钩子与API截获

开发平台：

Visual C++

GetWindowTextRemote.c：源码内容

							#include <windows.h>
//-------------------------------------------------------
// 共享数据区
// 共享数据区中的数据在DLL被映射的进程中都是共享的
//-------------------------------------------------------
#pragma data_seg (".shared")
HWND	g_hWnd	= 0;                        //要读取的编辑框控件句柄
HHOOK	g_hHook = 0;                        //HOOK句柄
UINT	WM_HOOKSPY = 0;                     //自定义消息，通知远程进程读取编辑框控件的内容
char	g_szPassword [256] = { '' };      //保存编辑框控件的缓存区
#pragma data_seg ()
#pragma comment(linker,"/SECTION:.shared,RWS") 
HINSTANCE hDll;
BOOL WINAPI APIENTRY DllMain(HINSTANCE	hinstDll, 
                       DWORD  reason_for_call, 
                       LPVOID lpReserved
					 )
{
	hDll = hinstDll;
    return TRUE;
}
//-------------------------------------------------------
// HookProc
// 由远程进程执行
//
#define pCW ((CWPSTRUCT*)lParam)
LRESULT HookProc (
  int code,       // hook code
  WPARAM wParam,  // virtual-key code
  LPARAM lParam   // keystroke-message information
)
{	
	if( pCW->message == WM_HOOKSPY ) {
		MessageBeep(MB_OK);
		SendMessage( g_hWnd,WM_GETTEXT,128,(LPARAM)g_szPassword );
		UnhookWindowsHookEx(g_hHook );
	}
	return CallNextHookEx(g_hHook, code, wParam, lParam);
}
//-------------------------------------------------------
// GetWindowTextRemote
// 插入本DLL到远程进程
// 从远程编辑框控件中获取密码
//
// 返回值：读取到的密码字符数
//
__declspec(dllexport) int GetWindowTextRemote(HWND hWnd, LPSTR lpString)
{	
	g_hWnd = hWnd;
	g_hHook = SetWindowsHookEx(WH_CALLWNDPROC,(HOOKPROC)HookProc,
								hDll, GetWindowThreadProcessId(hWnd,NULL) );
	if( g_hHook==NULL ) {
		lpString[0] = '';
		return 0;
	}
	
	if (WM_HOOKSPY == 0)
		WM_HOOKSPY = RegisterWindowMessage( "WM_HOOKSPY_RK" );
	// 向远程进程发送读取消息，触发其读取密码
	SendMessage( hWnd,WM_HOOKSPY,0,0 );
	strcpy( lpString,g_szPassword );
	return strlen(lpString);
}

						