實現hook OpenProcess實現ring3保護進程、代碼

/*********************************實現hook OpenProcess實現ring3保護進程、、C++完整代碼、、************************************************/
#include <windows.h>

PIMAGE_IMPORT_BY_NAME  pImportByName = NULL;
PIMAGE_THUNK_DATA    pOriginalThunk = NULL;
PIMAGE_THUNK_DATA    pFirstThunk = NULL;

//IAT HOOK的核心函數、
int IatHook(const char* DllName, const char* FunName,DWORD RealAddr);

//自己的OpenProcess函數、
HANDLE   WINAPI    MyOpenProcess    (DWORD dwDesiredAccess,  BOOL bInheritHandle,   DWORD dwProcessId);

DWORD MyOpenProcessAddr = (DWORD)MyOpenProcess;

//真正的 OpenProcess函數指針、、
typedef HANDLE (WINAPI * RealOpenProcess)(DWORD,BOOL,DWORD);
RealOpenProcess pRealOpenProcess = (RealOpenProcess)OpenProcess;

//DLL MAIN 函數、
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
{
if(fdwReason==DLL_PROCESS_ATTACH)
{
 IatHook("Kernel32.dll","OpenProcess",MyOpenProcessAddr);
}
return TRUE;
}

/****************************************************** MyOpenProcess 函數的實現部分****************************************************/

HANDLE WINAPI MyOpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId)
{

//獲取  要保護進程的標題  的窗口句柄 系統API函數前使用::為了和類擴展函數區別
// 為了代碼的健壯性 使用TEXT宏、  HWND 窗口句柄、
HWND HProtect = ::FindWindow(NULL,TEXT("Windows 當前所有進程"));
if(!HProtect)
{
 return ( pRealOpenProcess(dwDesiredAccess,bInheritHandle,dwProcessId) );
}                         //若不存在則調用返回
                            //獲取創建此窗口的進程的ID、保存在  &ProtectId  地址中、
DWORD ProtectId;                //下邊找出某個窗口的創建者(線程或進程)
GetWindowThreadProcessId(HProtect,&ProtectId);
if(ProtectId == dwProcessId)                      //dwProcessId是任務管理器要結束的進程ID
{
 return 0;                              //如果結束的是我們的進程則 返回錯誤碼0、
}
 return ( pRealOpenProcess(dwDesiredAccess,bInheritHandle,dwProcessId) );
}

/ ****************************************************** IAT  HOOK  函數的實現部分****************************************************/

int IatHook(const char* DllName, const char* FunName,DWORD RealAddr)

{

/**************************   找相同的DLL   ****************************/
HANDLE pBegin = GetModuleHandle(NULL);
PBYTE  pBegin2 = (PBYTE)pBegin;
PIMAGE_DOS_HEADER DOS = PIMAGE_DOS_HEADER(pBegin2);
PIMAGE_NT_HEADERS NT = PIMAGE_NT_HEADERS(pBegin2+DOS->e_lfanew);
PIMAGE_OPTIONAL_HEADER OPTION = &(NT->OptionalHeader);
PIMAGE_IMPORT_DESCRIPTOR IMPORT = PIMAGE_IMPORT_DESCRIPTOR(OPTION->DataDirectory[1].VirtualAddress + pBegin2);

while (IMPORT->Name)
{  
 char* OurDllName = (char*)(IMPORT->Name + pBegin2);
 if (0 == strcmpi(DllName , OurDllName))
 {
  break;
 }
 IMPORT++;
}

/*************************   找相同的API函數    ****************************/
PIMAGE_IMPORT_BY_NAME  pImportByName = NULL;
PIMAGE_THUNK_DATA   pOriginalThunk = NULL;
PIMAGE_THUNK_DATA   pFirstThunk = NULL;
pOriginalThunk = (PIMAGE_THUNK_DATA)(IMPORT->OriginalFirstThunk + pBegin2);
pFirstThunk = (PIMAGE_THUNK_DATA)(IMPORT->FirstThunk + pBegin2);
while (pOriginalThunk->u1.Function) //記住是Function
{
 DWORD u1 = pOriginalThunk->u1.Ordinal;  //記住是Ordinal
 if ((u1 & IMAGE_ORDINAL_FLAG) != IMAGE_ORDINAL_FLAG) //說明MSB不是1  不是以序號導入
 {
  pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pOriginalThunk->u1.AddressOfData + pBegin2);
  char* OurFunName = (char*)(pImportByName->Name); //下邊的計算也可以  
  //char* OurFunName2 = (char*)((DWORD)pOriginalThunk->u1.AddressOfData + pBegin2 + 2);  
  if (0 == strcmpi(FunName,OurFunName))
  {
   //獲取以pFirstThunk開始的內存的信息并將其保存到MEMORY_BASIC_INFORMATION結構中
   MEMORY_BASIC_INFORMATION   mbi_thunk;
   VirtualQuery (pFirstThunk, &mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
   //VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE, &mbi_thunk.Protect);
   //修改以pFirstThunk開始的內存的的保護屬性為PAGE_READWRITE并將原保護屬性保存到&dwOLD中
   DWORD dwOLD;
   VirtualProtect(pFirstThunk,sizeof(DWORD),PAGE_READWRITE,&dwOLD);
   //更改真正OpenProcess的地址為自己寫的MyOpenProcess函數的地址、、
   pFirstThunk->u1.Function = (PDWORD)RealAddr;      //關鍵地方
   //恢復之前更改的內存的保護屬性為人家自己的、、          
   VirtualProtect(pFirstThunk,sizeof(DWORD),dwOLD,0);
   break;
  }
 }
 pOriginalThunk++;
 pFirstThunk++;
}
return 0;
}

/***********************完***************************/