键盘过滤

代码具体分为两部分
1.KeyHook 动态链接库
2.HookMain 主程序入口

1.KeyHook 动态链接库
DllMain.cpp
Source.def

//DllMain.cpp   
   #include <iostream>
   #include <tchar.h>
   #include <Windows.h>
   using namespace std;

   HINSTANCE __ModuleHandle = NULL;  //模块句柄（基地址）
   HHOOK  __HookModule = NULL;       //钩子句柄（基地址）
   LRESULT CALLBACK MessageProcedure(int Message, WPARAM wParam, LPARAM lParam)
//DllMain 的规范写法 注意程序位数 钩子程序位数需要和所需钩的程序或系统的位数相匹配
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD ul_reason_for_call, LPVOID lpvReserved)
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
	{
		__ModuleHandle = hinstDLL;
		break;
	}
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}
//IDA Export 中发现的导出函数 HookStart
HHOOK SetWindowsHookEx(      
		 int idHook,      //消息ID
    HOOKPROC lpfn,   //回调函数
    HINSTANCE hMod,  //模块句柄
    DWORD dwThreadId //线程ID 一般为0
);
HHOOK HookStart()
{
	HHOOK ReturnValue; // eax

	ReturnValue = SetWindowsHookEx(2, MessageProcedure, __ModuleHandle, 0);  //系统黑函数
	__HookModule = ReturnValue;  //拦截成功 返回一个钩子钩取的句柄 
	return ReturnValue;
}

//SetWindowsHookEx函数的回调函数 MessageProcedure
LRESULT CALLBACK MessageProcedure(int Message, WPARAM wParam, LPARAM lParam)
{
	TCHAR v1[260] = { 0 }; // 文件的完整路径
 	TCHAR v2[50] = { 0 }; //按键文本
	TCHAR* v3; // 游走指针
	memset(&v1, 0, 260);  //初始化

	if (Message >= 0
		&& ParamemterData2 >= 0
		&& (GetModuleFileName(0,v1,260), v3 = _tcsrchr(v1, 92), !_tcsicmp(v3 + 1, _T("notepad.exe"))))
	{
		GetKeyNameText(ParamemterData2, v2, 50);
		MessageBox(NULL, v2, _T("Filter"), 0);
		ResultValue = 1;
	}
	else
	{
		//不做拦截
		ResultValue = CallNextHookEx(NULL, Message, ParameterData1, ParamemterData2);
	}
	return ResultValue;
}

//IDA Export 中发现的导出函数 HookStop
HHOOK HookStop()
{
	HHOOK ReturnValue; // eax

	ReturnValue = __HookModule;
	if (__HookModule)
	{
		ReturnValue = (HHOOK)UnhookWindowsHookEx(__HookModule);
		__HookModule = 0;
	}
	return ReturnValue;
}
//Source.def  资源文件(导出表)
 EXPORTS
	HookStart @1
	HookStop  @2

2.HookMain主程序入口

//_tmain.cpp
#include <iostream>
#include <tchar.h>
#include <Windows.h>
using namespace std;

typedef void  (_cdecl *LPFN_SUB)(void);  //函数指针
int _tmain()
{
	HMODULE ModuleHandle; // eax@1 模块句柄（基地址）
	DWORD v5; // eax@2  报错
	int ResultValue; // eax@2
	//void(*v7)(void); 
	//void(*v8)(void); 
	LPFN_SUB v7 = NULL;
	LPFN_SUB v8 = NULL;

	ModuleHandle = LoadLibraryA("HookKey.dll");  //加载模块的句柄
	if (ModuleHandle)
	{
		v7 = (void(*)(void))GetProcAddress(ModuleHandle, "HookStart");
		v8 = (void(*)(void))GetProcAddress(ModuleHandle, "HookStop");
		v7();
		_tprintf(_T("press 'q' to quit!\n"));
		while (_gettchar() != 113)
		{

		}
		v8();
		FreeLibrary(ModuleHandle); 
	}
	else
	{
		v5 = GetLastError();		
	}
	return 0;
}