阅读背景:

求大神救急(怎么让win7 64位的系统,DNS解析的时候,调用自己写的代码来解析。) [问题点数:100分]

来源:互联网 

class CHOOKAPI { public:     LPVOID    pOldFunEntry, pNewFunEntry ;    // 初始函数地址、HOOK后的函数地址     BYTE    bOldByte[5], bNewByte[5] ;        // 原始字节、目标字节   public:     CHOOKAPI () {}     ~CHOOKAPI() {}     // 实现HOOK API     void Hook ( PSTR szModuleName, PSTR szFunName, FARPROC pFun )     {             HMODULE    hMod = ::GetModuleHandleA ( szModuleName ) ;         if ( hMod != NULL )         {             pNewFunEntry    = (LPVOID)pFun ;             pOldFunEntry    = (LPVOID)GetProcAddress ( hMod, szFunName ) ;             bNewByte[0]        = 0xE9 ;             *((PDWORD)(&(bNewByte[1])))    = (DWORD)pNewFunEntry - (DWORD)pOldFunEntry - 5 ;                DWORD   dwProtect, dwWriteByte, dwReadByte ;              VirtualProtect ( (LPVOID)pOldFunEntry, 5, PAGE_READWRITE, &dwProtect );             ReadProcessMemory    ( GetCurrentProcess(), (LPVOID)pOldFunEntry, bOldByte, 5, &dwReadByte ) ;                     WriteProcessMemory    ( GetCurrentProcess(), (LPVOID)pOldFunEntry, bNewByte, 5, &dwWriteByte ) ;             VirtualProtect ( (LPVOID)pOldFunEntry, 5, dwProtect, NULL ) ;         }     }     // 重新HOOK     void ReHook ()     {         DWORD    dwProtect, dwWriteByte ;         VirtualProtect ( pOldFunEntry, 5, PAGE_READWRITE, &dwProtect );         WriteProcessMemory ( GetCurrentProcess(), pOldFunEntry, bNewByte, 5, &dwWriteByte ) ;         VirtualProtect ( pOldFunEntry, 5, dwProtect, NULL ) ;     }     // 撤消HOOK     void UnHook ()     {         DWORD    dwProtect, dwWriteByte ;         VirtualProtect ( pOldFunEntry, 5, PAGE_READWRITE, &dwProtect );         WriteProcessMemory ( GetCurrentProcess(), pOldFunEntry, bOldByte, 5, &dwWriteByte ) ;         VirtualProtect ( pOldFunEntry, 5, dwProtect, NULL ) ;     } } ; CHOOKAPI dnshook; long WINAPI DnsQuery_Wnew( __in                PCWSTR          pszName,     __in                WORD            wType,     __in                DWORD           Options,     __inout_opt         PVOID           pExtra,     __deref_out_opt     PDNS_RECORD *   ppQueryResults,     __deref_opt_out_opt PVOID *         pReserved     ) {     dnshook.UnHook();     long ret=0;     /*     DNS解析相关的代码     */    dnshook.ReHook();     return ret;       }   然后调用: dnshook.Hook("dnsapi.dll","DnsQuery_W",(FARPROC)DnsQuery_Wnew);//写在NSPStartup或WSPStartup都可以   这样写在win7 64位下,就不能用了。     听说可以在NSPLookupServiceBegin NSPLookupServiceNext NSPLookupServiceEnd这三个函数里写代码。看找了好多资料也没有搞明白,也没有找到三个API成功的例子。    class CHOOKAPI { public:     LPVOID    pOldFunE



你的当前访问异常,请进行认证后继续阅读剩余内容。

分享到: