67857645345

简易的API HOOK源码 摘自中国铁道出版社《Windows黑客技术解密与攻防--C语言篇》(The simple API HOOK Open Source From China Railway Press Windows hacking techniques decryption and offensive and defensive- C language papers)

directx 3d hook，用callback的方式，提供endscene()和reset()的hook，很好的例子，供有志于hook dx3d的同学参考学习(directx 3d hook, provide endscene() and reset() hook in call back,good example)

Hooks into registry and records registry calls

另一种思路注入目标进程的方法 可作为拓宽思维的例子(zhuru dll)

HOOK SSDT Hook系统服务描述表.查看SSDT.是个好东西哈哈(HOOK SSDT that s may be is you need)

MouseTrace，用 VC++写的鼠标Hook钩子，获取X,Y坐标，并适时显示在窗体上，如上图示，在窗体上移动鼠标，坐标信息会被跟踪，移出窗体则无效。(MouseTrace, using VC++ to write the mouse Hook hook, get X, Y coordinates and the time display on the form, as shown, move the mouse over the form, coordinate information will be tracked, out of form would be invalid.)

文件HOOK例程HookFindFile.rar，可以直接以VC6编译通过，达到文件隐藏目地。(HOOK routine document HookFindFile.rar, can be passed directly to the VC6 compiled to document the hidden purpose.)

用DDDK编写驱动,修改SSDT表HOOK NTDebugActiveProcess函数 钩子函数中可以判断PID号,决定是否放行,放行则在钩子函数中调用原来的NTDebugActiveProcess函数.否则直接返回False.HOOK成功后所有调用DebugActiveProcess的程序将会失效.当然可以按照你的需要HOOK更多的系统服务函数.同一服务函数的服务号在每个操作系统版本中是不同的.下面附件中编译完成的驱动请在WinXP SP2的环境下测试.否则可能会导致直接重启(Used to prepare DDDK drive, modify SSDT Table HOOK NTDebugActiveProcess function hook function can determine the PID number, decide whether to release, release in the hook function to call the original function NTDebugActiveProcess. False.HOOK Otherwise, after the success of a direct return all calls DebugActiveProcess procedures will be failure. You can, of course, in accordance with the needs of more system services HOOK function. the same service function of the service in each of the operating system versions are different. following the completion of the annex to compile drivers in WinXP SP2 test environment. or else may lead to the resumption of direct)

使用键盘钩子来接收键盘上的所有输入，进行键盘控制，可以使用这样的功能来做游戏外挂等(Use the keyboard hook to receive all input on the keyboard, the keyboard controls, you can use this function to do the game plug-in, etc.)

说明：  国外的一个中间层NDIS Hook 源码，通过Hook中间层，实现IP ARP 包的过滤。(Abroad, a middle layer NDIS Hook source, through Hook middle layer, to achieve IP ARP packet filtering.)