写一个对NtWriteFile的APIHOOK的动态链接库完整代码 用c语言 用outputdebugstringa输出参数 用中文注释

以下是一个对NtWriteFile的APIHOOK的动态链接库完整代码，使用C语言，使用OutputDebugStringA输出参数：

#include <windows.h>
#include <stdio.h>
#include <winternl.h>

// 定义原始函数指针类型
typedef NTSTATUS(NTAPI* PNTWRITEFILE)(HANDLE, HANDLE, PVOID, PVOID, PVOID, ULONG, PLARGE_INTEGER, PVOID);

// 定义全局变量存储原始函数地址
PNTWRITEFILE g_pNtWriteFile = NULL;

// 定义APIHOOK函数
NTSTATUS NTAPI MyNtWriteFile(HANDLE FileHandle, HANDLE Event, PVOID ApcRoutine, PVOID ApcContext, PVOID IoStatusBlock, ULONG BufferSize, PLARGE_INTEGER ByteOffset, PVOID Key)
{
    // 输出参数
    char szDebugString[1024] = { 0 };
    sprintf_s(szDebugString, "[MyNtWriteFile] FileHandle: %p, Event: %p, ApcRoutine: %p, ApcContext: %p, IoStatusBlock: %p, BufferSize: %u, ByteOffset: %lld, Key: %p", FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, BufferSize, ByteOffset ? ByteOffset->QuadPart : 0, Key);
    OutputDebugStringA(szDebugString);

    // 调用原始函数
    return g_pNtWriteFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, BufferSize, ByteOffset, Key);
}

// DLL入口函数
BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        // 获取原始函数地址
        g_pNtWriteFile = (PNTWRITEFILE)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtWriteFile");
        if (g_pNtWriteFile == NULL)
        {
            return FALSE;
        }

        // 修改函数地址
        DWORD dwOldProtect;
        if (!VirtualProtect(g_pNtWriteFile, sizeof(DWORD), PAGE_EXECUTE_READWRITE, &dwOldProtect))
        {
            return FALSE;
        }
        *(DWORD*)g_pNtWriteFile = (DWORD)MyNtWriteFile;
        VirtualProtect(g_pNtWriteFile, sizeof(DWORD), dwOldProtect, &dwOldProtect);
        break;

    case DLL_PROCESS_DETACH:
        // 恢复函数地址
        if (g_pNtWriteFile != NULL)
        {
            if (!VirtualProtect(g_pNtWriteFile, sizeof(DWORD), PAGE_EXECUTE_READWRITE, &dwOldProtect))
            {
                return FALSE;
            }
            *(DWORD*)g_pNtWriteFile = (DWORD)NtWriteFile;
            VirtualProtect(g_pNtWriteFile, sizeof(DWORD), dwOldProtect, &dwOldProtect);
        }
        break;
    }
    return TRUE;
}