64位系统InlineHook

APIHook64Class.h

 #ifndef APIHOOK64CLASS_H_
 #define APIHOOK64CLASS_H_
 #include <Windows.h>

 class APIHook64
 {
 private:
     unsigned char code[];
     unsigned char oldcode[];
     FARPROC addr;

 public:
     APIHook64();
     BOOL Hook(char *dllName,char *apiName,long long callfunc,BOOL bHook=TRUE);
 };

 #endif

APIHook64Class.cpp

 #include "APIHook64Class.h"

 APIHook64::APIHook64()
 {
     /*
         mov eax,0x12345678
         push eax
         ret
     */
     unsigned char c[] = { 0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0xC3 };
     RtlMoveMemory(APIHook64::code, c, );
     memset(APIHook64::oldcode, , );
     addr = NULL;
 }

 BOOL APIHook64::Hook(char *dllName, char *apiName, long long callfunc, BOOL bHook)
 {
     BOOL bOk = FALSE;
     DWORD dwOldProtect = ;
     long long api = callfunc;
     HANDLE hPro = GetCurrentProcess();

     if (!APIHook64::oldcode[])
     {
         addr = GetProcAddress(LoadLibrary(dllName), apiName);
         RtlMoveMemory(APIHook64::code+, &api, );
         if (VirtualProtectEx(hPro, addr, , PAGE_EXECUTE_READWRITE, &dwOldProtect))
         {
             RtlMoveMemory(APIHook64::oldcode, addr, );
         }
     }
     if (bHook)
     {
         bOk = WriteProcessMemory(hPro, addr, APIHook64::code, , NULL);
     }
     else {
         bOk = WriteProcessMemory(hPro, addr, APIHook64::oldcode, , NULL);
     }
     VirtualProtectEx(hPro, addr, , dwOldProtect, &dwOldProtect);
     CloseHandle(hPro);
     return bOk;
 }