Windows API hooking.简单的C++例子

什么是API hook?

API hook是一种技术，通过它我们可以测量和修改API调用的行为和流。许多反病毒解决方案也使用这种技术来检测代码是否为恶意代码。
示例1
在挂接windows API函数之前，我将考虑如何从DLL中导出函数。
例如，我们有DLL的这个逻辑(pet.cpp):

/*
pet.dll - DLL example for basic hooking
*/
 
#include 
#pragma comment (lib, "user32.lib")
 
BOOL APIENTRY DllMain(HMODULE hModule,  DWORD  ul_reason_for_call, LPVOID lpReserved) {
  switch (ul_reason_for_call) {
    case DLL_PROCESS_ATTACH:
      break;
    case DLL_PROCESS_DETACH:
      break;
    case DLL_THREAD_ATTACH:
      break;
    case DLL_THREAD_DETACH:
      break;
  }
  return TRUE;
}
 
extern "C" {
  __declspec(dllexport) int _cdecl Cat(LPCTSTR say) {
    MessageBox(NULL, say, "=^..^=", MB_OK);
	  return 1;
	}
}
 
extern "C" {
  __declspec(dllexport) int _cdecl Mouse(LPCTSTR say) {
    MessageBox(NULL, say, "<:3()~~", MB_OK);
	  return 1;
	}
}
 
extern "C" {
  _