c – IAT挂钩但挂钩功能未被调用

在调试过程中,我能够看到内核的原始IAT地址！GetCurrentProcessId：

GetCurrentProcessId地址：7C8099C0

我要交换的功能是：

MyGetCurrentProcessId地址：100118BB

我挂钩thunkIAT-> u1.Function的地址并将其从7C8099C0更改为100118BB,但正如我之前提到的,当从程序中调用GetCurrentProcessId()时,调用Kernel32函数(不是我注入的函数).

执行钩子的部分代码是：

if(strcmp(apiName,(char*)(*nameData).Name)==0)
{
DBG_PRINT2("[processImportDescriptor]: found match for %sn",apiName);

VirtualProtect(
    &thunkIAT->u1.Function,// start addres of the zone to "unlock"
    0x010,// size to protect
    PAGE_EXECUTE_READWRITE,// new permission
    &dwOldProtect           // old permission
 );

procPtr = MyGetCurrentProcessId;
thunkIAT->u1.Function = (DWORD)procPtr;

DBG_PRINT2("MyGetCurrentProcessId() address: %08Xn",MyGetCurrentProcessId);
DBG_PRINT2("procPtr address: %08Xn",procPtr);
DBG_PRINT2("thunkIAT->u1.Function address: %08Xn",thunkIAT->u1.Function);

VirtualProtect(
    &thunkIAT->u1.Function,// start addres of the zone to "relock"
    0x0010,// size to protect
    dwOldProtect,// new permission
    &dwOldProtect2      // old permission
);

}

有什么想法吗？谢谢.