IAT/EAT 挂钩“gethostbyname”
我编写了这段代码，通过更改 IAT 和 EAT 中的地址来挂钩 API 函数： http://pastebin.com/7d9N1J2c
当我想挂接“recv”或“connect”时，这工作得很好。然而，由于某种未知的原因，当尝试挂钩“gethostbyname”时，我的挂钩函数从未被调用。
我试图通过获取 wsock32.dll 模块的基址 + 0x375e 在调试器中找到“gethostbyname”，这就是我的 wsock32.dll 的序数 52 显示为偏移量的内容。但这只会让我最终陷入一些随机的 asm 代码，而不是函数的开头。 然而，相同的方法对于尝试找到“recv”入口点来说效果很好。
有人看到我可能做错了什么吗？
I wrote this code to hook API functions by changing the address in the IAT and EAT: http://pastebin.com/7d9N1J2c
This works just fine when I want to hook "recv" or "connect". However for some unknown reason when trying to hook "gethostbyname", my hook function is never called.
I tried to find "gethostbyname" in a debugger by taking the base address of the wsock32.dll module + 0x375e, which is what the ordinal 52 of my wsock32.dll is showing as offset. But that just makes me end up in some random asm code, not at the beginning of a function.
The same method however works fine for trying to find the "recv" entry point.
Does anyone see what I might be doing wrong?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我推荐这个工具：
http://www.moduleanalyzer.com/
它们的作用完全相同，并显示与之连接的 url API。
问题是有多个 API 可以将 url 转换为地址。您正在挂钩的应用程序可能正在使用您未拦截的另一个版本的 API。
I recommend this tool:
http://www.moduleanalyzer.com/
They do exactly the same and show the url that was connected with that API.
The problem is that there are more than one API to translate an url to an address. The application you are hooking may be using another version of the API that you're not intercepting.
运行一些像 IDA 这样的反汇编程序，并在挂接此函数后附加到您的进程，ida 在附加和播放进程上应用更改并检查有什么问题。
换句话说，您有许多库可以与蹦床挂钩，例如 Microsoft Detours、NCodeHook 等。
Run some disassembler like IDA and attach to your process after you hook this functions, ida get apply changes on attaching and play process and check what is wrong.
In other way you have many libraries to do hooks with trampolines like Microsoft Detours, NCodeHook etc.