API HOOK 实战解决War FTP无法重命名覆盖已经存在文件的有关问题之VB&Deviare篇

API HOOK 实战解决War FTP无法重命名覆盖已经存在文件的问题之VB&Deviare篇

如果看过我之前写的API HOOK 实战解决War FTP无法重命名覆盖已经存在文件的问题之AutoIt3篇，就会发现其中有一个问题。因为war-ftp默认是以系统服务的方式运行的，但用我之前写的程序是否无法成功Hook到API调用信息的。曾经就此问题请教过AutoIt中文论坛的版主，得到的答复是当初写API Hook库时没有考虑到这种情况，如果要实现这个功能，要重写整个库！

怎么办呢？等版主重写？那不知道何年何月了，或许永无此日都有可能。不能就此放弃，继续努力查询资料。于是在网上又开始搜索起来，还真被我发现了一些“蛛丝马迹”。其中用Detour、Deviare和Easyhook几个库被提到过。Detour是微软的东东，但没有正规支持，网上的资料是最多的，可惜几乎都是c++代码。Easyhook只支持C#，无奈我这种死守VB的人不会用啊！最终还是选择了Deviare（http://www.nektra.com/products/deviare-api-hook-windows/），因为它支持COM调用！

当然这个库的例子和说明更是少的可怜。官网只有一个c#的例子，论坛有一个vbscript的例子，结合这两个例子，我总算摸索出如何Hook掉API的传入参数。下面是例子：

Option ExplicitDim objSP As NktSpyMgrDim objProcess As NktProcessDim WithEvents objHook As NktHookSub objHook_OnFunctionCalled(ByVal Hook As Deviare2.NktHook, ByVal proc As Deviare2.NktProcess, ByVal callInfo As Deviare2.NktHookCallInfo) Dim i As Integer 'Debug.Print "Function called: " & Hook.FunctionName & " within process " & proc.Path '函数调用前修改参数 If callInfo.IsPreCall Then '如果 dwCreationDisposition 为CREATE_NEW（1）则改为CREATE_ALWAYS（2） If callInfo.Params.GetAt(4).LongVal = 1 Then Debug.Print "文件名：" & callInfo.Params.GetAt(0).Value callInfo.Params.GetAt(4).LongVal = 2 End If End IfEnd Sub'The main function to iterate/find a process objectPublic Function GetProcess(strProcess As String) As NktProcess Dim process As NktProcess Dim enumprocess As NktProcessesEnum Set enumprocess = objSP.Processes Set process = enumprocess.First While Not process Is Nothing If process.Name = strProcess Then Set GetProcess = process End If Set process = enumprocess.Next WendEnd FunctionPrivate Sub Command1_Click() 'Set objProcess = GetProcess("notepad.exe") Set objProcess = GetProcess("war-ftpd.exe") Debug.Print objProcess.Path 'Set objHook = objSP.CreateHook("user32.dll!MessageBoxW", eNktHookFlags.flgRestrictAutoHookToSameExecutable And eNktHookFlags.flgOnlyPreCall) Set objHook = objSP.CreateHook("Kernel32.dll!CreateFileW", eNktHookFlags.flgRestrictAutoHookToSameExecutable And eNktHookFlags.flgOnlyPreCall) objHook.Hook True Call objHook.Attach(objProcess, True) End SubPrivate Sub Form_Load() Set objSP = New NktSpyMgr objSP.InitializeEnd SubPrivate Sub Form_Unload(Cancel As Integer) If Not objHook Is Nothing Then objHook.Unhook Set objSP = NothingEnd Sub
需要在工程的引用中增加DeviareCOM 2.0，如果找不到就要先注册DeviareCOM.dll.