[原创]最近无聊，在研究外挂的F12呼出窗口的原理

最近无聊，在研究外挂的F12呼出窗口的原理，在对某一款外挂进行分析后，按这个外挂的思路，也实现了F12呼出窗口的功能，特出来分享一下；本人也只是刚研究C++编程，大神请飘过，莫笑哦……
首先新建一个MFC规则DLL,在这个DLL中插入一个对话框资源，对话框什么样子，你们自己可心着画呗；费话不多说，直接上代码：

// wgdll.cpp : Defines the initialization routines for the DLL.
//
#include "stdafx.h"
#include "wgdll.h"
#include "DLLDLG.h"
#include <WinInet.h>
#include "string"
using namespace  std;
#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif
HHOOK g_hhook=NULL;
CDLLDLG *pCWndWGMain;
BOOL ishook=FALSE;  //表示是否自已HOOK过了；
HMODULE hmod=NULL;
//
//	Note!
//
//		If this DLL is dynamically linked against the MFC
//		DLLs, any functions exported from this DLL which
//		call into MFC must have the AFX_MANAGE_STATE macro
//		added at the very beginning of the function.
//
//		For example:
//
//		extern "C" BOOL PASCAL EXPORT ExportedFunction()
//		{
//			AFX_MANAGE_STATE(AfxGetStaticModuleState());
//			// normal function body here
//		}
//
//		It is very important that this macro appear in each
//		function, prior to any calls into MFC.  This means that
//		it must appear as the first statement within the 
//		function, even before any object variable declarations
//		as their constructors may generate calls into the MFC
//		DLL.
//
//		Please see MFC Technical Notes 33 and 58 for additional
//		details.
//
/////////////////////////////////////////////////////////////////////////////
// CWgdllApp
BEGIN_MESSAGE_MAP(CWgdllApp, CWinApp)
	//{{AFX_MSG_MAP(CWgdllApp)
		// NOTE - the ClassWizard will add and remove mapping macros here.
		//    DO NOT EDIT what you see in these blocks of generated code!
	//}}AFX_MSG_MAP
END_MESSAGE_MAP()
/////////////////////////////////////////////////////////////////////////////
// CWgdllApp construction
CWgdllApp::CWgdllApp()
{
	// TODO: add construction code here,
	// Place all significant initialization in InitInstance
}
/////////////////////////////////////////////////////////////////////////////
// The one and only CWgdllApp object
CWgdllApp theApp;
//下面是自己编写的代码
LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam);
BOOL installhook()
{
	HMODULE hmod2=::GetModuleHandle(L"wgdll.dll");
	if (g_hhook == NULL) 
	{
		HWND gameh=FindWindow(NULL,L"PEiD v0.95");//查找游戏窗口
		if (gameh==0) { AfxMessageBox(L"未找到游戏",MB_OK,NULL);}//出错处理
		DWORD tid=::GetWindowThreadProcessId(gameh,NULL);//获取线程ID
		g_hhook=::SetWindowsHookEx(WH_KEYBOARD,(HOOKPROC)KeyboardProc,hmod2,tid); //安装线程勾子
	if (g_hhook != NULL)
		return TRUE;
	}
	return FALSE;
}
BOOL selfhook()
{
	if (g_hhook == NULL) {
	g_hhook = ::SetWindowsHookEx(WH_KEYBOARD, (HOOKPROC)KeyboardProc,NULL,GetCurrentThreadId());
	if (g_hhook != NULL)
		return TRUE;
	}
	return FALSE;
}
BOOL uninstallhook()
{
	BOOL result=::UnhookWindowsHookEx(g_hhook);
	g_hhook=NULL;
	return result;
}
BOOL showdlg()
{
	AFX_MANAGE_STATE(AfxGetStaticModuleState());
	CWnd *pCWnd = CWnd::GetForegroundWindow();
	if (pCWndWGMain==NULL)
	{
		pCWndWGMain=new CDLLDLG;
		pCWndWGMain->Create(IDD_DLG,pCWnd);
	}
	pCWndWGMain->ShowWindow(SW_SHOW);
	return true;
}
LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam)
{
//按F12弹起时呼出外挂
	AFX_MANAGE_STATE(AfxGetStaticModuleState());
	BOOL bKeyUp = lParam & (1 << 31);
	if (bKeyUp && wParam == VK_F12 && nCode == HC_ACTION) 
	{
		if(ishook)
		{
			showdlg();
		}else
		{
			LoadLibrary(L"F:\\study\\c++\\wgdll\\Debug\\wgdll.dll");     //这个地址要注意，自己改一下；
			selfhook();
			ishook=true;
			showdlg();
		}
	}
return ::CallNextHookEx(g_hhook, nCode, wParam ,lParam);
}
BOOL CWgdllApp::InitInstance()
{
	// TODO: 在此添加专用代码和/或调用基类
	hmod=this->m_hInstance;
	return CWinApp::InitInstance();
}

另外，对话框的CPP文件如下：

// DLLDLG.cpp : implementation file
//
#include "stdafx.h"
#include "wgdll.h"
#include "DLLDLG.h"
#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif
/////////////////////////////////////////////////////////////////////////////
// CDLLDLG dialog
CDLLDLG::CDLLDLG(CWnd* pParent /*=NULL*/)
	: CDialog(CDLLDLG::IDD, pParent)
{
	//{{AFX_DATA_INIT(CDLLDLG)
	m_edit1 = 0;
	m_edit2 = 0;
	m_edit3 = 0;
	//}}AFX_DATA_INIT
}
void CDLLDLG::DoDataExchange(CDataExchange* pDX)
{
	CDialog::DoDataExchange(pDX);
	//{{AFX_DATA_MAP(CDLLDLG)
	DDX_Text(pDX, IDC_EDIT1, m_edit1);
	DDX_Text(pDX, IDC_EDIT2, m_edit2);
	DDX_Text(pDX, IDC_EDIT3, m_edit3);
	//}}AFX_DATA_MAP
}
BEGIN_MESSAGE_MAP(CDLLDLG, CDialog)
	//{{AFX_MSG_MAP(CDLLDLG)
	ON_BN_CLICKED(IDC_BUTTON1, OnButton1)
	//}}AFX_MSG_MAP
END_MESSAGE_MAP()
/////////////////////////////////////////////////////////////////////////////
// CDLLDLG message handlers
void CDLLDLG::OnButton1() 
{
	// TODO: Add your control notification handler code here
}

还有DEF文件，定义DLL导出函数的：
; wgdll.def : Declares the module parameters for the DLL.
LIBRARY      "wgdll"
EXPORTS
    ; Explicit exports can go here
installhook;
uninstallhook;
selfhook;
使用的时候，只要用你的EXE文件导入这个DLL模块，调用这个DLL文件里的installhook函数，就可以对目标进程按装线程键盘钩子，在目标进程按F12，就会弹出所谓的外挂窗口;