检测API函数的InlineHook

小程序：扫一扫查出行
【扫一扫了解最新限行尾号】
复制小程序

 BOOL GetProcHookStatus(LPCSTR lpModuleName, LPCSTR lpProcName)

 {

     HMODULE hModule = GetModuleHandleA(lpModuleName);

     if (NULL == hModule)

     {

         hModule = LoadLibraryA(lpModuleName);

         if (NULL == hModule)

             return -;

     }

     FARPROC farProc = GetProcAddress(hModule, lpProcName);

     if (NULL == farProc)

         return -;

     BYTE buffer[] = {};

     if (!ReadProcessMemory(GetCurrentProcess(), farProc, &buffer, , NULL))

         return -;

     if (buffer[] == 0x8B && buffer[] == 0xFF && buffer[] == 0x55 && buffer[] == 0x8B && buffer[] == 0xEC)

         return FALSE;

     if (buffer[] == 0xEB || buffer[] == 0xE9 || buffer[] == 0xEA)

         return TRUE;

     return -;

 }