Hook api

Небольшой код для перехвата функций методом модификации импорта.

bool HookImport(DWORD Base, DWORD Org, DWORD Hook)
{
    PIMAGE_FILE_HEADER pFileHdr;
    PIMAGE_OPTIONAL_HEADER pOptHdr;
    PIMAGE_IMPORT_DESCRIPTOR pImpDesc;
    bool rv = false;

    pFileHdr = (PIMAGE_FILE_HEADER)(*(PDWORD)(Base+0x3c)+Base+4);
    pOptHdr = (PIMAGE_OPTIONAL_HEADER)((DWORD)pFileHdr+sizeof(IMAGE_FILE_HEADER));
    pImpDesc = (PIMAGE_IMPORT_DESCRIPTOR)(Base +
                pOptHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

    for ( int i=0;pImpDesc[i].Characteristics; i++ )
    {
        char * CurrentModuleName = (char*)(pImpDesc[i].Name + Base);
        PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)(pImpDesc[i].FirstThunk + Base);
        for ( int j=0; pThunk[j].u1.Ordinal; j++ )
        {
            if (pThunk[j].u1.Function == Org)
            {
                pThunk[j].u1.Function = Hook;
                rv = true;
                goto Exit;
            }
        }
    }
    Exit:
    return rv;
}