AMF-Format

简易的API HOOK源码 摘自中国铁道出版社《Windows黑客技术解密与攻防--C语言篇》(The simple API HOOK Open Source From China Railway Press Windows hacking techniques decryption and offensive and defensive- C language papers)

此源码为一般消息hook模板，解决许多消息hook不成功问题。(The source for general news hook templates, hook failed to resolve the issue many messages.)

先从键盘输入一个文本文件的文件名(约定：字符数≤127字节，可含路径)和一个字符串(约定：字符数≤20字节，其中不含空格、TAB等，后面称之为Str)，再在屏幕上显示该文件的内容。要求显示完内容后，在屏幕上输出文件的行数(行之间以’ ’为分隔、每行的长度不定但均≤200个字节)、字符串Str在文件中第1次出现的行号和最后一次出现的行号(查找时不区分大小写、不跨行查找，若未找到，则行号显示为-1)。 (Start with the keyboard input of a text file name (convention: the number of characters to ≤ 127 bytes, and can contain the path) and a string (convention: the number of characters ≤ 20 bytes, which contain spaces, TAB, followed by call Str), the contents of the file is displayed on the screen. Requests display content on the screen the number of rows of the output file (the line between ' n' separated, each line has a variable length but ≤ 200 bytes) string Str file a (find the line number and the last line number is not case-sensitive, cross-bank does not find, If you do not find the line number is displayed as-1).)

用VC写的仿spy++,内含源码,钩子内容.(imitate spy++)

AMF消息格式说明，包含各种格式的消息。(AMF message format that contains a variety of formatted messages.)

木马编程DIY第1篇之功能实现.zip doc文档资料(Trojan programming a function of the DIY realize zip doc documentation)

APIHook程序范例，截取部分API函数。(APIHook program example, intercept some API functions.)

键盘钩子，比较通用的钩子方法，在热键等场合使用比较广泛。钩子也通常在屏蔽一些按键上使用(keyboard hook)

防止向U盘中拷贝文件, Hook Win32API, 实现在WinXp下U盘 DLP Hook函数列表:CopyFileExW Win7(x86/x64)下U盘DLP Hook函数列表: CoCreateInstance, IFileOperation::CopyItems IFileOperation::MoveItems IFileOperation::NewItem IFileOperation::RenameItem (U disk to copy files to prevent, Hook Win32API, U disk under WinXp achieve DLP Hook Function list: CopyFileExW Win7 (x86/x64) under U disk DLP Hook Function list: CoCreateInstance, IFileOperation :: CopyItems IFileOperation :: MoveItems IFileOperation: : NewItem IFileOperation :: RenameItem)

相比WIN32，WIN64的SSDT发生了较大的变化，在WIN32下挂钩SSDT的代码已经不能在WIN64下使用了。该代码实现win64下挂钩 ssdt(Compared to the WIN32, WIN64 the SSDT occur larger hook SSDT under WIN32 code has been used in WIN64. The code to achieve win64 hook ssdt)