逆核系列No.6--Windows Hook

本节内容

Windows消息钩取并利用小实例进行理解该过程

源码分析

关键下钩子的API的原型

HHOOK SetWindowsHookExW(
  [in] int       idHook,
  [in] HOOKPROC  lpfn,
  [in] HINSTANCE hmod,
  [in] DWORD     dwThreadId		//该参数值为0时则该钩子为全局钩子会对所有实例以及后续新生实例产生作用
);

示例程序源码

//HookMain.exe源码

#include "stdio.h"
#include "conio.h"
#include "windows.h"

#define	DEF_DLL_NAME		"KeyHook.dll"
#define	DEF_HOOKSTART		"HookStart"
#define	DEF_HOOKSTOP		"HookStop"

typedef void (*PFN_HOOKSTART)();
typedef void (*PFN_HOOKSTOP)();

void main()
{
	HMODULE			hDll = NULL;
	PFN_HOOKSTART	HookStart = NULL;
	PFN_HOOKSTOP	HookStop = NULL;
	char			ch = 0;

    // KeyHook.dll载入
	hDll = LoadLibraryA(DEF_DLL_NAME);
    if( hDll == NULL )
    {
        printf("LoadLibrary(%s) failed!!! [%d]", DEF_DLL_NAME, GetLastError());
        return;
    }

    // export函数导入
	HookStart = (PFN_HOOKSTART)GetProcAddress(hDll, DEF_HOOKSTART);
	HookStop = (PFN_HOOKSTOP)GetProcAddress(hDll, DEF_HOOKSTOP);

    // 启用Hook
	HookStart();

    // 直至接收到'q'否则不停止钩取
	printf("press 'q' to quit!\n");
	while( _getch() != 'q' )	;

    // 钩子断钩
	HookStop();
	
    // KeyHook.dll 卸载
	FreeLibrary(hDll);
}

HookMain的源码比较简单，就是载入KeyHook.dll并且导入HookStart和HookStop用于控制钩子。

//KeyHook.dll源码

#include "stdio.h"
#include "windows.h"

#define DEF_PROCESS_NAME		"notepad.exe"

HINSTANCE g_hInstance = NULL;
HHOOK g_hHook = NULL;
HWND g_hWnd = NULL;

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpvReserved)
{
	switch( dwReason )
	{
        case DLL_PROCESS_ATTACH:
			g_hInstance = hinstDLL;
			break;

        case DLL_PROCESS_DETACH:
			break;	
	}

	return TRUE;
}

LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam)
{
	char szPath[MAX_PATH] = {0,};
	char *p = NULL;

	if( nCode >= 0 )
	{
		// bit 31 : 0 => press, 1 => release
		if( !(lParam & 0x80000000) )	//释放键盘
		{
			GetModuleFileNameA(NULL, szPath, MAX_PATH);		//获取模块的绝对路径，为null则获取正在执行的程序路径
			p = strrchr(szPath, '\\');

            //比对当前进程的名称，若为notepad.exe则消息不回传递给应用程序或下一个钩子
			if( !_stricmp(p + 1, DEF_PROCESS_NAME) )
				return 1;
		}
	}

    // 若非notepad.exe则调用CallNextHookEx将消息传递给应用程序或下一个钩子
	return CallNextHookEx(g_hHook, nCode, wParam, lParam);
}

#ifdef __cplusplus
extern "C" {
#endif
	__declspec(dllexport) void HookStart()
	{
		g_hHook = SetWindowsHookEx(WH_KEYBOARD, KeyboardProc, g_hInstance, 0);
	}

	__declspec(dllexport) void HookStop()
	{
		if( g_hHook )
		{
			UnhookWindowsHookEx(g_hHook);
			g_hHook = NULL;
		}
	}
#ifdef __cplusplus
}
#endif

KeyHook.dll则是控制钩子和钩子的内部逻辑，回调函数KeyboardProc是自写的逻辑完成的功能是在接受全局钩子钩取到的消息时判断该消息所对应的应用程序是否是notepad.exe，若为notepad.exe则return 1 否则CallNextHookEx。下钩HookStart 断钩HookStop。

梳理一下过程：

Hookmain.exe调用LoadLibrary尝试载入KeyHook.dll文件，成功则LoadLibrary返回KeyHook.dll的对应句柄
成功载入KeyHook.dll由于Windows载入DLL的机制会使得KeyHook.DllMain因为dwReason = DLL_PROCESS_ATTACH触发，执行相应的行为（g_hInstance = hinstDLL：实际上hinstDLL是指向KeyHook.dll自身的实例句柄）
HookMain.exe接着获取了KeyHook.dll下的两个API ：HookStart & HookStop，并启动了HookStart
程序回到KeyHook.dll内部，执行SetWindowsHookEx(WH_KEYBOARD, KeyboardProc, g_hInstance, 0); 含义是：钩子处理的消息类型是WH_KEYBOARD，一下是SetWindowsHookEx.idHook的可取值int类型（代号标识），比较多这里只列出源码中的WH_KEYBOARD，更多信息请自行查阅文档

Value Meanning

WH_KEYBOARD2 Installs a hook procedure that monitors keystroke messages. For more information, see the KeyboardProc hook procedure.

表明钩子SetWindowsHookEx处理的是键盘事件，回调函数是KeyHook.KeyboardProc这是由于（g_hInstance指向KeyHook.dll的实例句柄），最后一个参数0表明钩子是个全局钩子。

Value	Meanning
WH_KEYBOARD2	Installs a hook procedure that monitors keystroke messages. For more information, see the KeyboardProc hook procedure.

当钩子的触发事件（键盘事件）发生，会调用KeyHook.KeyboardProc，该函数的原型：

LRESULT CALLBACK KeyboardProc(
  _In_ int    code,		//how to process the message
  _In_ WPARAM wParam,	//contain information about a keystroke message
  _In_ LPARAM lParam	//contain information about a keystroke message
);

第一个参数code：

A code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

表明钩子相应处理过程如何处理钩取到的消息，当该值小于0，则不对钩取到的内容做更多处理，必须让KeyboardProc()函数返回CallNextHookEx()

Value	Meaning
HC_ACTION 0	The wParam and lParam parameters contain information about a keystroke message.
HC_NOREMOVE 3	The wParam and lParam parameters contain information about a keystroke message, and the keystroke message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)