MCH_Demos

QQ 盗号模拟， 监视键盘程序。 做的比较粗糙点(QQ simulated ones, monitor keyboard procedures. Rough point of comparison to do)

实例13-1：动态链接库（Dll）实例。源代码在光盘中“13dlltest ”目录下。 实例13-2：鼠标钩子应用实例。源代码在光盘中“13MouseHook”目录下。 实例13-3：键盘钩子应用实例。源代码在光盘中“13KeyboardHook”目录下。( dlltest MouseHook KeyboardHook)

APIHOOK,通过遍历PE文件修改导出函数表进行HOOK(APIHOOK, by traversing the PE file to modify the derived function table HOOK)

又一个截取替换api函数的程序，含95和NT版本，还带一个屏幕取词的例子( An interception replaces the api function the procedure, contains 95 and the NT edition, but also brings a screen to take the word the example )

简单的鼠标钩子，运行时可以使鼠标无法操作(Simple mouse hook, the runtime can not operate the mouse)

说明：  上个程序的DLL 上个程序的D(In the process the last DLL procedures D)

N种内核注入DLL的思路及实现,很好的参考资料(Kernel inject DLL N kinds of ideas and implementation, good reference)

前段时间做键盘程序找的资料，一个钩子程序，程序本身没有什么，主要是用了大量的api函数值得大家参考一下。(side of the keyboard to do procedures for the information, a hook procedures, the process itself is nothing much to it. it is mainly used a lot of api function worth examined.)

用DDDK编写驱动,修改SSDT表HOOK NTDebugActiveProcess函数 钩子函数中可以判断PID号,决定是否放行,放行则在钩子函数中调用原来的NTDebugActiveProcess函数.否则直接返回False.HOOK成功后所有调用DebugActiveProcess的程序将会失效.当然可以按照你的需要HOOK更多的系统服务函数.同一服务函数的服务号在每个操作系统版本中是不同的.下面附件中编译完成的驱动请在WinXP SP2的环境下测试.否则可能会导致直接重启(Used to prepare DDDK drive, modify SSDT Table HOOK NTDebugActiveProcess function hook function can determine the PID number, decide whether to release, release in the hook function to call the original function NTDebugActiveProcess. False.HOOK Otherwise, after the success of a direct return all calls DebugActiveProcess procedures will be failure. You can, of course, in accordance with the needs of more system services HOOK function. the same service function of the service in each of the operating system versions are different. following the completion of the annex to compile drivers in WinXP SP2 test environment. or else may lead to the resumption of direct)

钩子编程的好例子，钩子的种类好多，这个事cbt钩子，用来监视程序端的改变。(Programming hook a good example of the type of hook a lot, this thing cbt hook, used to monitor changes in client program.)