如何注入 DLL 制作启用 Detours 的钩子？

Question

我需要任何建议在获取代码后如何继续 CreateFile() 挂钩：

#include<windows.h>
#include "C:\Detours\Detours-4.0.1\include\detours.h"

static HANDLE(WINAPI* TrueCreateFileW)(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile) = CreateFileW;

__declspec(dllexport) HANDLE WINAPI MyCreateFileW(LPCTSTR lpFileName, DWORD dwDesiredAccess, DWORD 
dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile)
{
if ((LPCTSTR)lpFileName == (LPCTSTR)L"C:\TestHook\file.txt")
{
    return TrueCreateFileW((LPCTSTR)L"C:\TestHook\file.txt", dwDesiredAccess, dwShareMode, lpSecurityAttributes,
        dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
}
return TrueCreateFileW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes,
    dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
}


BOOL APIENTRY DLLMain(HMODULE hModule, DWORD reason_for_call, LPVOID lpReserved)
{

LONG error;
switch (reason_for_call)
{
case DLL_PROCESS_ATTACH:
    OutputDebugString(L"Attaching HookingDLL.dll");
    //OutputDebugString(strInfo);
    DetourRestoreAfterWith();
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)TrueCreateFileW, MyCreateFileW);
    error = DetourTransactionCommit();

    if (error == NO_ERROR)
    {
        OutputDebugString(L"Hooking attempt succeeded");
    }
    else
    {
        OutputDebugString(L"Hooking attempt failed");
    }
    break;
case DLL_THREAD_ATTACH:
    break;
case DLL_THREAD_DETACH:
    break;
case DLL_PROCESS_DETACH:
    OutputDebugString(L"Detaching HookingDLL.dll");
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)TrueCreateFileW, MyCreateFileW);
    error = DetourTransactionCommit();

    if (error == NO_ERROR)
    {
        OutputDebugString(L"Successfully detached hook");
    }
    else
    {
        OutputDebugString(L"Hook removal has failed");
    }
    break;
}
return TRUE;
}

我需要的是在 Notepad++ 中创建新的 .txt 文件时调用 MyCreateFileW 挂钩。最有可能的是，我必须添加一个 DLL 注入器来应用该钩子，但在 Internet 上，我没有为初学者找到任何易于理解的分步指南（值得一提的是，我是一名学生）。您能否建议在我的情况下如何继续使用 DLL 注入器？让我注意到我正在使用 Microsoft Detours 来更顺畅、更一致地学习 API 挂钩。

Answer 1

你已经准备好了detour DLL。您需要做的是创建一个新进程并使用DetourCreateProcessWithDlls 将DLL 加载到其中。像这样的：

DetourCreateProcessWithDll(NULL, "C:\\windows\\notepad.exe", NULL,
        NULL, FALSE, CREATE_DEFAULT_ERROR_MODE, NULL, NULL,
        &si, &pi, DetourPath, DLLPath, NULL);

您可以参考本教程“API Hooking with MS Detours”了解更多详细信息。