利用Windows页防护机制进行函数挂钩

#include <windows.h>
#include <stdio.h>

// Hook函数功能
HANDLE hook(LPSECURITY_ATTRIBUTES rcx, SIZE_T rdx, LPTHREAD_START_ROUTINE r8, LPVOID r9, DWORD stck1, LPDWORD stck2) {
    MessageBoxA(0, "CreateThread() was called!", "YAY!", 0);
    MessageBoxA(0, "Hooked CreateThread", "YAY!", 0);
    // 这里调用原始CreateThread函数
    //return CreateThread(rcx, rdx, r8, r9, stck1, stck2);
 return NULL;
}

LONG WINAPI handler(EXCEPTION_POINTERS * ExceptionInfo) {
 if (ExceptionInfo->ExceptionRecord->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION) {
  if (ExceptionInfo->ContextRecord->Rip == (DWORD64) &CreateThread) {
   printf("[!] Exception (%#llx)!" , ExceptionInfo->ExceptionRecord->ExceptionAddress);
            printf("nClick a key to continue...n");
   getchar();
   ExceptionInfo->ContextRecord->Rip = (DWORD64) &hook;
            printf("Modified RIP Points to: %#llxn", ExceptionInfo->ContextRecord->Rip);
            printf("Hook Function = %#llxn", (DWORD64) &hook);
  }
  return EXCEPTION_CONTINUE_EXECUTION;
 }
 return EXCEPTION_CONTINUE_SEARCH;
}

int main() {
 DWORD old = 0;
    DWORD param = 5000;
 AddVectoredExceptionHandler(1, &handler);
 VirtualProtect(&CreateThread, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &old);
 printf("CreateThread addr = %#pn", &CreateThread);
 
 HANDLE hThread = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) &Sleep, &param, 0, 0);
 WaitForSingleObject(hThread, param);
 printf("YEP!n");
    
 return 0;
}