我在使方法 Hook 正常工作时遇到了一些问题。如果“我”调用被 Hook 的方法，我就可以让 Hook 工作。但是当它在进程运行期间自然发生时，它不会被钩住。我的问题可能源于这样一个事实，即我实际上是在我自己生成的线程中设置这些 Hook 。显然 LhSetInclusiveACL() 方法需要知道您要 Hook 的线程。好吧，这是我的问题...

我真的不在乎哪些线程应用了钩子(Hook)，我希望它们都被钩住。例如，假设我希望“gdi32.dll”库中的 CreateICW() 方法与整个进程“iexplorer.exe” Hook 。不仅仅是来自线程 ID 号 48291 或其他。了解哪些线程将调用您感兴趣的 Hook 例程需要深入了解您正在 Hook 的进程的内部工作原理。我推测这通常是不可行的，对我来说当然也不可行。因此，我不可能先验地知道哪些线程 ID 需要被 Hook 。

以下代码取自“UnmanageHook”示例:

extern "C" int main(int argc, wchar_t* argv[])
{
    //...
    //...
    //...

    /*
        The following shows how to install and remove local hooks...
    */
    FORCE(LhInstallHook(
            GetProcAddress(hUser32, "MessageBeep"),
            MessageBeepHook,
            (PVOID)0x12345678,
            hHook));

    // won't invoke the hook handler because hooks are inactive after installation
    MessageBeep(123);

    // activate the hook for the current thread
    // This is where I believe my problem is.  ACLEntries is 
    // supposed to have a list of thread IDs that should pay
    // attention to the MessageBeep() hook.  Entries that are
    // "0" get translated to be the "current" threadID.  I want
    // ALL threads and I don't want to have to try to figure out
    // which threads will be spawned in the future for the given
    // process.  The second parameter is InThreadCount. I'm
    // kind of shocked that you can't just pass in 0 or -1 or
    // something for this parameter and just have it hook all
    // threads in that given process.
    FORCE(LhSetInclusiveACL(ACLEntries, 1, hHook));

    // will be redirected into the handler...
    MessageBeep(123);


    //...
    //...
    //...
}

我已经在 LhSetInclusiveACL() 方法调用中添加了一些注释来解释这种情况。 LhSetExclusiveACL() 和这些方法的“全局”版本似乎也无济于事。

此处供引用的是 LhSetExclusiveACL 的文档:

/***********************************************************************
Sets an exclusive hook local ACL based on the given thread ID list.
Global and local ACLs are always intersected. For example if the 
global ACL allows a set “G” of threads to be intercepted, and the 
local ACL allows a set “L” of threads to be intercepted, then the 
set “G  L” will be intercepted. The “exclusive” and “inclusive” 
ACL types don’t have any impact on the computation of the final 
set. Those are just helpers for you to construct a set of threads.

EASYHOOK_NT_EXPORT LhSetExclusiveACL(
   ULONG* InThreadIdList,
   ULONG InThreadCount,
   TRACED_HOOK_HANDLE InHandle);

Parameters:

   InThreadIdList
      An array of thread IDs. If you specific zero for an 
      entry in this array, it will be automatically replaced
      with the calling thread ID.

   InThreadCount
      The count of entries listed in the thread ID list. This
      value must not exceed MAX_ACE_COUNT!

   InHandle
      The hook handle whose local ACL is going to be set. 

Return values:

   STATUS_INVALID_PARAMETER_2
       The limit of MAX_ACE_COUNT ACL is violated by the given buffer.
***********************************************************************/

我是不是用错了？我想这就是大多数实现使用此库的方式，那么为什么这对我不起作用？

最佳答案

您想改用 LhSetExclusiveACL。这意味着跨任何线程的任何调用都会被 Hook ，除了您在 ACL 中指定的调用。

关于c++ - 如何使用非托管 EasyHook 从进程中的任何线程 Hook 方法？，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/10821312/