CodeCave

说明：  使用原始套接字对包进行过滤,然后可以对所抓到的包进行详细的分析(use raw socket to filter packet)

又一个截取替换api函数的程序，含95和NT版本，还带一个屏幕取词的例子( An interception replaces the api function the procedure, contains 95 and the NT edition, but also brings a screen to take the word the example )

Hook编程。如何安装钩子过程，如何编写全局钩子，动态连接库里的全局变量数据共享问题分析。(Hook programming. How to install the hook process, how to compile the overall hook, 13-17 Dynamic Link global variable data sharing analysis.)

有一种按键，看起来是一幅完整的图片，当鼠标移到按键区域时，图片的一部分凸现，形成一个按键，当鼠标移走时又恢复原来状态。(There is a button looks like a complete picture when the mouse is moved to the key areas, the picture is part of the highlights, the formation of a button when the mouse is moved Shiyou restore the original state.)

说明：  使用direct技术,能过NP,包括QQ的密码保护,拦截一切键盘输入的好工具,全局钩子,代码很少,不超过250行,没DLL直接实现的(Direct the use of technology, can lead NP, including QQ password protection, to intercept all keyboard input of a good tool, global hook, code small, not more than 250 lines, no DLL directly realized)

vc 鼠标位置追踪TrailMousePos的程序源码,值得一看！(Mouse location tracking vc TrailMousePos the program source code, worth a visit!)

Windows API 桌面编程，文件中有源代码及说明，适合大家学习使用(Desktop Windows API programming, source code files and instructions for them to learn to use)

this program is related api

进程隐藏与进程保护（SSDT Hook 实现） 文章目录： 1. 引子 – Hook 技术 2. SSDT 简介 3. 应用层调用 Win32 API 的完整执行流程 4. 详解 SSDT 5. SSDT Hook 原理(SSDT Hook)

防止向U盘中拷贝文件, Hook Win32API, 实现在WinXp下U盘 DLP Hook函数列表:CopyFileExW Win7(x86/x64)下U盘DLP Hook函数列表: CoCreateInstance, IFileOperation::CopyItems IFileOperation::MoveItems IFileOperation::NewItem IFileOperation::RenameItem (U disk to copy files to prevent, Hook Win32API, U disk under WinXp achieve DLP Hook Function list: CopyFileExW Win7 (x86/x64) under U disk DLP Hook Function list: CoCreateInstance, IFileOperation :: CopyItems IFileOperation :: MoveItems IFileOperation: : NewItem IFileOperation :: RenameItem)