感謝盧克的提示。我使用了EasyHook。我選擇了它,因爲它也支持64位dll-inject。
DLL注入:
using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Threading;
using EasyHook;
namespace InjectDLL
{
public class Main : EasyHook.IEntryPoint
{
LocalHook CreateTrackPopupMenuExHook;
public Main(RemoteHooking.IContext InContext){}
public void Run(RemoteHooking.IContext InContext)
{
try
{
CreateTrackPopupMenuExHook = LocalHook.Create(
LocalHook.GetProcAddress("user32.dll", "TrackPopupMenuEx"),
new DTrackPopupMenuEx(TrackPopupMenuEx_Hooked),
this);
CreateTrackPopupMenuExHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
}
catch
{
return;
}
while (true)
{
Thread.Sleep(500);
}
}
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern bool AppendMenu(IntPtr hMenu, long uFlags, int uIDNewItem, string lpNewItem);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
static extern IntPtr TrackPopupMenuEx(
IntPtr hMenu,
uint fuFlags,
int x,
int y,
IntPtr hwnd,
IntPtr lptpm);
[UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Auto, SetLastError = true)]
delegate IntPtr DTrackPopupMenuEx(
IntPtr hMenu,
uint fuFlags,
int x,
int y,
IntPtr hwnd,
IntPtr lptpm);
const long MF_STRING = 0x00000000L;
const long MF_SEPARATOR = 0x00000800L;
static IntPtr TrackPopupMenuEx_Hooked(
IntPtr hMenu,
uint fuFlags,
int x,
int y,
IntPtr hwnd,
IntPtr lptpm)
{
IntPtr returnValue = IntPtr.Zero;
try
{
//Separator
AppendMenu(hMenu, MF_SEPARATOR, 0, null);
//New menu item
AppendMenu(hMenu, MF_STRING, 40010, "TestMenuItem");
//call the default procedure
returnValue = TrackPopupMenuEx(hMenu, fuFlags, x, y, hwnd, lptpm);
//our menu item is selected
if (returnValue == (IntPtr)40010)
{
/* CODE HERE */
returnValue = IntPtr.Zero;
}
return returnValue;
}
catch
{
return;
}
return returnValue;
}
}
}
最終有人會打電話給TrackPopupMenu()。我想你可以勾住它,複製菜單,插入你的項目,然後用TPM_RETURNCMD調用真正的TrackPopupMenu()。如果身份證是你的,你可以處理它;如果該ID不是你的,那麼你可以返回給調用者。不過,如果你問我,這是一個非常毛茸茸的方法。 – Luke