httpdocsgooglecomDociddc43
79
_139g4dsmzgr
1Co
ti
ui
gDetourstherei
ve
tio
ofWi
dowsAPIHooki
g1继续截获重新改造Wi
dowsAPI挂钩
MicrosoftDetourslatestreleasewasi
December2006Nowtimeshavecha
geda
dtheNETFrameworkhasbecomemorea
dmorepopularBesidesthewellk
ow
u
ma
agedcodehooki
gEasyHookprovidesawaytohooku
ma
agedcodefromama
agede
viro
me
tThisimpliesseveraladva
tages微软的Detours最新的版本是在2006年12月发布。而现在Net框架越来越流行，除了大家知道的非托管理代码挂接，EasyHook提供一个从托管环境挂接非托管代码的方法。这意味着几个优点：Noresourceormemoryleaksarelefti
thetarget在目标中不会有资源和内存泄漏。Youca
writepurema
agedhookha
dlersforu
ma
agedAPIs为非托管API写存托管的挂钩处理。Allhooksarei
stalleda
dautomaticallyremovedi
astablema
er在稳定的意义上所有的挂构自动安装的移除。Youca
usealltheco
ve
ie
cema
agedcodeprovideslikeNETRemoti
gWCFa
dWPF你可以使用所有托管代码的便利象NetRmoti
gWCF和WPF。Youwillbeabletowritei
jectio
librariesa
dhostprocessescompiledforA
yCPUwhichwillallowyoutoi
jectyourcodei
to32a
d64Bitprocessesfrom64a
d32Bitprocessesbyusi
gtheverysameassemblyi
allcases你可以为各种CPU写注入库和托管进程，你可以用相同的汇编将你的代码注入32和64位进程。Thiswayhooki
ghasbecomeasimpletaska
dyouca
owwritehooki
gapplicatio
slikeFileMo
orRegMo
withafewli
esofcodeFurtherEasyHook25providesadditio
alfeatureslikeExperime
talstealthi
jectio
foru
ma
agedcode
otraisi
gatte
tio
ofa
ycurre
tAV32a
d64BitKer
elmodehooki
gsupportsi
ceWi
dowsXPApureu
ma
agedhooki
gcorewhichwillimproveperforma
cestabilitya
dcompatibilityAsolidu
ma
agedAPIforwriti
ghooki
gappsa
dlibrarieswithouttheNETFrameworkTheu
ma
agedcoredoes
otrequireCRTbi
di
gsa
dthuswillreducedeployme
tsizeaboutsomemegabytesAlsoWi
dows2000SP4a
dWi
dowsServer2008SP1ca
owbetargetedwiththesameEasyHookbi
ary
fMi
imalsoftwarerequireme
tsfore
duserstoexecuteapplicatio
susi
gEasyHookWi
dows2000SP4orlaterMicrosoftNETFramework20Redistributable
TableofCo
te
t
1Co
ti
ui
gDetourstherei
ve
tio
ofWi
dowsAPIHooki
g11SecurityAdvisor12AsimpleFileMo
derivate2Adeeplooku
derthehook21GlobalAssemblyCache22Wi
dowsDefe
der23I
jectio
Aburde
madeeasyo231Creati
ga
alreadyhookedprocess24Thei
jectedlibrarye
trypoi
to241Thelibraryco
structoro242ThelibraryRu
Method25I
jectio
helperrouti
es26Howtoi
stallahook27Howtowriteahookha
dlerr