Windows下两种API钩挂技术的研究与实现  

Research and implementation of two API-Hooking technologies based on Windows

作　　者：苏雪丽[1] 袁丁[1,2] 

机构地区：[1]四川师范大学计算机科学学院,四川成都610101 [2]西南交通大学信息编码与传输四川省重点实验室,四川成都610031

出　　处：《计算机工程与设计》2011年第7期2548-2552,共5页Computer Engineering and Design

基　　金：西南交通大学信息编码与传输四川省重点实验室开放研究基金项目(2010-05)

摘　　要：详细阐述了两种API钩挂技术IAT(importaddresstable)Hook和InlineHook的基本原理,给出了各自的实现方法。通过实验,指出IAT Hook在文件操作监控时存在的不稳定现象,比如explorer.exe错误。提出用基于Inline Hook的Detours技术弥补IAT Hook的缺陷,并给出了实现方法。实验结果表明,该方法能有效实现稳定可靠的API钩挂I,nline Hook是一种比较好的API钩挂技术。Two API-Hooking technologies, IAT Hook and Inline Hook are expounded, and then the implementation of them. According to experiments, the instability oflAT Hook is pointed out, such as explorer.exe fault, suggesting use Detours technology which is based on Inline Hook to make up for deficiencies in IAT Hook. In the end, an implementation of this schema is forwarded. Experimental results show that the proposed method realized stable and reliable API-Hooking, lnline Hook is a good API-Hooking technology.

关 键 词：API钩挂技术 IAT钩挂 PE文件 Inline钩挂 Detours技术 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]