在之前的日志中，我提到过，我发现每个API的代码之间，都有5个字接的空白。所以，我忽然想到，我可以利用这5个字节进行新的API Hook，进而实现API被Hook以后还能执行原来的指令。

　　其实，我觉得很多时候Hook一个API后，我们就没有必要去执行原来的代码了，因为我们要用新的过程来取代原来的API。可是，有的时候我们需要的仅仅是监视一下这个API的执行，或者只修改一下它的返回值而已，不希望它的过程被覆盖掉。这样，就产生了我这样的一个想法。

　　这个方法，原理就是在API过程的最后，函数返回之前，跳转到我构造的指令中。在我的指令里，先保存了一下API的返回值，以便我们可以自己选择返回API原来的值或者自己定制的值。然后把传递进来的参数重新压栈，接着再用call指令调用我们自己的过程，然后返回。

　　只是这个方法，有一个缺点，就是每个API的后面必须要有5字节的空白和只有一处返回指令。

　　其实并不需要5个字节的空白。因为返回指令一般都是1字节或3字节的，而跳转指令都是5字接的。所以，只要有4字节或2字接的空白就足够了，具体要看API的返回指令而定了。

　　值得欣慰的是，大部分的API都满足这条件。自己写的DLL暂时不支持此法的Hook，以后再研究一下还有没其他方法。

　　思路其实都很清晰的，过程我也写得很简单。稍微会点ASM和VB的人估计看我这代码都没困难的吧。

　　废话不说了，现在就放上代码吧。

frmMain.frm

VERSION 5.00 Begin VB.Form frmMain    Caption         =   "Form1"    ClientHeight    =   3090    ClientLeft      =   60    ClientTop       =   450    ClientWidth     =   4680    LinkTopic       =   "Form1"    ScaleHeight     =   3090    ScaleWidth      =   4680    StartUpPosition =   3  '窗口缺省    Begin VB.CommandButton cmdUnhook       Caption         =   "UnHook API"       Height          =   495       Left            =   240       TabIndex        =   2       Top             =   1680       Width           =   1095    End    Begin VB.CommandButton cmdMessage       Caption         =   "MessageBox"       Height          =   495       Left            =   240       TabIndex        =   1       Top             =   960       Width           =   1095    End    Begin VB.CommandButton cmdHook       Caption         =   "Hook API"       Height          =   495       Left            =   240       TabIndex        =   0       Top             =   240       Width           =   1095    End End Attribute VB_Name = "frmMain" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Dim bInitial As Boolean Dim bHook As Boolean Dim lngFuncAddr As Long Dim lngCodesAddr As Long Dim byteOldCodes(4) As Byte Dim byteNewCodes(4) As Byte Dim byteCodes(35) As Byte Dim RETAddr As Long Private Sub cmdHook_Click()     If bHook Then         Debug.Print "已安装 Hook！"     Else         Debug.Print         Debug.Print "=========================Hook 开始========================="         If Not bInitial Then             GoTo Err         Else             If WriteProcessMemory(GetCurrentProcess, ByVal RETAddr, byteNewCodes(0), 5, ByVal 0) = 0 Then                 GoTo Err             End If             bHook = True         End If     End If     Exit Sub Err: Debug.Print "发生错误！" Debug.Print "=========================Hook 结束=========================" End Sub Private Sub cmdMessage_Click()     Debug.Print "对话框结果：" & MessageBox(Me.hwnd, "API Hook 测试！", "API Hook", vbOKOnly Or vbInformation) End Sub Private Sub cmdUnhook_Click()     If Not bHook Then         Debug.Print "未安装 Hook！"     Else         If WriteProcessMemory(GetCurrentProcess, ByVal RETAddr, byteOldCodes(0), 5, ByVal 0) = 0 Then             GoTo Err         End If         bHook = False         Debug.Print "=========================Hook 结束========================="     End If     Exit Sub Err: Debug.Print "发生错误！" End Sub Private Sub Form_Load()     Dim lngNewFuncAddr As Long     Dim hModule As Long     Dim hProcess As Long     Dim i As Integer, j As Integer, n As Long     Dim codes() As Byte     Dim code As Variant     Dim bytecode(3) As Byte     Dim nParamCount As Long     Dim tmpAddr As Long     Dim retu As Long     CopyMemory lngNewFuncAddr, AddressOf MessageBoxProc, 4     '获取模块句柄     hModule = GetModuleHandle("user32.dll")     If hModule <= 0 Then         GoTo Err     Else         '获取API地址         lngFuncAddr = GetProcAddress(hModule, "MessageBoxA")         If lngFuncAddr <= 0 Then             GoTo Err         Else             '分配指令内存             lngCodesAddr = GlobalAlloc(GPTR, UBound(byteCodes) + 1)             If lngCodesAddr <= 0 Then                 GoTo Err             Else                 '获取当前进程句柄                 hProcess = GetCurrentProcess                 '计算空指令地址                 n = 8                 RETAddr = lngFuncAddr                 Do While True                     ReDim codes(n)                     retu = ReadProcessMemory(hProcess, ByVal RETAddr, codes(0), n, ByVal 0)                     If retu = 0 Then GoTo Err                     For i = 0 To n - 1                         If codes(i) = &H90 Then                             retu = ReadProcessMemory(hProcess, ByVal RETAddr + 1, bytecode(0), 4, ByVal 0)                             If retu = 0 Then GoTo Err                             For j = 0 To 3                                 If bytecode(j) <> &H90 Then                                     Exit For                                 End If                                 If j = 3 Then                                     GoTo F1                                 End If                             Next                         End If                         RETAddr = RETAddr + 1                     Next                     n = n * 2                 Loop F1:                 '计算返回指令地址                 ReDim codes(2)                 retu = ReadProcessMemory(hProcess, ByVal RETAddr - 3, codes(0), 3, ByVal 0)                 If retu = 0 Then GoTo Err                 If codes(0) = &HC2 Then                     RETAddr = RETAddr - 3                 ElseIf codes(2) = &HC3 Then                     RETAddr = RETAddr - 1                 Else                     GoTo Err                 End If                 retu = ReadProcessMemory(hProcess, ByVal RETAddr, byteOldCodes(0), UBound(byteOldCodes) + 1, ByVal 0)                 If retu = 0 Then GoTo Err                 '生成指令                 nParamCount = 4     'API参数个数                 byteCodes(0) = &HA3                 CopyMemory byteCodes(1), VarPtr(dwReturn(0)), 4                 byteCodes(5) = &HB8                 CopyMemory byteCodes(6), VarPtr(dwReturn(UBound(dwReturn))), 4                 byteCodes(10) = &HB9                 CopyMemory byteCodes(11), nParamCount, 4                 byteCodes(15) = &HFF                 byteCodes(16) = &H74                 byteCodes(17) = &H24                 CopyMemory byteCodes(18), nParamCount * 4, 1                 byteCodes(19) = &H8F                 byteCodes(20) = &H0                 byteCodes(21) = &HFF                 byteCodes(22) = &H30                 byteCodes(23) = &H83                 byteCodes(24) = &HE8                 byteCodes(25) = &H4                 byteCodes(26) = &HE2                 byteCodes(27) = &HF3                 byteCodes(28) = &HE8                 tmpAddr = lngCodesAddr + 30                 CopyMemory byteCodes(29), lngNewFuncAddr - tmpAddr - 5, 4                 CopyMemory byteCodes(33), byteOldCodes(0), 3                 CopyMemory ByVal lngCodesAddr, byteCodes(0), UBound(byteCodes) + 1                 '生成跳转指令                 byteNewCodes(0) = &HE9                 CopyMemory byteNewCodes(1), lngCodesAddr - RETAddr - 5, 4                 bInitial = True             End If         End If     End If     Exit Sub Err: CloseHandle hModule Debug.Print "发生错误！" End Sub Private Sub Form_Unload(Cancel As Integer)     '这里还原一下API，避免在调试模式下产生错误     If bHook Then         WriteProcessMemory GetCurrentProcess, ByVal RETAddr, byteOldCodes(0), 5, ByVal 0     End If     If bInitial Then         GlobalFree lngCodesAddr     End If End Sub

modMain.bas

Attribute VB_Name = "modMain" Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long) Public Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long Public Declare Function GetCurrentProcess Lib "kernel32" () As Long Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Public Declare Function GlobalAlloc Lib "kernel32" (ByVal wFlags As Long, ByVal dwBytes As Long) As Long Public Declare Function GlobalFree Lib "kernel32" (ByVal hMem As Long) As Long Public Declare Function MessageBox Lib "user32" Alias "MessageBoxA" (ByVal hwnd As Long, ByVal lpText As String, ByVal lpCaption As String, ByVal wType As Long) As Long Public Declare Function lstrcpy Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long Public Const GMEM_FIXED = &H0 Public Const GMEM_ZEROINIT = &H40 Public Const GPTR = (GMEM_FIXED Or GMEM_ZEROINIT) Public Const MAX_PATH = 260 'dwReturn(0)是原来API的返回值 '从dwReturn(1)开始是传递进来的参数，顺序与参数声明的顺序一致 '声明的时候直接把上限声明为与参数个数一样即可 Public dwReturn(4) As Long Public Function MessageBoxProc(hwnd As Long, lpText As String, lpCaption As String, wType As Long) As Long     '不知道为什么，重新压栈的参数执行到我们的过程体时，参数都不正确了，所以这里手动修正一下     Dim t_hwnd As Long, t_lpText As String, t_lpCaption As String, t_wType As Long     t_hwnd = dwReturn(1)     t_lpText = String(MAX_PATH, 0)     lstrcpy t_lpText, dwReturn(2)     t_lpCaption = String(MAX_PATH, 0)     lstrcpy t_lpCaption, dwReturn(3)     t_wType = dwReturn(4)          Debug.Print "MessageBox 已被截拦！并且源过程也已正常执行！"     Debug.Print "hwnd：" & t_hwnd     Debug.Print "lpText：" & t_lpText     Debug.Print "lpCaption：" & t_lpCaption     Debug.Print "wType：" & t_wType     MessageBoxProc = dwReturn(0) End Function

完整工程下载：