与HOOK相关的API

《与HOOK相关的API》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、·IntroductionInterceptingWin32APIcallshasalwaysbeenachallengingsubjectamongmostoftheWindowsdevelopersandIhavetoadmit,it'sbeenoneofmyfavoritetopics.ThetermHookingrepresentsafundamentaltechniqueofgettingcontroloveraparticularpieceofcodeexecution.Itprovidesanstraightforwardmechanismthatcaneasilya

2、ltertheoperatingsystem'sbehavioraswellas3rdpartyproducts,withouthavingtheirsourcecodeavailable.ManymodernsystemsdrawtheattentiontotheirabilitytoutilizeexistingWindowsapplicationsbyemployingspyingtechniques.Akeymotivationforhooking,isnotonlytocontributetoadvancedfunctionalities,butalsotoinjectu

3、ser-suppliedcodefordebuggingpurposes.Unlikesomerelatively"old"operatingsystemslikeDOSandWindows3.xx,thepresentWindowsOSasNT/2Kand9xprovidesophisticatedmechanismstoseparateaddressspacesofeachprocess.Thisarchitectureoffersarealmemoryprotection,thusnoapplicationisabletocorrupttheaddressspaceofano

4、therprocessorintheworsecaseeventocrashtheoperatingsystemitself.Thisfactmakesalotharderthedevelopmentofsystem-awarehooks.Mymotivationforwritingthisarticlewastheneedforareallysimplehookingframework,thatwillofferaneasytouseinterfaceandabilitytocapturedifferentAPIs.Itintendstorevealsomeofthetricks

5、thatcanhelpyoutowriteyourownspyingsystem.ItsuggestsasinglesolutionhowtobuildasetforhookingWin32APIfunctionsonNT/2Kaswellas98/Me(shortlynamedinthearticle9x)familyWindows.ForthesakeofsimplicityIdecidednottoaddasupportdoUNICODE.However,withsomeminormodificationsofthecodeyoucouldeasilyaccomplishth

6、istask.Spyingofapplicationsprovidesmanyadvantages:1.APIfunction'smonitoringTheabilitytocontrolAPIfunctioncallsisextremelyhelpfulandenablesdeveloperstotrackdownspecific"invisible"actionsthatoccurduringtheAPIcall.Itcontributestocomprehensivevalidationofparametersaswellasreportsproblemsthatusuall

7、yremainoverlookedbehindthescene.Forinstancesometimes,itmightbeveryhelpfultomonitormemoryrelatedAPIfunctionsforcatchingresourceleaks.2.DebuggingandreverseengineeringBesidesthestandardmethodsfordebuggingAPIhookinghasadeservedreputationfor