Location:
Search - hook process
Search list
Description: 文件监测钩子
注入DLL使用的是 CreateRemoteThread 跨进程建立对DLL 的加载-document monitoring hook into DLL using the inter-process CreateRemoteThread establish the right DLL loading
Platform: |
Size: 31586 |
Author: zhouyan |
Hits:
Description: 如何安装钩子过程，如何编写全局钩子，动态连接库里的全局变量数据共享问题分析。ADO数据库编程。在VB中利用ADO控件和ADO对象访问数据库，在VC中利用ADO技术访问数据库。-process of how to install the hook, how to compile the overall hook. Dynamic Link 13-17 global variable data sharing analysis. ADO database programming. In VB using ADO and ADO Object Access database, the use of the VC ADO access to the database.
Platform: |
Size: 160125 |
Author: zhou |
Hits:
Description: \"process wide\":
some demos about hooking APIs/code in your own process
OS independent
\"system wide\":
several demos about system wide API hooking (using hook dlls)
OS independent
\"system wide - win9x only\":
one demo which shows a special system wide hooking method
win9x only
-"wide process" : some demos about hooking APIs / code in your own p rocess OS independent "system wide" : several demos about system wide API hooking (us ing hook dlls) OS independent "system wide-win 9x only ": one demo which shows a special system wide hooki Vi only method win9x
Platform: |
Size: 1070498 |
Author: 万俟雅言 |
Hits:
Description: 自己写的API－Hook。hook的函数是CreateProcessA和CreateProcessW。就是说可以检测进程创建。还有2处不完善。一个是创建程序的路径没能很好的显示。另一个退出时有点系统异常。-himself wrote the API - Hook. The hook function is CreateProcessA and CreateProcessW. Say can detect the creation process. There are two imperfect. One is to establish procedures for the path failed to show good. Another system to pull out a bit unusual.
Platform: |
Size: 142733 |
Author: 林风 |
Hits:
Description: QQ连连看外挂源码 20050609qq
连连看外挂简介
原理
1 截取屏幕，从而取得方块数据，然后搜索算法.
2 通过鼠标键盘钩子发送消息来消去.
3 腾讯反外挂作的很牛,连连看程序在接到鼠标点击消息的同时从驱动层判断有没有
点击消息,所以把0x00403291地址的内存锁定为0x00就可以让腾讯的凡外挂系统失效。
4 在消除过程中因为烟雾等特效的影响,中途按F9键分析结果很可能错误,谁有办法
解决这个问题一定要告诉我啊! 最好能取消动画特效,直接消去.
5 因为时间仓促,利用周末匆匆写完这个程序,所以代码极不规范,还请大家谅解.-QQ Lianliankan extrapolated source 20050609qq Lianliankan pylon on an interception principle screen, obtain data box, Then search algorithm. 2 mouse through the keyboard hook Send Message to eliminate. 3 Tencent anti - pylon for the very cattle, Lianliankan procedures for the receipt of information a mouse click at the same time from the driver layer judgment it is not news. Therefore 0 x00403291 address to the memory lock on the 0x00 allows Tencent Van extrapolated system failure. Four in the elimination process because of the smoke, and other effects, according to the F9 key halfway analysis it is very likely wrong. who has the solution to this problem must tell me ah! best to abolish the animation effects, direct elimination. 5 because of the time constraints, the use of hastily finishe
Platform: |
Size: 222180 |
Author: wancb |
Hits:
Description: 采用钩子所做的对Outlook Express增加工具按钮，OE与MS Outlook不同，不能使用插件的方法实现，本人开发的这个Hook程序是一个大系统的一部分改编的，有帮于对OE开发的朋友们。-done using the hook right Outlook Express tool to increase button OE with MS Outlook, may not be able to use the plug-in method. I Hook development of this process is a big part of the adaptation, to help in the development of OE friends.
Platform: |
Size: 99879 |
Author: 黄立波 |
Hits:
Description: 利用钩子实现菜单阴影效果
有很多人对Office XP里面的菜单的阴影效果羡慕不已,它不需要在Windows XP 中就可以在菜单后面显示阴影, 当然在Windows XP中, 已经完全支持菜单阴影了。 虽然我们不一定很有必要自己来实现这个较难实现的效果。但是正如有很多人想实现那种IE风格的菜单栏一样,尽管它们并不能为我们带来更多实用的功能, 却可以使我们的程序看起来与众不同。
-use menus hook shadow effect of a lot of people inside the Office XP menu envy of the shadow effect MU performance, it does not need Windows XP on the back of the menu showed shadow, Of course, in Windows XP, which has fully supported the shadow of the menu. Although we do not own it is necessary to achieve this difficult to achieve results. But, as many people would like to achieve the kind of IE style menu bar, Although they do not bring us a more practical function, but we can make the process appear to be different.
Platform: |
Size: 205644 |
Author: xian |
Hits:
Description: 前段时间做键盘程序找的资料，一个钩子程序，程序本身没有什么，主要是用了大量的api函数值得大家参考一下。-side of the keyboard to do procedures for the information, a hook procedures, the process itself is nothing much to it. it is mainly used a lot of api function worth examined.
Platform: |
Size: 1640 |
Author: 李伟 |
Hits:
Description: 包括：cdrom控制，cpu和mouse信息，USB编程，测试cpu速度，检测键盘按键，列出进程，鼠标钩子编程，系统信息获取，注册表编程-include : cdrom control, cpu and mouse information, USB programming, cpu speed test to detect the keyboard keys, listing process, the mouse hook programming, system information access, the registry program
Platform: |
Size: 619862 |
Author: hugh |
Hits:
Description: 远程监控木马源码, 利用钩子实现, 这是课程设计, 里面有非常详细的说明文档,对与想深入学习hook 和 进程快照还有指令分析器的人来说本作品最适合,里面的代码十分复杂,建议你们想学习的话最好详细阅读课程设计的文档,这个程序是很多老师都做不出来的! -RMON Trojan source code, using the hook realize that this is the curriculum design, with a very detailed documentation. and the right to study in depth hook and there are snapshots of the process analyzers instructions of the people who work the most suitable. inside the code is very complex and suggest that you want to learn the best detailed reading curriculum design documentation, this procedure is that many teachers can not do!
Platform: |
Size: 697197 |
Author: mo |
Hits:
Description: 魔域修改器(使用到了外挂HOOK技术)注入到游戏进程直接修改进程地址-film amended (the use of a pylon HOOK technology) into the game to direct the process of amending process addresses
Platform: |
Size: 52028 |
Author: koangel |
Hits:
Description: Visual.C++程序设计技巧与实例--配套光盘
第5章 消息映射与处理
本章共8个实例：
1. Mouse鼠标消息示例
2. KeyBoard键盘消息示例
3. Sender_Reveiver利用消息来实现内部进程通信
4. MouseHook鼠标钩子示例
5. SubClass通过子分类来重定向消息
6. SuperClass超分类示例
7. Test重载OnCmdMsg来截获和重定向消息
8. CmdFun使用命令范围来映射消息-Visual.C program design techniques and examples -- matching CD Chapter 5 news mapping and processing a total of this chapter 8 examples : 1. Mouse Mouse news two examples. Keyboard news KeyBoard three examples. Sender_Re veiver use of information to achieve internal process communication 4. MouseHook mouse hook examples 5. Su bClass adopted son classified information to redirect 6. SuperClass-seven examples of classification. Test Heavy OnCmdMsg to intercept and redirect news 8. CmdFun scope order to use mapping information
Platform: |
Size: 386422 |
Author: xixi |
Hits:
Description: 如果您对IE4.0熟悉的话，你将知道在Internet Settings高级设置中有一个选项：“在新的进程中浏览（英文：Browse in a New Process）”，如果你把它前面的对钩去掉，然后运行IE，并打开任务管理器查看所有进程，你将会发现没有新的IExplorer.exe进程出现。反之，则新的IExplorer.exe进程出现。
当我们需要许多数据在程序实例之间共享的时候，这种能使多个实例运行在同一个进程空间的程序是非常有用的。它的实现很简单，众所周知，启动任何一个应用程序有两种途径，要么通过浏览器要么通过API调用诸如CreateProcess。首先侦察特定的窗口类是否存在，如果不存在，就创建一个新的窗口类，如果存在，那么使最近创建的进程发送一个消息到已存在的窗口，并使新近运行的实例窗口处于激活状态，先前的程序实例将启动一个单独的线程。
在此示例中，作者采用了一个MFC MDI程序，即使有多个程序实例在运行，任务管理器或者进程查看器（Process Viewer）将只会显示一个进程，当如果用WINDOWS自带程序SPY++查看，您将会发现该进程拥有许多线程，并且不同的MDI窗口集合分别属于不同的线程-seemed familiar with the case, You will know that the Internet Advanced Settings, there is a choice : "In the new process here (in English : Browse in a New Process)" If you put it right in front of the hook removed, and then run IE, and open the Task Manager View all process, You will find no new IExplorer.exe process. Instead, the new IExplorer.exe process. When we needed the procedure much of the data shared between the examples, This can run multiple instances of a process in the same space procedure is very useful. It is very simple to achieve, as we all know, launching an application of any two channels either through the browser or through API calls such as CreateProcess. First reconnaissance particular window class existence, if they do not exist, create a new window type
Platform: |
Size: 47300 |
Author: 苏语 |
Hits:
Description: Start.exe 安装 Insert.dll 中的 WH_GETMESSAGE 钩子.在钩子回调函数中
判断当前进程ID是否先前 Start.exe 查找到的 Explorer进程ID, 是的话,则
再次LoadLibrary(Insert.dll),并定位到其中ThreadPro函数. 此时创建一个
新线程,线程函数就是ThreadPro,该新线程首先往Start.exe消息队列放置一个线
程退出消息 WM_QUIT,导致其消息循环结束. 此时插入线程完成..可以看到屏幕
左上角不断变化的数字..说明我们的代码正在执行.进程列表却没有Start.exe,
用进程管理观察,可发现Explorer进程,的确多了个线程,且来自Insert.dll ..
如果希望插入Explorer的线程结束,按 Alt+L 即可... :)-Start.exe Insert.dll installation of WH_GETMESSAGE hook. in the hook callback function to judge whether the current process ID prior to the search Start.exe Expl orer process ID, the answer is yes, then again LoadLibrary (Insert.dll) and the positioning of which ThreadPro function. At this time the creation of a new thread, Thread is ThreadPro function, The first new thread to Start.exe Message Queue placed a thread from the news WM_QUIT. lead to the end of the news cycle. At this point, insert threads completed .. can see the screen in the upper left corner evolving digital note .. Our code is being implemented. List of the process did not Start.exe with process management observation, Explorer process can be found, it is true, of a thread, and from Insert.dll .. If you want to insert the
Platform: |
Size: 26257 |
Author: pangguigao |
Hits:
Description: 一个木马生成器，可盗取玩家登陆的游戏帐号 密码 游戏房间URL 随身钱数。无进程 通过80端口传递信息.主要是想让朋友们一起学习键盘钩子.老鸟就别看拉-a Trojan generator, landing the player can steal a game account passwords game rooms URL unaccompanied money. No process through 80 ports transmit information. The main aim is to make friends, learn the keyboard hook. Much Although on Rafah
Platform: |
Size: 1305800 |
Author: 林林 |
Hits:
Description: 实现令人满意的风格统一的软件界面确实很难, 象网友提到的MessageBox、FileDialog、FontDialog、目录选择对话框等MFC内部甚至系统DLL内的对话框，要想让它变脸可不容易。有人说HOOK技术可以，HOOK技术确实可以，HOOK可以说是无孔不入，但HOOK的使用效率却是令人难以满意的，从目前大多数采HOOK技术的换肤软件使用情况来看，完全可以证明这一点。今天我们将讨论另外一技术来实现FileDialog的变脸，这种技术叫替换窗口过程法-achieve satisfactory style reunification of the software interface is difficult. As netizen's MessageBox, FileDialog, FontDialog. Contents dialog, and other internal MFC DLL system even within the dialog box, in order to allow it faces no easy thing. Some say HOOK technology, the technology can really HOOK, HOOK can be said to be all-pervasive. However, the efficient use HOOK is unsatisfactory. from the most current mining technology HOOK skinnable software situation, we can prove this point. Today, we will discuss other technologies to achieve a FileDialog changing face of this technique is called window replacement process France
Platform: |
Size: 610942 |
Author: hk |
Hits:
Description: 怎样让自己的程序进程不让别人强行关闭掉,拦截API函数，利用钩子拦截TerminateProcess这个API函数-how to let their own procedures process forced the closure of not allowing people to swap, intercepting API function, use the hook to intercept the TerminateProcess API
Platform: |
Size: 815497 |
Author: 无名 |
Hits:
Description: ExcpHook is an open source (see license.txt) Exception Monitor for Windows made by Gynvael Coldwind (of Team Vexillium). t uses a ring0 driver to hook KiExceptionDispatch procedure to detect the exceptions, and then shows information about the exception on stdout (using the ring3 part of the program ofc).
The difference between this method, and the standard debug API method it that this method monitores all of XP processes, and the program does not have to attach to any other process to monitor it, hence it s harder to detect.
The code currently is considered as ALPHA, and it has been reported to BSoD sometimes (on multi core/cpu machines). Take Care!
Platform: |
Size: 54007 |
Author: 张京 |
Hits:
Description: 全局钩子,监视所有键盘消息,并且保存到文本文件.详细全面的过程.全部源代码.VC6下编译通过-overall hook, keyboard monitor all news and save text files. Detailed and comprehensive process. All source code. Under compile VC6
Platform: |
Size: 18259 |
Author: 学习 |
Hits:
Description: 利用Hook在Explorer进程插入一个线程实例-use Explorer Hook in the process of inserting a threaded example
Platform: |
Size: 26411 |
Author: 王任 |
Hits:
«
1
2
...
8
9
10
11
12
1314
15
16
17
18
...
26
»