Question

我已经编写了两个应用程序（dll，exe）来将dll挂接到putty中以便监听键盘事件。

一个应用程序是Dll应用程序，它包含钩子方法（meconnect）。

#include "stdafx.h"
#include <stdio.h>
#include <windows.h>

INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved) {
    /* open file */
    FILE *file;
    fopen_s(&file, "C:\\temp.txt", "a+");

    switch (Reason) {
    case DLL_PROCESS_ATTACH:
        fprintf(file, "DLL attach function called.\n");
        break;
    case DLL_PROCESS_DETACH:
        fprintf(file, "DLL detach function called.\n");
        break;
    case DLL_THREAD_ATTACH:
        fprintf(file, "DLL thread attach function called.\n");
        break;
    case DLL_THREAD_DETACH:
        fprintf(file, "DLL thread detach function called.\n");
        break;
    }

    /* close file */
    fclose(file);

    return TRUE;
}

extern "C" __declspec(dllexport) LRESULT  __stdcall meconnect(int code, WPARAM wParam, LPARAM lParam) {
    //FILE *file;
    //fopen_s(&file, "C:\\function.txt", "a+");
    //fprintf(file, "Function keyboard_hook called.\n");
    //fclose(file);

    OutputDebugString(L"function keyboard hook called. \n");
    //return 0;
    return(CallNextHookEx(NULL, code, wParam, lParam));
}

在PuTTY应用程序上触发键盘事件时，将调用meconnect方法。

下面给出了将dll注入到PuTTY应用程序中的代码。

// program.exe.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <Windows.h>
#include <string>
#include  <io.h>

using namespace std;

void Usage()
{
    printf("Usage: InjectDLL pid path-to-dll [-privilege]");
}


int _tmain(int argc, char* argv[])
{



    /*
    * Load library in which we'll be hooking our functions.
    */
    HMODULE dll = LoadLibrary(L"C:\\drivers\\dllinject.dll");
    //HMODULE dll = LoadLibrary((LPCTSTR)buf);
    if (dll == NULL) {
        printf("The DLL could not be found.\n");
        getchar();
        return -1;
    }

    /*
    * Get the address of the function inside the DLL.
    */
    HOOKPROC addr = (HOOKPROC)GetProcAddress(dll, "_meconnect@12");
    if (addr == NULL) {
        printf("The function was not found.\n");
        getchar();
        return -1;
    }

    /*
    * Hook the function.
    */
    DWORD procID=0;
    HWND targetWnd = FindWindowA("PuTTYConfigBox","PuTTY Configuration" );
    //HWND windowHandle = FindWindowA(NULL, "Calculator.exe");
    DWORD threadID = GetWindowThreadProcessId(targetWnd, &procID);

    wchar_t msgBuf[1024] = L"";
    wchar_t msgBuf2[1024] = L"";
    wsprintf(msgBuf, L"the proc Id is %d", threadID);

    OutputDebugString(msgBuf);
    HHOOK handle = SetWindowsHookEx(WH_KEYBOARD, addr, dll, threadID);
    DWORD x = GetLastError();
    wsprintf(msgBuf2, L"the last error is %d", x);
    OutputDebugString(msgBuf2);
    if (handle == NULL) {
        printf("The KEYBOARD could not be hooked.\n");
    }
    else{
        printf("Program successfully hooked.\nPress enter to unhook the function and stop the program.\n");
    }

    /*
    * Unhook the function.
    */

    getchar();
    UnhookWindowsHookEx(handle);

    return 0;
}

当我运行上面的代码时，setWindowsHookEx总是返回null，这意味着SetWindowsHookEx没有挂钩到PuTTY应用程序。谁能帮助我理解我在这里做错了什么。

Answer 1

你需要以下一种方式在dll中声明函数：

extern "C" LRESULT  __stdcall meconnect(int code, WPARAM wParam, LPARAM lParam) {
//...
}

#ifdef _X86_
#define EXP_meconnect "_meconnect@12"
#elif defined(_AMD64_)
#define EXP_meconnect "meconnect"
#else
#error "unknown platform"
#endif

__pragma(comment(linker, "/export:meconnect=" EXP_meconnect))

总是按名称“meconnect”导出它。另一种方式 - 使用def file

或者如果您将其声明为

extern "C" __declspec(dllexport) LRESULT  __stdcall meconnect(int code, WPARAM wParam, LPARAM lParam) {
//...
}

在dll中，你需要在exe下一个代码：

#ifdef _X86_
#define EXP_meconnect "_meconnect@12"
#elif defined(_AMD64_)
#define EXP_meconnect "meconnect"
#else
#error "unknown platform"
#endif

HOOKPROC addr = (HOOKPROC)GetProcAddress(dll, EXP_meconnect );

挂钩到特定线程时，SetWindowsHookEx返回null

1 个答案: