C语言实现NtWriteFile API Hook动态链接库完整代码

#include <windows.h> #include <stdio.h>

#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)

typedef NTSTATUS (WINAPI *PFNNtWriteFile)( HANDLE FileHandle, HANDLE Event, PVOID ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PVOID Key );

PFNNtWriteFile g_pNtWriteFile = NULL;

NTSTATUS WINAPI NtWriteFileHook( HANDLE FileHandle, HANDLE Event, PVOID ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PVOID Key ) { NTSTATUS status = STATUS_SUCCESS; DWORD dwLastError = ERROR_SUCCESS;

__try {
    // Call the original function
    status = g_pNtWriteFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key);

    // Output the parameters
    char szOutput[1024];
    sprintf_s(szOutput, 'NtWriteFileHook - FileHandle: %p, Event: %p, ApcRoutine: %p, ApcContext: %p, IoStatusBlock: %p, Buffer: %p, Length: %lu, ByteOffset: %p, Key: %p, status: %lx\n', 
              FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key, status);
    OutputDebugStringA(szOutput);
} 
__except(EXCEPTION_EXECUTE_HANDLER) {
    dwLastError = GetExceptionCode();
    status = STATUS_INFO_LENGTH_MISMATCH;
}

SetLastError(dwLastError);
return status;

}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: // Get the address of NtWriteFile g_pNtWriteFile = (PFNNtWriteFile)GetProcAddress(GetModuleHandleA('ntdll.dll'), 'NtWriteFile');

        // Replace NtWriteFile with our hook
        DWORD dwOldProtect;
        VirtualProtect(g_pNtWriteFile, sizeof(PFNNtWriteFile), PAGE_EXECUTE_READWRITE, &dwOldProtect);
        g_pNtWriteFile = (PFNNtWriteFile)InterlockedExchange((LONG volatile*)g_pNtWriteFile, (LONG)NtWriteFileHook);
        VirtualProtect(g_pNtWriteFile, sizeof(PFNNtWriteFile), dwOldProtect, &dwOldProtect);
        break;
    case DLL_PROCESS_DETACH:
        // Restore NtWriteFile
        DWORD dwOldProtect;
        VirtualProtect(g_pNtWriteFile, sizeof(PFNNtWriteFile), PAGE_EXECUTE_READWRITE, &dwOldProtect);
        InterlockedExchange((LONG volatile*)g_pNtWriteFile, (LONG)NtWriteFileHook);
        VirtualProtect(g_pNtWriteFile, sizeof(PFNNtWriteFile), dwOldProtect, &dwOldProtect);
        break;
    default:
        break;
}

return TRUE;

}