【C】DirectSound8 Hook：将DirectSoundBuffer中的声音存为WAV

0xAA55

原理很简单，将原始的dsound.dll改名为“dsorg.dll”，然后自己写一个Dll，命名为“dsound.dll”，使其具有和原来的dsound.dll相同的导出表。
其实只需要使用这个def文件就能做到了：

1. LIBRARY
   
2.         EXPORTS
   
3. DirectSoundCreate                                @1
   
4. DirectSoundEnumerateA                        @2
   
5. DirectSoundEnumerateW                        @3
   
6. DllCanUnloadNow                                        PRIVATE
   
7. DllGetClassObject                                PRIVATE
   
8. DirectSoundCaptureCreate                @6
   
9. DirectSoundCaptureEnumerateA        @7
   
10. DirectSoundCaptureEnumerateW        @8
    
11. GetDeviceID                                                @9
    
12. DirectSoundFullDuplexCreate                @10
    
13. DirectSoundCreate8                                @11
    
14. DirectSoundCaptureCreate8                @12

复制代码

然后就是要自己实现这几个方法。

1. #define        CINTERFACE
   
2. 
   
3. #include"log.h"
   
4. #include<Windows.h>
   
5. #include<dsound.h>
   
6. 
   
7. //原始Dll句柄
   
8. HMODULE        g_hOrgDll=NULL;
   
9. 
   
10. //DirectSoundCreate
    
11. //DirectSoundEnumerateA
    
12. //DirectSoundEnumerateW
    
13. //DllCanUnloadNow
    
14. //DllGetClassObject
    
15. //DirectSoundCaptureCreate
    
16. //DirectSoundCaptureEnumerateA
    
17. //DirectSoundCaptureEnumerateW
    
18. //GetDeviceID
    
19. //DirectSoundFullDuplexCreate
    
20. //DirectSoundCreate8
    
21. //DirectSoundCaptureCreate8
    
22. 
    
23. void HookIDirectSound(LPDIRECTSOUND pDS);
    
24. void HookIDirectSound8(LPDIRECTSOUND8 pDS);
    
25. void HookIDirectSoundBuffer(LPDIRECTSOUNDBUFFER pDSB);
    
26. void HookIDirectSoundBuffer8(LPDIRECTSOUNDBUFFER8 pDSB8);
    
27. 
    
28. //=============================================================================
    
29. //函数指针类型定义
    
30. //-----------------------------------------------------------------------------
    
31. typedef _Check_return_ HRESULT(WINAPI*FnDirectSoundCreate)(_In_opt_ LPCGUID pcGuidDevice, _Outptr_ LPDIRECTSOUND *ppDS, _Pre_null_ LPUNKNOWN pUnkOuter);
    
32. typedef HRESULT(WINAPI*FnDirectSoundEnumerateA)(_In_ LPDSENUMCALLBACKA pDSEnumCallback, _In_opt_ LPVOID pContext);
    
33. typedef HRESULT(WINAPI*FnDirectSoundEnumerateW)(_In_ LPDSENUMCALLBACKW pDSEnumCallback, _In_opt_ LPVOID pContext);
    
34. typedef HRESULT(STDAPICALLTYPE*FnDllCanUnloadNow)();
    
35. typedef HRESULT(STDAPICALLTYPE*FnDllGetClassObject)(REFCLSID rclsid,REFIID riid,LPVOID*ppv);
    
36. typedef HRESULT(WINAPI*FnDirectSoundCaptureCreate)(_In_opt_ LPCGUID pcGuidDevice, _Outptr_ LPDIRECTSOUNDCAPTURE *ppDSC, _Pre_null_ LPUNKNOWN pUnkOuter);
    
37. typedef HRESULT(WINAPI*FnDirectSoundCaptureEnumerateA)(_In_ LPDSENUMCALLBACKA pDSEnumCallback, _In_opt_ LPVOID pContext);
    
38. typedef HRESULT(WINAPI*FnDirectSoundCaptureEnumerateW)(_In_ LPDSENUMCALLBACKW pDSEnumCallback, _In_opt_ LPVOID pContext);
    
39. typedef HRESULT(WINAPI*FnGetDeviceID)(_In_opt_ LPCGUID pGuidSrc, _Out_ LPGUID pGuidDest);
    
40. typedef HRESULT(WINAPI*FnDirectSoundFullDuplexCreate)
    
41. (
    
42.     _In_opt_ LPCGUID pcGuidCaptureDevice,
    
43.     _In_opt_ LPCGUID pcGuidRenderDevice,
    
44.     _In_ LPCDSCBUFFERDESC pcDSCBufferDesc,
    
45.     _In_ LPCDSBUFFERDESC pcDSBufferDesc,
    
46.     HWND hWnd,
    
47.     DWORD dwLevel,
    
48.     _Outptr_ LPDIRECTSOUNDFULLDUPLEX* ppDSFD,
    
49.     _Outptr_ LPDIRECTSOUNDCAPTUREBUFFER8 *ppDSCBuffer8,
    
50.     _Outptr_ LPDIRECTSOUNDBUFFER8 *ppDSBuffer8,
    
51.     _Pre_null_ LPUNKNOWN pUnkOuter
    
52. );
    
53. typedef HRESULT(WINAPI*FnDirectSoundCreate8)(_In_opt_ LPCGUID pcGuidDevice, _Outptr_ LPDIRECTSOUND8 *ppDS8, _Pre_null_ LPUNKNOWN pUnkOuter);
    
54. typedef HRESULT(WINAPI*FnDirectSoundCaptureCreate8)(_In_opt_ LPCGUID pcGuidDevice, _Outptr_ LPDIRECTSOUNDCAPTURE8 *ppDSC8, _Pre_null_ LPUNKNOWN pUnkOuter);
    
55. 
    
56. //=============================================================================
    
57. //函数指针
    
58. //-----------------------------------------------------------------------------
    
59. FnDirectSoundCreate        g_pOrgDirectSoundCreate=NULL;
    
60. FnDirectSoundEnumerateA g_pOrgDirectSoundEnumerateA=NULL;
    
61. FnDirectSoundEnumerateW g_pOrgDirectSoundEnumerateW=NULL;
    
62. FnDllCanUnloadNow g_pOrgDllCanUnloadNow=NULL;
    
63. FnDllGetClassObject g_pOrgDllGetClassObject=NULL;
    
64. FnDirectSoundCaptureCreate g_pOrgDirectSoundCaptureCreate=NULL;
    
65. FnDirectSoundCaptureEnumerateA g_pOrgDirectSoundCaptureEnumerateA=NULL;
    
66. FnDirectSoundCaptureEnumerateW g_pOrgDirectSoundCaptureEnumerateW=NULL;
    
67. FnGetDeviceID g_pOrgGetDeviceID=NULL;
    
68. FnDirectSoundFullDuplexCreate g_pOrgDirectSoundFullDuplexCreate=NULL;
    
69. FnDirectSoundCreate8 g_pOrgDirectSoundCreate8=NULL;
    
70. FnDirectSoundCaptureCreate8 g_pOrgDirectSoundCaptureCreate8=NULL;
    
71. 
    
72. void LoadOrgDll()
    
73. {
    
74.         if(!g_hOrgDll)
    
75.         {
    
76.                 Log("Loading org Dll.\n");
    
77.                 g_hOrgDll=LoadLibrary(TEXT("dsorg.dll"));
    
78.                 if(!g_hOrgDll)
    
79.                         return;
    
80.                 g_pOrgDirectSoundCreate=(FnDirectSoundCreate)GetProcAddress(g_hOrgDll,"DirectSoundCreate");
    
81.                 g_pOrgDirectSoundEnumerateA=(FnDirectSoundEnumerateA)GetProcAddress(g_hOrgDll,"DirectSoundEnumerateA");
    
82.                 g_pOrgDirectSoundEnumerateW=(FnDirectSoundEnumerateW)GetProcAddress(g_hOrgDll,"DirectSoundEnumerateW");
    
83.                 g_pOrgDllCanUnloadNow=(FnDllCanUnloadNow)GetProcAddress(g_hOrgDll,"DllCanUnloadNow");
    
84.                 g_pOrgDllGetClassObject=(FnDllGetClassObject)GetProcAddress(g_hOrgDll,"DllGetClassObject");
    
85.                 g_pOrgDirectSoundCaptureCreate=(FnDirectSoundCaptureCreate)GetProcAddress(g_hOrgDll,"DirectSoundCaptureCreate");
    
86.                 g_pOrgDirectSoundCaptureEnumerateA=(FnDirectSoundCaptureEnumerateA)GetProcAddress(g_hOrgDll,"DirectSoundCaptureEnumerateA");
    
87.                 g_pOrgDirectSoundCaptureEnumerateW=(FnDirectSoundCaptureEnumerateW)GetProcAddress(g_hOrgDll,"DirectSoundCaptureEnumerateW");
    
88.                 g_pOrgGetDeviceID=(FnGetDeviceID)GetProcAddress(g_hOrgDll,"GetDeviceID");
    
89.                 g_pOrgDirectSoundFullDuplexCreate=(FnDirectSoundFullDuplexCreate)GetProcAddress(g_hOrgDll,"DirectSoundFullDuplexCreate");
    
90.                 g_pOrgDirectSoundCreate8=(FnDirectSoundCreate8)GetProcAddress(g_hOrgDll,"DirectSoundCreate8");
    
91.                 g_pOrgDirectSoundCaptureCreate8=(FnDirectSoundCaptureCreate8)GetProcAddress(g_hOrgDll,"DirectSoundCaptureCreate8");
    
92.         }
    
93. }
    
94. 
    
95. _Check_return_ HRESULT WINAPI DirectSoundCreate
    
96. (
    
97.         _In_opt_ LPCGUID pcGuidDevice,
    
98.         _Outptr_ LPDIRECTSOUND *ppDS,
    
99.         _Pre_null_ LPUNKNOWN pUnkOuter)
    
100. {
     
101.         HRESULT hRet;
     
102.         LoadOrgDll();
     
103.         Log("DirectSoundCreate\n");
     
104.         hRet=g_pOrgDirectSoundCreate(pcGuidDevice,ppDS,pUnkOuter);
     
105.         if(SUCCEEDED(hRet) && *ppDS)
     
106.                 HookIDirectSound(*ppDS);
     
107.         return hRet;
     
108. }
     
109. 
     
110. HRESULT WINAPI DirectSoundEnumerateA
     
111. (
     
112.         _In_ LPDSENUMCALLBACKA pDSEnumCallback,
     
113.         _In_opt_ LPVOID pContext
     
114. )
     
115. {
     
116.         HRESULT hRet;
     
117.         LoadOrgDll();
     
118.         Log("DirectSoundEnumerateA\n");
     
119.         hRet=g_pOrgDirectSoundEnumerateA(pDSEnumCallback,pContext);
     
120.         return hRet;
     
121. }
     
122. 
     
123. HRESULT WINAPI DirectSoundEnumerateW
     
124. (
     
125.         _In_ LPDSENUMCALLBACKW pDSEnumCallback,
     
126.         _In_opt_ LPVOID pContext
     
127. )
     
128. {
     
129.         HRESULT hRet;
     
130.         LoadOrgDll();
     
131.         Log("DirectSoundEnumerateW\n");
     
132.         hRet=g_pOrgDirectSoundEnumerateW(pDSEnumCallback,pContext);
     
133.         return hRet;
     
134. }
     
135. 
     
136. HRESULT STDAPICALLTYPE DllCanUnloadNow()
     
137. {
     
138.         HRESULT hRet;
     
139.         LoadOrgDll();
     
140.         Log("DllCanUnloadNow\n");
     
141.         hRet=g_pOrgDllCanUnloadNow();
     
142.         return hRet;
     
143. }
     
144. 
     
145. HRESULT STDAPICALLTYPE DllGetClassObject(REFCLSID rclsid,REFIID riid,LPVOID*ppv)
     
146. {
     
147.         HRESULT hRet;
     
148.         LoadOrgDll();
     
149.         Log("DllGetClassObject\n");
     
150.         hRet=g_pOrgDllGetClassObject(rclsid,riid,ppv);
     
151.         return hRet;
     
152. }
     
153. 
     
154. HRESULT WINAPI DirectSoundCaptureCreate
     
155. (
     
156.         _In_opt_ LPCGUID pcGuidDevice,
     
157.         _Outptr_ LPDIRECTSOUNDCAPTURE*ppDSC,
     
158.         _Pre_null_ LPUNKNOWN pUnkOuter)
     
159. {
     
160.         HRESULT hRet;
     
161.         LoadOrgDll();
     
162.         Log("DirectSoundCaptureCreate\n");
     
163.         hRet=g_pOrgDirectSoundCaptureCreate(pcGuidDevice,ppDSC,pUnkOuter);
     
164.         return hRet;
     
165. }
     
166. 
     
167. HRESULT WINAPI DirectSoundCaptureEnumerateA
     
168. (
     
169.         _In_ LPDSENUMCALLBACKA pDSEnumCallback,
     
170.         _In_opt_ LPVOID pContext
     
171. )
     
172. {
     
173.         HRESULT hRet;
     
174.         LoadOrgDll();
     
175.         Log("DirectSoundCaptureEnumerateA\n");
     
176.         hRet=g_pOrgDirectSoundCaptureEnumerateA(pDSEnumCallback,pContext);
     
177.         return hRet;
     
178. }
     
179. 
     
180. HRESULT WINAPI DirectSoundCaptureEnumerateW
     
181. (
     
182.         _In_ LPDSENUMCALLBACKW pDSEnumCallback,
     
183.         _In_opt_ LPVOID pContext
     
184. )
     
185. {
     
186.         HRESULT hRet;
     
187.         LoadOrgDll();
     
188.         Log("DirectSoundCaptureEnumerateW\n");
     
189.         hRet=g_pOrgDirectSoundCaptureEnumerateW(pDSEnumCallback,pContext);
     
190.         return hRet;
     
191. }
     
192. 
     
193. HRESULT WINAPI GetDeviceID
     
194. (
     
195.         _In_opt_ LPCGUID pGuidSrc,
     
196.         _Out_ LPGUID pGuidDest
     
197. )
     
198. {
     
199.         HRESULT hRet;
     
200.         LoadOrgDll();
     
201.         Log("GetDeviceID\n");
     
202.         hRet=g_pOrgGetDeviceID(pGuidSrc,pGuidDest);
     
203.         return hRet;
     
204. }
     
205. 
     
206. HRESULT WINAPI DirectSoundFullDuplexCreate
     
207. (
     
208.     _In_opt_ LPCGUID pcGuidCaptureDevice,
     
209.     _In_opt_ LPCGUID pcGuidRenderDevice,
     
210.     _In_ LPCDSCBUFFERDESC pcDSCBufferDesc,
     
211.     _In_ LPCDSBUFFERDESC pcDSBufferDesc,
     
212.     HWND hWnd,
     
213.     DWORD dwLevel,
     
214.     _Outptr_ LPDIRECTSOUNDFULLDUPLEX* ppDSFD,
     
215.     _Outptr_ LPDIRECTSOUNDCAPTUREBUFFER8 *ppDSCBuffer8,
     
216.     _Outptr_ LPDIRECTSOUNDBUFFER8 *ppDSBuffer8,
     
217.     _Pre_null_ LPUNKNOWN pUnkOuter
     
218. )
     
219. {
     
220.         HRESULT hRet;
     
221.         LoadOrgDll();
     
222.         Log("DirectSoundFullDuplexCreate\n");
     
223.         hRet=g_pOrgDirectSoundFullDuplexCreate
     
224.                 (
     
225.                         pcGuidCaptureDevice,
     
226.                         pcGuidRenderDevice,
     
227.                         pcDSCBufferDesc,
     
228.                         pcDSBufferDesc,
     
229.                         hWnd,
     
230.                         dwLevel,
     
231.                         ppDSFD,
     
232.                         ppDSCBuffer8,
     
233.                         ppDSBuffer8,
     
234.                         pUnkOuter
     
235.                 );
     
236.         HookIDirectSoundBuffer8(*ppDSBuffer8);
     
237.         return hRet;
     
238. }
     
239. 
     
240. HRESULT WINAPI DirectSoundCreate8
     
241. (
     
242.         _In_opt_ LPCGUID pcGuidDevice,
     
243.         _Outptr_ LPDIRECTSOUND8 *ppDS8,
     
244.         _Pre_null_ LPUNKNOWN pUnkOuter
     
245. )
     
246. {
     
247.         HRESULT hRet;
     
248.         LoadOrgDll();
     
249.         Log("DirectSoundCreate8\n");
     
250.         hRet=g_pOrgDirectSoundCreate8(pcGuidDevice,ppDS8,pUnkOuter);
     
251.         if(SUCCEEDED(hRet) && *ppDS8)
     
252.                 HookIDirectSound8(*ppDS8);
     
253.         return hRet;
     
254. }
     
255. 
     
256. HRESULT WINAPI DirectSoundCaptureCreate8
     
257. (
     
258.         _In_opt_ LPCGUID pcGuidDevice,
     
259.         _Outptr_ LPDIRECTSOUNDCAPTURE8 *ppDSC8,
     
260.         _Pre_null_ LPUNKNOWN pUnkOuter
     
261. )
     
262. {
     
263.         HRESULT hRet;
     
264.         LoadOrgDll();
     
265.         Log("DirectSoundCaptureCreate8\n");
     
266.         hRet=g_pOrgDirectSoundCaptureCreate8(pcGuidDevice,ppDSC8,pUnkOuter);
     
267.         return hRet;
     
268. }

复制代码

其中的Log是一个参数类似于printf然后将内容打印到文件的这么一个调试性质的函数，而HookXXXXX这样的函数则是用来对某个Com类进行Hook操作。
某些游戏会完全使用DirectSound，并且使用多个DirectSoundBuffer完成音效混合的操作，因此对于这样的游戏，我们就可以将其加载的音效偷出来保存了。具体的代码请下载附件。

BIN: psdsbin.7z (224.62 KB, 下载次数: 20)

2015-4-28 22:43 上传

点击文件名下载附件

SRC: psdssrc.7z (503.65 KB, 下载次数: 40)

2015-4-28 22:44 上传

点击文件名下载附件

ljxin

膜拜技术宅

0x01810

mark...可以用来翻录..

fangyuan

太强了，我在网上找了很久也没有找到，最终在你这里找到了相似的实现方法，我用的是注入一个Dll模块到第三方库，然后再进行DirectSound8的hook，但是我不知道该如何截取数据，接口已经全部hook了，我现在只要看你的源码就可以知道怎么来保存了，谁能相信15年的帖子帮了22年的我，感想大佬的无私奉献！！！！

系统消息

我也说两句吧：
1.不需要HOOK的函数可以直接在def文件里面做导出表跳转，不需要自己写代码再调用过去，比如：DllCanUnloadNow=dsorg.DllCanUnloadNow @4 PRIVATE
2.需要HOOK并不只是 DirectSoundCreate 和 DirectSoundCreate8，还有 DllGetClassObject 也需要HOOK，因为DS对象有两种创建方式，一种就是直接调用dsound.dll的导出函数，还有一种就是用 CoCreateInstance（这个走 DllGetClassObject 不走 DirectSoundCreate 和 DirectSoundCreate8）。