Windows API Hooking: Intercepting NtWriteFile Function

#include <windows.h> #include <stdio.h> #include <winternl.h>

// 定义原始函数指针类型 typedef NTSTATUS(NTAPI* PNTWRITEFILE)(HANDLE, HANDLE, PVOID, PVOID, PVOID, ULONG, PLARGE_INTEGER, PVOID);

// 定义全局变量存储原始函数地址 PNTWRITEFILE g_pNtWriteFile = NULL;

// 定义APIHOOK函数 NTSTATUS NTAPI MyNtWriteFile(HANDLE FileHandle, HANDLE Event, PVOID ApcRoutine, PVOID ApcContext, PVOID IoStatusBlock, ULONG BufferSize, PLARGE_INTEGER ByteOffset, PVOID Key) { // 输出参数 char szDebugString[1024] = { 0 }; sprintf_s(szDebugString, '[MyNtWriteFile] FileHandle: %p, Event: %p, ApcRoutine: %p, ApcContext: %p, IoStatusBlock: %p, BufferSize: %u, ByteOffset: %lld, Key: %p', FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, BufferSize, ByteOffset ? ByteOffset->QuadPart : 0, Key); OutputDebugStringA(szDebugString);

// 调用原始函数
return g_pNtWriteFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, BufferSize, ByteOffset, Key);

}

// DLL入口函数 BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: // 获取原始函数地址 g_pNtWriteFile = (PNTWRITEFILE)GetProcAddress(GetModuleHandleA('ntdll.dll'), 'NtWriteFile'); if (g_pNtWriteFile == NULL) { return FALSE; }

    // 修改函数地址
    DWORD dwOldProtect;
    if (!VirtualProtect(g_pNtWriteFile, sizeof(DWORD), PAGE_EXECUTE_READWRITE, &dwOldProtect))
    {
        return FALSE;
    }
    *(DWORD*)g_pNtWriteFile = (DWORD)MyNtWriteFile;
    VirtualProtect(g_pNtWriteFile, sizeof(DWORD), dwOldProtect, &dwOldProtect);
    break;

case DLL_PROCESS_DETACH:
    // 恢复函数地址
    if (g_pNtWriteFile != NULL)
    {
        PNTWRITEFILE pNtWriteFile = (PNTWRITEFILE)GetProcAddress(GetModuleHandleA('ntdll.dll'), 'NtWriteFile');
        if (pNtWriteFile != NULL)
        {
            if (!VirtualProtect(pNtWriteFile, sizeof(DWORD), PAGE_EXECUTE_READWRITE, &dwOldProtect))
            {
                return FALSE;
            }
            *(DWORD*)pNtWriteFile = (DWORD)g_pNtWriteFile;
            VirtualProtect(pNtWriteFile, sizeof(DWORD), dwOldProtect, &dwOldProtect);
        }
    }
    break;
}
return TRUE;

}