www.gusucode.com > VB病毒编程源代码资料及教程 > VB病毒编程源代码资料及教程/code/!!病毒编程资料/禁止进程创建/dll/hook.cpp

    #include "stdafx.h"
#include <windows.h>
#include "stdio.h"
#include "stdlib.h"

HANDLE hProcess=0;
UCHAR OldCode[5]={0}, NewCode[5]={0};
ULONG FunAddr=0;
HWND hExe=0;
HINSTANCE hMod=0;
HHOOK hHook=0;

BOOL HookStatus(BOOL Status){
	BOOL ret=FALSE;
	if (Status) {
		ret = WriteProcessMemory(hProcess, (void *)FunAddr, NewCode, 5, 0);
		if (ret) return TRUE;}
	else {
		ret = WriteProcessMemory(hProcess, (void *)FunAddr, OldCode, 5, 0);
		if (ret) return TRUE;}
	return FALSE;
}

BOOL WINAPI CreateProcessWCallBack(LPCWSTR lpApplicationName,
								  LPWSTR lpCommandLine,
								  LPSECURITY_ATTRIBUTES lpProcessAttributes,
								  LPSECURITY_ATTRIBUTES lpThreadAttributes,
								  BOOL bInheritHandles,
								  DWORD dwCreationFlags,
								  LPVOID lpEnvironment,
								  LPCWSTR lpCurrentDirectory,
								  LPSTARTUPINFOW lpStartupInfo,
								  LPPROCESS_INFORMATION lpProcessInformation){
	ULONG ret=0;
	BOOL b=FALSE;
	COPYDATASTRUCT cds={0};

	cds.lpData = (void *)lpApplicationName;
	cds.cbData = 255;

	ret = SendMessage(hExe, WM_COPYDATA, GetCurrentProcessId(), (LPARAM)&cds);
	if (ret==1234) {
		HookStatus(FALSE);
		b = CreateProcessW(lpApplicationName, 
							lpCommandLine, 
							lpProcessAttributes,
							lpThreadAttributes,
							bInheritHandles,
							dwCreationFlags,
							lpEnvironment,
							lpCurrentDirectory,
							lpStartupInfo,
							lpProcessInformation);
		HookStatus(TRUE);
		return b;
	} else return FALSE;
	return FALSE;
}

BOOL HookCreateProcess(){
	ULONG JmpAddr=0;
	char msg[255]={0};

	FunAddr = (ULONG)GetProcAddress(LoadLibrary("Kernel32.dll"), "CreateProcessW");
	memcpy(OldCode, (void *)FunAddr, 5);
	NewCode[0] = 0xe9;
	JmpAddr = (ULONG)CreateProcessWCallBack - FunAddr - 5;
	memcpy(&NewCode[1], &JmpAddr, 4);
	//sprintf(msg, "NewCode: %x %x %x %x %x\nFunAddr: %x\nJmpAddr: %x\nMyFun: %x", NewCode[0], NewCode[1], NewCode[2], NewCode[3], NewCode[4], FunAddr, JmpAddr, (ULONG)CreateProcessWCallBack);
	//MessageBox(0, msg, "", MB_OK);
	HookStatus(TRUE);
	return TRUE;
}

BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved)
{
	hMod = (HINSTANCE)hModule;
	if (ul_reason_for_call==DLL_PROCESS_ATTACH){
		hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, GetCurrentProcessId());
		hExe = FindWindow(NULL, "Hook CreateProcessW");
		HookCreateProcess();}
	if (ul_reason_for_call==DLL_PROCESS_DETACH) HookStatus(FALSE);
    return TRUE;
}

extern "C" __declspec(dllexport) BOOL UnLoadHook(){
	return(UnhookWindowsHookEx(hHook));
}

LRESULT CALLBACK HookProc(int nCode,WPARAM wParam,LPARAM lParam){
	return(CallNextHookEx(hHook,nCode,wParam,lParam));
}

extern "C" __declspec(dllexport) BOOL StartHook(){
	hHook = SetWindowsHookEx(WH_GETMESSAGE,(HOOKPROC)HookProc, hMod, 0);
	if (hHook) return TRUE;
	return FALSE;
}