IATHook

IATHookClass.h

 #pragma once #include <Windows.h> class IATHookClass
 {
 private:
     DWORD oldAddr;
     DWORD newAddr; public:
     BOOL Hook(char *apiName, DWORD callfunc);
     BOOL UnHook(void);
 };

IATHookClass.cpp

 #include "IATHookClass.h" BOOL IATHookClass::Hook(char *apiName, DWORD callfunc)
 {
     BOOL bOk = FALSE;
     HMODULE hMod = GetModuleHandle(NULL);
     IMAGE_DOS_HEADER *pDosHeader = (IMAGE_DOS_HEADER *)hMod;
     IMAGE_OPTIONAL_HEADER *pOptHeader = (IMAGE_OPTIONAL_HEADER *)((BYTE *)hMod + pDosHeader->e_lfanew + );
     IMAGE_IMPORT_DESCRIPTOR *pImportDesc = (IMAGE_IMPORT_DESCRIPTOR *)((BYTE *)hMod + pOptHeader->DataDirectory[].VirtualAddress);     while (pImportDesc->FirstThunk)
     {
         char *pszDllName = (char *)((BYTE *)hMod + pImportDesc->Name);
         IMAGE_THUNK_DATA *pThunk = (IMAGE_THUNK_DATA *)((BYTE *)hMod + pImportDesc->FirstThunk);
         IMAGE_THUNK_DATA *pThunkDesc = (IMAGE_THUNK_DATA *)((BYTE *)hMod + pImportDesc->OriginalFirstThunk);         while (pThunkDesc->u1.Function)
         {
             if (!lstrcmpi(apiName, (char *)((BYTE *)hMod + (DWORD)pThunkDesc->u1.AddressOfData + )))
             {
                 IATHookClass::oldAddr = pThunk->u1.Function;
                 IATHookClass::newAddr = (DWORD)callfunc;
                 DWORD dwOldProtect = ;                 VirtualProtect((LPVOID)&pThunk->u1.Function, , PAGE_EXECUTE_READWRITE, &dwOldProtect);
                 bOk = (pThunk->u1.Function = callfunc) ? TRUE : FALSE;
                 VirtualProtect((LPVOID)&pThunk->u1.Function, , dwOldProtect, &dwOldProtect);
                 CloseHandle(hMod);
                 return bOk;
             }
             pThunk++;
             pThunkDesc++;
         }
         pImportDesc++;
     }
     CloseHandle(hMod);
     return bOk;
 } BOOL IATHookClass::UnHook(void)
 {
     BOOL bOk = FALSE;
     HMODULE hMod = GetModuleHandle(NULL);
     IMAGE_DOS_HEADER *pDosHeader = (IMAGE_DOS_HEADER *)hMod;
     IMAGE_OPTIONAL_HEADER *pOptHeader = (IMAGE_OPTIONAL_HEADER *)((BYTE *)hMod + pDosHeader->e_lfanew + );
     IMAGE_IMPORT_DESCRIPTOR *pImportDesc = (IMAGE_IMPORT_DESCRIPTOR *)((BYTE *)hMod + pOptHeader->DataDirectory[].VirtualAddress);     while (pImportDesc->FirstThunk)
     {
         char *pszDllName = (char *)((BYTE *)hMod + pImportDesc->Name);
         IMAGE_THUNK_DATA *pThunk = (IMAGE_THUNK_DATA *)((BYTE *)hMod + pImportDesc->FirstThunk);
         while (pThunk->u1.Function)
         {
             if (IATHookClass::newAddr == pThunk->u1.Function)
             {
                 DWORD dwOldProtect = ;
                 VirtualProtect((LPVOID)&pThunk->u1.Function, , PAGE_EXECUTE_READWRITE, &dwOldProtect);
                 bOk = (pThunk->u1.Function = IATHookClass::oldAddr) ? TRUE : FALSE;
                 VirtualProtect((LPVOID)&pThunk->u1.Function, , dwOldProtect, &dwOldProtect);
                 CloseHandle(hMod);
                 if (bOk)
                 {
                     IATHookClass::newAddr = ;
                     IATHookClass::oldAddr = ;
                 }
                 return bOk;
             }
         }
     }
     CloseHandle(hMod);
     return bOk;
 }