挂钩Windows API

挂钩Windows API(6)
    PCSTR pszHookModName = "kernel32.dll",pszSleepName = "Sleep";
    HMODULE hKernel = GetModuleHandle(pszHookModName);
    PROC pfnNew = (PROC)0x12345678,       //这里存放新地址
        pfnHookAPIAddr = GetProcAddress(hKernel,pszSleepName);

    ULONG ulSize;
    PIMAGE_IMPORT_DESCRIPTOR pImportDesc =
        (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(
            hKernel,
            TRUE,
            IMAGE_DIRECTORY_ENTRY_IMPORT,
            &ulSize
        );

    while (pImportDesc->Name)
    {
        PSTR pszModName = (PSTR)((PBYTE) hKernel + pImportDesc->Name);
        if (stricmp(pszModName, pszHookModName) == 0)
        break;  
        pImportDesC++;
    }

    PIMAGE_THUNK_DATA pThunk =
    (PIMAGE_THUNK_DATA)((PBYTE) hKernel + pImportDesc->FirstThunk);

    while (pThunk->u1.Function)
    {
        PROC* ppfn = (PROC*) &pThunk->u1.Function;
        BOOL bFound = (*ppfn == pfnHookAPIAddr);