 
    
55. #include "stdafx.h"
    
56. #include "mhook-lib/mhook.h"
    
57. #include
    
58. 
    
59. //////////////封包函数//////////////
    
60. static void GT_WriteReleaseLog(char* str,char* path="C:\mk.log")
    
61. {
    
62. HANDLE hFile = CreateFileA(path, GENERIC_WRITE, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    
63. if(hFile == NULL)
    
64. return;
    
65. //设置文件中进行读写的当前位置
    
66. _llseek((HFILE)hFile,0, SEEK_END);
    
67. DWORD dw;
    
68. WriteFile(hFile,str,strlen(str),&dw,NULL);
    
69. _lclose((HFILE)hFile);
    
70. }
    
71. HMODULE hMod = LoadLibraryA("Ws2_32");
    
72. //1.0
    
73. typedef int (WINAPI *_send)(SOCKET s, const char *buf, int len, int flags);
    
74. typedef int (WINAPI *_recv)(SOCKET s, char *buf, int len, int flags);
    
75. _send g_trueSend = (_send)GetProcAddress(hMod,"send");
    
76. _recv g_trueRecv = (_recv)GetProcAddress(hMod,"recv");
    
77. //2.0
    
78. typedef int (WINAPI *_wsend)(SOCKET s, LPWSABUF lpBuffers, DWORD dwBufferCount,
    
79. LPDWORD lpNumberOfBytesSent,DWORD dwFlags, LPWSAOVERLAPPED lpOverlapped,
    
80. LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);
    
81. typedef int (WINAPI *_wrecv)(SOCKET s, LPWSABUF lpBuffers, DWORD dwBufferCount,
    
82. LPDWORD lpNumberOfBytesRecvd, LPDWORD lpFlags, LPWSAOVERLAPPED lpOverlapped,
    
83. LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);
    
84. _wsend g_trueWSend = (_wsend)GetProcAddress(hMod,"WSASend");
    
85. _wrecv g_trueWRecv = (_wrecv)GetProcAddress(hMod,"WSARecv");
    
86. 
    
87. mhook_func _msend = NULL;
    
88. mhook_func _mrecv = NULL;
    
89. mhook_func _mwsend = NULL;
    
90. mhook_func _mwrecv = NULL;
    
91. 
    
92. /**
    
93. 参数描述：
    
94. SOCKET s 发送端套接字描述符
    
95. const char *buf 应用程序要发送的数据的缓冲区(想要发送的数据)
    
96. int len 实际要发送的字节数
    
97. int flags 一般置为0即可
    
98. 如果没有错误发生，send将返回的总字节数发送
    
99. */
    
100. int WINAPI hook_send(SOCKET s, const char *buf, int len, int flags)
     
101. {
     
102. int ret = g_trueSend(s,buf,len,flags);
     
103. if (ret > 0)
     
104. {
     
105. char *temp = new char[ret];
     
106. memcpy_s(temp,ret,buf,ret);
     
107. if(_msend != NULL)
     
108. _msend(s,temp,ret);
     
109. delete temp;
     
110. }
     
111. return ret;
     
112. }
     
113. 
     
114. /**
     
115. 参数描述：
     
116. SOCKET s 发送端套接字描述符
     
117. const char *buf 应用程序存放接收的数据的缓冲区
     
118. int len buf的长度
     
119. int flags 一般置为0即可
     
120. 如果没有错误发生，recv返回的字节数的接收
     
121. */
     
122. int WINAPI hook_recv(SOCKET s, char *buf, int len, int flags)
     
123. {
     
124. int ret = g_trueRecv(s,buf,len,flags);
     
125. if (ret > 0)
     
126. {
     
127. char *temp = new char[ret];
     
128. memcpy_s(temp,ret,buf,ret);
     
129. if(_msend != NULL)
     
130. _mrecv(s,temp,ret);
     
131. delete temp;
     
132. }
     
133. return ret;
     
134. }
     
135. 
     
136. /*
     
137. s：标识一个已连接套接口的描述字。
     
138. lpBuffers：一个指向WSABUF结构数组的指针。每个WSABUF结构包含缓冲区的指针和缓冲区的大小。
     
139. dwBufferCount：lpBuffers数组中WSABUF结构的数目。
     
140. lpNumberOfBytesSent：如果发送操作立即完成，则为一个指向所发送数据字节数的指针。
     
141. dwFlags：标志位。
     
142. lpOverlapped：指向WSAOVERLAPPED结构的指针（对于非重叠套接口则忽略）。
     
143. lpCompletionRoutine：一个指向发送操作完成后调用的完成例程的指针。（对于非重叠套接口则忽略）。
     
144. 若无错误发生且发送操作立即完成，则WSASend()函数返回0
     
145. */
     
146. int WINAPI hook_wsend(SOCKET s, LPWSABUF lpBuffers, DWORD dwBufferCount,
     
147. LPDWORD lpNumberOfBytesSent,DWORD dwFlags, LPWSAOVERLAPPED lpOverlapped,
     
148. LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
     
149. {
     
150. int ret = g_trueWSend(s,lpBuffers,dwBufferCount,lpNumberOfBytesSent
     
151. ,dwFlags,lpOverlapped,lpCompletionRoutine);
     
152. DWORD len = *lpNumberOfBytesSent;
     
153. if (len > 0)
     
154. {
     
155. char *temp = new char[len];
     
156. memcpy_s(temp,len,lpBuffers->buf,len);
     
157. if(_mwsend != NULL)
     
158. _mwsend(s,temp,len);
     
159. delete temp;
     
160. }
     
161. return ret;
     
162. }
     
163. 
     
164. int WINAPI hook_wrecv(SOCKET s, LPWSABUF lpBuffers, DWORD dwBufferCount,
     
165. LPDWORD lpNumberOfBytesRecvd, LPDWORD lpFlags, LPWSAOVERLAPPED lpOverlapped,
     
166. LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
     
167. {
     
168. int ret = g_trueWRecv(s,lpBuffers,dwBufferCount,lpNumberOfBytesRecvd,lpFlags
     
169. ,lpOverlapped,lpCompletionRoutine);
     
170. DWORD len = *lpNumberOfBytesRecvd;
     
171. if (len > 0)
     
172. {
     
173. char *temp = new char[len];
     
174. memcpy_s(temp,len,lpBuffers->buf,len);
     
175. if(_mwrecv != NULL)
     
176. _mwrecv(s,temp,len);
     
177. delete temp;
     
178. }
     
179. return ret;
     
180. }
     
181. 
     
182. BOOL APIENTRY DllMain(HMODULE hModule,DWORD ul_reason_for_call,LPVOID lpReserved)
     
183. {
     
184. switch (ul_reason_for_call)
     
185. {
     
186. case DLL_PROCESS_ATTACH:
     
187. //直接在这里HOOK SEND和RECV函数
     
188. Mhook_SetHook((LPVOID*)&g_trueSend,hook_send);
     
189. Mhook_SetHook((LPVOID*)&g_trueRecv,hook_recv);
     
190. Mhook_SetHook((LPVOID*)&g_trueWSend,hook_wsend);
     
191. Mhook_SetHook((LPVOID*)&g_trueWRecv,hook_wrecv);
     
192. break;
     
193. case DLL_THREAD_ATTACH:
     
194. break;
     
195. case DLL_THREAD_DETACH:
     
196. break;
     
197. case DLL_PROCESS_DETACH:
     
198. //直接在这里UNHOOK SEND和RECV函数)
     
199. Mhook_Unhook((LPVOID*)&g_trueSend);
     
200. Mhook_Unhook((LPVOID*)&g_trueRecv);
     
201. Mhook_Unhook((LPVOID*)&g_trueWSend);
     
202. Mhook_Unhook((LPVOID*)&g_trueWRecv);
     
203. if(hModule != NULL)
     
204. FreeLibrary(hModule);
     
205. break;
     
206. }
     
207. return TRUE;
     
208. }
     
209. 最后加上DEF文件
     
210. 
     
211. 
     
212. LIBRARY
     
213. 
     
214. EXPORTS
     
215. ; 此处可以是显式导出
     
216. t001 @1
     
217. t002 @2
     
218. t003 @3
     
219. t004 @4

复制代码