doc01

You can hook the system and do what you want!

strawhat_模块 远程HOOK 操作_call地址取机器码操作_jmp地址取机器码(strawhat_ HOOK module remote operation _call address fetch operation _jmp machine code machine code fetch address)

强制删除文件，无注入无驱动无hook，原理就是查找文件的锁定句柄，然后关闭句柄。(Forced to delete the file, no injection no driver no hook, the principle is to find the file lock handle, and then close the handle.)

另一种思路注入目标进程的方法 可作为拓宽思维的例子(zhuru dll)

简单的鼠标钩子，运行时可以使鼠标无法操作(Simple mouse hook, the runtime can not operate the mouse)

键盘模拟鼠标的源码 (The source to smimulate keyboard and mouse input)

Dialogic CTC 说明CTC编程C_API(Dialogic CTC CTC Programming note C_API)

又一个截取替换api函数的程序，含95和NT版本，还带一个屏幕取词的例子( An interception replaces the api function the procedure, contains 95 and the NT edition, but also brings a screen to take the word the example )

用DDDK编写驱动,修改SSDT表HOOK NTDebugActiveProcess函数 钩子函数中可以判断PID号,决定是否放行,放行则在钩子函数中调用原来的NTDebugActiveProcess函数.否则直接返回False.HOOK成功后所有调用DebugActiveProcess的程序将会失效.当然可以按照你的需要HOOK更多的系统服务函数.同一服务函数的服务号在每个操作系统版本中是不同的.下面附件中编译完成的驱动请在WinXP SP2的环境下测试.否则可能会导致直接重启(Used to prepare DDDK drive, modify SSDT Table HOOK NTDebugActiveProcess function hook function can determine the PID number, decide whether to release, release in the hook function to call the original function NTDebugActiveProcess. False.HOOK Otherwise, after the success of a direct return all calls DebugActiveProcess procedures will be failure. You can, of course, in accordance with the needs of more system services HOOK function. the same service function of the service in each of the operating system versions are different. following the completion of the annex to compile drivers in WinXP SP2 test environment. or else may lead to the resumption of direct)

消息钩子源码（SetWindowsHookEx）-拦截鼠标和键盘消息的示例程序(News source hook (SetWindowsHookEx)- intercept the mouse and keyboard messages sample procedures)