Hook api（拾人牙慧，略作整理）

#include
#include

// libimagehlp.a

LPVOID SetModuleCallee(HMODULE hCaller, LPCSTR lpszCallee, LPCSTR lpszFunction, LPVOID lpfnCallee)
{
    ULONG size;
    PIMAGE_IMPORT_DESCRIPTOR pImportDesc;

    pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hCaller, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &size);
    if (pImportDesc)
    {
        while (pImportDesc->Name)
        {
            if (!lstrcmpiA((LPSTR)((PBYTE)hCaller + pImportDesc->Name), lpszCallee))
            {
                PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)((PBYTE)hCaller + pImportDesc->FirstThunk);
                LPVOID lpfnCaller = GetProcAddress(GetModuleHandle(lpszCallee), lpszFunction);

                while (pThunk->u1.Function)
                {
                    if (*(LPVOID *)&pThunk->u1.Function == lpfnCaller)
                    {
                        *(LPVOID *)&pThunk->u1.Function = lpfnCallee;
                        return lpfnCaller;
                    }
                    ++pThunk;
                }
                break;
            }
            ++pImportDesc;
        }
    }

    return NULL;
}

static HCURSOR (WINAPI *lpfnSetCursor)(HCURSOR);

HCURSOR WINAPI Test(HCURSOR hCursor)
{
    MessageBox(NULL, TEXT("ok"), TEXT("Hook"), MB_OK);
    return lpfnSetCursor(hCursor);
}

int main(void)
{
    lpfnSetCursor = (typeof(lpfnSetCursor))SetModuleCallee(GetModuleHandle(NULL), "user32.dll", "SetCursor", Test);
    SetCursor(NULL);

    return 0;
}