我在網上找到一段Hook Api(CreateProcessW)的代碼,編譯後執行,可以攔截到使用該Api的程序,但在停止Hook退出程序時,再去開啟使用該Api程序時系統會提示:
'"0x02cacb54"指令參考的"0x02cacb54"記憶體.該記憶體不能為"read"
以下是在Dll文件裡使用的ApiHook.pas

{------------------APIHook.pas---------------------}

unit APIHook;

interface

uses
SysUtils, Windows, WinSock, Dialogs;

type
{ 要HOOK的API函数定义 }
TCreatePW = function (lpApplicationName: PWideChar; lpCommandLine: PWideChar;
lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;
var lpProcessInformation: TProcessInformation): BOOL; stdcall;


procedure HookAPI;
procedure UnHookAPI;

var
ProcessHandle: HWND;
BaseAddress: array [0..2] of Pointer;
OldProc: array [0..2] of array [0..7] of Byte;
NewPorc: array [0..2] of array [0..7] of Byte;

implementation

{ 自定义的函数,用于覆盖系统的CreateProcessW函数 }
function MyCreatePW(lpApplicationName: PWideChar; lpCommandLine: PWideChar;
lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;
var lpProcessInformation: TProcessInformation): BOOL; stdcall;
var
nSize: Cardinal;
begin
{ 显示打开程序的命令行和文件名}
MessageBoxW(0, lpCommandLine ,lpApplicationName , 0);
WriteProcessMemory(ProcessHandle, BaseAddress[0], @OldProc[0], 8, nSize);//這一句是修改成原來函數的地址,讓程序能正常打開
Result := CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes,
lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment,
lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
WriteProcessMemory(ProcessHandle, BaseAddress[0], @NewPorc[0], 8, nSize);//在程序正常打開後再修改成自定義函數的地址,使所有程序在下次打開時都要先調用自定義函數
end;

procedure HookAPI;
var
DLLModule: THandle;
nSize: Cardinal;
Dat: DWORD;
Tmp : array [0..3] of Byte;
begin
ProcessHandle := DWORD(-1);
DLLModule := LoadLibrary('kernel32.dll');
{ 系统函数入口点地址 }
BaseAddress[0] := GetProcAddress(DLLModule, 'CreateProcessW');
Dat := DWORD(@MyCreatePA);
Move(Dat, Tmp, 4);
NewPorc[0][0] := $B8; { 汇编跳转指令 }
NewPorc[0][1] := Tmp[0]; { 跳转到自身的函数 }
NewPorc[0][2] := Tmp[1];
NewPorc[0][3] := Tmp[2];
NewPorc[0][4] := Tmp[3];
NewPorc[0][5] := $FF;
NewPorc[0][6] := $E0;
NewPorc[0][7] := 0;
{ 读取系统函数内存地址 }
ReadProcessMemory(ProcessHandle, BaseAddress[0], @OldProc[0], 8, nSize);
{ 用自己的函数地址覆盖系统的函数地址 }
WriteProcessMemory(ProcessHandle, BaseAddress[0], @NewPorc[0], 8, nSize);
end;

procedure UnHookAPI;
var
nSize: Cardinal;
begin
{ 恢复所修改的地址 }
WriteProcessMemory(ProcessHandle, BaseAddress[0], @OldProc[0], 8, nSize); //主要是這句出了問題,為何無法恢復原來函數的地址??
end;

end.