Description: 我在XP下用过detour,也是用钩子将dll注入到其他进程进行API拦截，当时拦截的是 ShowWindow以及文件操作的一些API，感觉没什么问题阿.你可以先用Detour拦截一下其他的API试试，比如 CreateProcess,这个API我拦截过，Detour能拦截的
-I used the XP detour. also used to hook dll injected into other processes API interception, then intercept the ShowWindow and some file manipulation API, A feeling no problems. You can use Detour to intercept a few other API try. For example CreateProcess, I intercept the API that can intercept the Detour Platform: |
Size: 2048 |
Author:byron |
Hits:
Description: 微软公司的拦截api开发包:
All Detours functions are compatible with all x86 version of Windows NT,
Windows 2000, and Windows XP. However, under Windows 95, Windows 98, and
Windows ME, the DetourFunction* APIS do not work unless the program is
running under a debugger (the process was created with the DEBUG_PROCESS flag
on the call to the CreateProcess* APIs). Since most programs are not typically
run under a debugger, the DetourFunction* APIs do not work for most programs
on Win9x platforms.-Microsoft's interception api development kits : All Detours functions are compatible with all x 86 version of Windows NT, Windows 2000, and Windows XP. However, under Windows 95, Windows 98 and Windows ME,* DetourFunction the APIS do not work unless the program is running under a debugger (the proces 's was created with the flag on the DEBUG_PROCESS call to the CreateProcess* APIs). Since most pr ograms are not typically run under a debugger. the DetourFunction* APIs do not work for most pr ograms on Win9x platforms. Platform: |
Size: 529408 |
Author:摩尔 |
Hits:
Description: 开始，运行输入 sigverif
通过检查数字签名就知道是不是ms的了。
主要使用Win32API实现验证应用或驱动程
WinVerifyTrust API。如果该API被Hook有没有其他方法验证应用或驱动程序是否通过微软签名？如果仅仅是被挂钩了IAT，那么可以直接通过函数指针调用。
如果是像Detours那样用jmp改写了函数头，可以通过读取WinTrust.dll中WinVerifyTrust的实现位置，恢复函数头的机器码。
不知道使用CryptoAPI，再使用指定的Microsoft证书
是不是更好一点，不容易被欺骗
怕调api被hook的话，自己将验证的代码写出来，用openssl应该容易点。-Start, Run enter sigverif by checking the digital signature is not on the know of the ms. Win32API realize the main use of the application or driver to verify WinVerifyTrust API. If the API was Hook has no other way to verify whether the application or driver through Microsoft Signed? If merely being linked to the IAT, you can call directly through the function pointer. If it is used as the Detours as to alter the function jmp head, can be read in WinVerifyTrust Wintrust.dll realize the location, the restoration of function of the binary header. Do not know the use of CryptoAPI, and then use the specified certificate is not Microsoft a little better, not easy to be deceived by fear api tune hook, then he would write the code to verify, using openssl should be easy points. Platform: |
Size: 200704 |
Author:齐欢乐 |
Hits:
Description: Detours是一强大的工具，提供了简单易用的函数接口来拦截(Hook)WIN32 API调用和为一个已在运行的进程装入一个D-Detours is a powerful tool that provides easy-to-use interface to intercept function (Hook) WIN32 API calls and as a process is already running into a D Platform: |
Size: 63488 |
Author:sony |
Hits:
Description: 用Detours库截获CreateFileW,实现对该API的挂钩.初学者可以学习一下Detours库的调用使用方法.-Intercepted using Detours library CreateFileW, realize the linkage of the API. Beginners can learn about Detours library calls to use. Platform: |
Size: 2916352 |
Author:wxb |
Hits:
Description: 阻止全局钩子的加载.使用了微软的Detours库进行API拦截。如果只是为了拦截一个函数，使用Detours好像有点儿浪费。本程序不使用Detours库，直接对LoadLibraryExW函数进行拦截。-Hook to prevent the loading of the overall situation. The use of Microsoft' s Detours library to intercept API. If only in order to intercept a function, use the Detours seems a bit wasteful. This procedure does not use the Detours library, direct-to-interception LoadLibraryExW function. Platform: |
Size: 12288 |
Author:高军 |
Hits:
Description: Detours应用的文章，比较老了，但是对HOOK API还是有帮助的。-Detours application of articles for using Hook API, but HOOK API is still helpful. Platform: |
Size: 84992 |
Author:lichunlin |
Hits:
Description: 使用微软detours库编写的API拦截函数，本代码主要提供了拦截recv函数的例子，其他函数的拦截可以参考例子编写-Detours library prepared using Microsoft API interception function, the code provides a blocking recv function key example of other function block can refer to the example of the preparation Platform: |
Size: 15767552 |
Author:david |
Hits:
Description: 1、自带detours库文件 说明文件pdf
2、底层HOOK API CreateFile 有范例程序(vs2008)
3、底层Hook API DeleteFile-1, detours library comes with documentation pdf
2, bottom HOOK API CreateFile a sample program (vs2008)
3, bottom Hook API DeleteFile Platform: |
Size: 959488 |
Author:zhouyongku |
Hits:
Description: 一个用于做HOOK开发的库，已经修改过，有32位和64位两种支持-the library which provide the function to HOOK the system API. Platform: |
Size: 7565312 |
Author:朱时宇 |
Hits:
Description: 类似微软的Detours，API HOOK库，支持X86/X64-Similar to the Microsoft Detours, API HOOK library support X86/X64 Platform: |
Size: 803840 |
Author:zhuangge |
Hits:
Description: Show to hook some windows api.
this is like the famous detours from microsoft.*
Here the source version of the solution-Show how to hook some windows api.
this is like the famous detours from microsoft.*
Here the source version of the solution Platform: |
Size: 72704 |
Author:pepe57 |
Hits:
Description: 微软Detours钩子库的DLL版。采用VS2012重新编译，生成stdcall的DLL，方便其他开发工具调用。已经测试了可以在Delphi中调用成功。-Microsoft Detours hook API, DLL version . Recompiled using VS2012 to generate stdcall functions, facilitate other development tools called. Have tested can be successfully invoked in Delphi. Platform: |
Size: 49152 |
Author:Chris Liu |
Hits:
Description: detour源码，hook使用，部分程序hook了，但是其他程序没有用(Detour source code, hook use, part of the program hook, but other programs do not use) Platform: |
Size: 843776 |
Author:中国袋鼠 |
Hits:
Search - detours api hook