Chinaunix首页 | 论坛 | 博客

在线笔记

首页　| 　博文目录　| 　关于我

ckelsel

  • 博客访问： 1465102
  • 博文数量： 596
  • 博客积分： 0
  • 博客等级： 民兵
  • 技术积分： 173
  • 用 户 组： 普通用户
  • 注册时间： 2016-07-06 15:50
个人简介

在线笔记

文章分类

全部博文（596）

文章存档

2016年（1）

2015年（104）

2014年（228）

2013年（226）

2012年（26）

2011年（11）

推荐博文
相关博文
Windows 下 API hook 和 Windows hook 应用区别

分类： Windows平台

2014-09-17 15:04:35



demo1

  1. #include "stdafx.h"
  2. #include <Windows.h>
  3. #include <dbghelp.h>
  4. #pragma comment( lib, "dbghelp.lib")

  6. ULONG ReplaceIATEntryInOneMod( PCSTR pszCalleeModName,
  7.                              PROC pfnCurent, PROC pfnNew, HMODULE hmodCaller)
  8. {
  9.     ULONG ulSize = 0;
  10.     PIMAGE_IMPORT_DESCRIPTOR pImportDesc = ( PIMAGE_IMPORT_DESCRIPTOR )
  11.         ImageDirectoryEntryToData( hmodCaller, TRUE,
  12.         IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize );

  14.     if ( NULL == pImportDesc )
  15.         return 0;

  17.     for ( ; pImportDesc->Name; pImportDesc++)
  18.     {
  19.         PSTR pszModName = (PSTR)
  20.             ((PBYTE) hmodCaller + pImportDesc->Name );
  21.         if ( 0 == lstrcmpiA( pszModName, pszCalleeModName) )
  22.             break;
  23.     }

  25.     if ( 0 == pImportDesc->Name )
  26.     {
  27.         return 0;
  28.     }

  30.     PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)
  31.         ((PBYTE) hmodCaller + pImportDesc->FirstThunk );
  32.     for (; pThunk->u1.Function; pThunk++ )
  33.     {
  34.         PROC *ppfn = ( PROC *)&pThunk->u1.Function;

  36.         BOOL bFound = (*ppfn == pfnCurent );
  37.         if ( bFound )
  38.         {
  39.             MEMORY_BASIC_INFORMATION mbi = { 0 };
  40.             VirtualQuery( pfnCurent, &mbi, sizeof(mbi) );
  41.             DWORD dwOldProtect = 0;
  42.             VirtualProtect( pfnCurent, sizeof(PROC), PAGE_READWRITE, &dwOldProtect );
  43.             ULONG upfAddress = 0;
  44.             ReadProcessMemory( GetCurrentProcess(),
  45.                 ppfn,
  46.                 &upfAddress,
  47.                 sizeof(PROC),
  48.                 NULL );
  49.             WriteProcessMemory( GetCurrentProcess(),
  50.                 ppfn,
  51.                 &pfnNew,
  52.                 sizeof(pfnNew),
  53.                 NULL );

  55.             VirtualProtect( ppfn, sizeof(PROC), dwOldProtect, 0 );
  56.             return upfAddress;
  57.         }
  58.     }


  61.     return 0;
  62. }

  64. typedef int(
  65.             WINAPI
  66.             *PMyMessageBoxW)(
  67.             __in_opt HWND hWnd,
  68.             __in_opt LPCWSTR lpText,
  69.             __in_opt LPCWSTR lpCaption,
  70.             __in UINT uType);

  72. PROC g_Proc = NULL;
  73. int
  74. WINAPI
  75. MyMessageBoxW(
  76.              __in_opt HWND hWnd,
  77.              __in_opt LPCWSTR lpText,
  78.              __in_opt LPCWSTR lpCaption,
  79.              __in UINT uType)
  80. {
  81.     wprintf(L"%s\n", lpText );
  82.     wprintf(L"%s\n", lpCaption );
  83.     return ((PMyMessageBoxW)g_Proc)(
  84.         hWnd,
  85.         lpText,
  86.         lpCaption,
  87.         uType);
  88. }
  89. extern "C" IMAGE_DOS_HEADER __ImageBase;





  95. int _tmain(int argc, _TCHAR* argv[])
  96. {

  98.     g_Proc = (PROC)ReplaceIATEntryInOneMod(
  99.         "user32.dll",
  100.         (PROC)MessageBoxW,
  101.         (PROC)MyMessageBoxW,
  102.         (HMODULE)&__ImageBase);

  104.     MessageBoxW(NULL, L"TEST", L"HOOK", MB_OK );

  106.     return 0;
  107. }
demo2

  1. // hooktest.cpp : Defines the entry point for the console application.
  2. //

  4. #include "stdafx.h"
  5. #include <Windows.h>

  7. PROC install_api_hook(
  8.                      HMODULE hHookModule,
  9.                      const char * szDllName,
  10.                      PROC uHookFunAddr,
  11.                      PROC uNewFundAddr
  12.                      );

  14. BOOL TestFunctionInIAT( HMODULE hModule, ULONG FunctionAddress )
  15. {
  16.     BOOL bReturn = FALSE;
  17.     unsigned char *pBaseAddr = reinterpret_cast<unsigned char *>(hModule);

  19.     // 获取DOS header 的位置
  20.     PIMAGE_DOS_HEADER pDosHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(pBaseAddr);

  22.     // 获取NTImage header 的位置
  23.     PIMAGE_NT_HEADERS pNtHeader = reinterpret_cast<PIMAGE_NT_HEADERS>(
  24.         pBaseAddr + pDosHeader->e_lfanew );

  26.     // 获取 PE option header的位置
  27.     PIMAGE_OPTIONAL_HEADER pPEOptionHeader = &pNtHeader->OptionalHeader;

  29.     // 获取导入表的目录结构
  30.     PIMAGE_DATA_DIRECTORY pIATDataDirectory = &(pPEOptionHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]);

  32.     // 获取导入表 descriptor
  33.     PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>(
  34.         pBaseAddr + pIATDataDirectory->VirtualAddress );

  36.     // 从pImportDescriptor 开始是一堆导入表，一张接着一张，直到
  37.     // 导入表的名字为空为止，其实就是对应Windows 的一个dll，有几张表，就表示
  38.     // 该模块依赖几个dll 的导出函数, Name 字段是dll的名称的相对虚拟地址
  39.     while ( pImportDescriptor->Name != 0 )
  40.     {
  41.         // thunk data 就是表示导入dll 中函数描述
  42.         PIMAGE_THUNK_DATA pThunkData = reinterpret_cast<PIMAGE_THUNK_DATA>(
  43.             pBaseAddr + pImportDescriptor->FirstThunk);
  44.         while( pThunkData->u1.Function != 0 )
  45.         {
  46.              ULONG *ppfn = ( ULONG *)&pThunkData->u1.Function;
  47.              if ( *ppfn == FunctionAddress )
  48.              {
  49.             
  50.                  bReturn = TRUE;
  51.                  break;
  52.              }
  53.              ++pThunkData;
  54.         }
  55.         ++pImportDescriptor;
  56.     }

  58.     return bReturn;
  59. }

  61. PROC g_CreateFunc = NULL;

  63. typedef BOOL (WINAPI *PCreateProcessW)(
  64.                                      __in_opt LPCWSTR lpApplicationName,
  65.                                      __inout_opt LPWSTR lpCommandLine,
  66.                                      __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes,
  67.                                      __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes,
  68.                                      __in BOOL bInheritHandles,
  69.                                      __in DWORD dwCreationFlags,
  70.                                      __in_opt LPVOID lpEnvironment,
  71.                                      __in_opt LPCWSTR lpCurrentDirectory,
  72.                                      __in LPSTARTUPINFOW lpStartupInfo,
  73.                                      __out LPPROCESS_INFORMATION lpProcessInformation);

  75. BOOL WINAPI MyCreateProcessW(
  76.                              __in_opt LPCWSTR lpApplicationName,
  77.                              __inout_opt LPWSTR lpCommandLine,
  78.                              __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes,
  79.                              __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes,
  80.                              __in BOOL bInheritHandles,
  81.                              __in DWORD dwCreationFlags,
  82.                              __in_opt LPVOID lpEnvironment,
  83.                              __in_opt LPCWSTR lpCurrentDirectory,
  84.                              __in LPSTARTUPINFOW lpStartupInfo,
  85.                              __out LPPROCESS_INFORMATION lpProcessInformation)
  86. {

  88.     MessageBoxW(NULL, lpCommandLine, L"CreateProcessW", MB_OK);

  90.     return ((PCreateProcessW)g_CreateFunc)(
  91.         lpApplicationName,
  92.         lpCommandLine,
  93.         lpProcessAttributes,
  94.         lpThreadAttributes,
  95.         bInheritHandles,
  96.         dwCreationFlags,
  97.         lpEnvironment,
  98.         lpCurrentDirectory,
  99.         lpStartupInfo,
  100.         lpProcessInformation);
  101. }

  103. int _tmain(int argc, _TCHAR* argv[])
  104. {
  105.     HMODULE hModule = NULL;
  106.     GetModuleHandleEx(
  107.         GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS,
  108.         (LPCTSTR)TestFunctionInIAT,
  109.         &hModule);
  110.     BOOL bReturn = TestFunctionInIAT( hModule , (ULONG_PTR)CreateProcessW );
  111.     if ( bReturn )
  112.     {
  113.         printf("Found address CreateProcessW!\n");
  114.     }
  115.     else
  116.     {
  117.         printf("found failed!\n");
  118.     }

  120.     g_CreateFunc = install_api_hook(hModule, "kernel32.dll", (PROC)CreateProcessW, (PROC)MyCreateProcessW);
  121.     
  122.     wchar_t szProcessName[] = L"notepad.exe";
  123.     STARTUPINFO si = {sizeof(si)};
  124.     PROCESS_INFORMATION pi;
  125.     CreateProcessW(NULL,
  126.         szProcessName,
  127.         NULL,
  128.         NULL,
  129.         FALSE,
  130.         0,
  131.         NULL,
  132.         NULL,
  133.         &si,
  134.         &pi);

  136.     return 0;
  137. }

  139. PROC install_api_hook(
  140.                      HMODULE hHookModule,
  141.                      const char * szDllName,
  142.                      PROC pfnHookFunAddr,
  143.                      PROC pfnNewFundAddr
  144.                      )
  145. {
  146.     PROC pOrigFunc = NULL;

  148.     unsigned char *pBaseAddr =
  149.         reinterpret_cast<unsigned char *>(hHookModule);

  151.     PIMAGE_DOS_HEADER pDosHeader =
  152.         reinterpret_cast<PIMAGE_DOS_HEADER>(pBaseAddr);

  154.     PIMAGE_NT_HEADERS pNtHeader =
  155.         reinterpret_cast<PIMAGE_NT_HEADERS>(
  156.         pBaseAddr + pDosHeader->e_lfanew );

  158.     PIMAGE_OPTIONAL_HEADER pPEOptionHeader =
  159.         &pNtHeader->OptionalHeader;

  161.     PIMAGE_DATA_DIRECTORY pIATDataDirectory =
  162.         &(pPEOptionHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]);

  164.     PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor =
  165.         reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>(
  166.         pBaseAddr + pIATDataDirectory->VirtualAddress );

  168.     for ( ; pImportDescriptor->Name; pImportDescriptor++ )
  169.     {
  170.         const char* pszModName =
  171.             reinterpret_cast<const char*>(
  172.             pBaseAddr + pImportDescriptor->Name);
  173.         if ( 0 == lstrcmpiA( pszModName, szDllName ) )
  174.         {
  175.             break;
  176.         }
  177.     }

  179.     if ( 0 == pImportDescriptor->Name )
  180.     {
  181.         return pOrigFunc;
  182.     }

  184.     PIMAGE_THUNK_DATA pThunkData =
  185.         reinterpret_cast<PIMAGE_THUNK_DATA>(
  186.         pBaseAddr + pImportDescriptor->FirstThunk);
  187.     while( pThunkData->u1.Function != 0 )
  188.     {
  189.         PROC *ppFunc = reinterpret_cast<PROC*>(
  190.             &pThunkData->u1.Function);
  191.         if ( *ppFunc == pfnHookFunAddr )
  192.         {
  193.             DWORD dwOldProtect = 0;
  194.             VirtualProtect( ppFunc, sizeof(PROC), PAGE_READWRITE, &dwOldProtect );
  195.             
  196.             pOrigFunc = *ppFunc;
  197.             CopyMemory(ppFunc, &pfnNewFundAddr, sizeof(PROC));
  198. //            SIZE_T stMemorySize = 0;
  199. //             WriteProcessMemory(
  200. //                 GetCurrentProcess(),
  201. //                 ppFunc,
  202. //                 &uNewFundAddr,
  203. //                 sizeof(*ppFunc),
  204. //                 &stMemorySize);
  205.             VirtualProtect( ppFunc, sizeof(PROC), dwOldProtect, 0 );
  206.             break;
  207.         }
  208.     }

  210.     return pOrigFunc;    
  211. }
//demo3

  1. // JmpHook.cpp : Defines the entry point for the console application.
  2. //

  4. #include "stdafx.h"
  5. #include <windows.h>

  7. unsigned char g_StubCode[6] = {0x0};
  8. PROC g_CreateFunc = 0;
  9. void restore_hook(PROC pfnOrigAddr);
  10. void set_hook(PROC pfnOrigAddr, PROC pfnNewAddr );

  12. typedef BOOL (WINAPI *PCreateProcessW)(
  13.                                      __in_opt LPCWSTR lpApplicationName,
  14.                                      __inout_opt LPWSTR lpCommandLine,
  15.                                      __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes,
  16.                                      __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes,
  17.                                      __in BOOL bInheritHandles,
  18.                                      __in DWORD dwCreationFlags,
  19.                                      __in_opt LPVOID lpEnvironment,
  20.                                      __in_opt LPCWSTR lpCurrentDirectory,
  21.                                      __in LPSTARTUPINFOW lpStartupInfo,
  22.                                      __out LPPROCESS_INFORMATION lpProcessInformation);

  24. BOOL WINAPI MyCreateProcessW1(
  25.                              __in_opt LPCWSTR lpApplicationName,
  26.                              __inout_opt LPWSTR lpCommandLine,
  27.                              __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes,
  28.                              __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes,
  29.                              __in BOOL bInheritHandles,
  30.                              __in DWORD dwCreationFlags,
  31.                              __in_opt LPVOID lpEnvironment,
  32.                              __in_opt LPCWSTR lpCurrentDirectory,
  33.                              __in LPSTARTUPINFOW lpStartupInfo,
  34.                              __out LPPROCESS_INFORMATION lpProcessInformation)
  35. {

  37.     restore_hook(g_CreateFunc);

  39.     MessageBoxW(NULL, lpCommandLine, L"CreateProcessW", MB_OK);

  41.     BOOL bRetCode = ((PCreateProcessW)g_CreateFunc)(
  42.         lpApplicationName,
  43.         lpCommandLine,
  44.         lpProcessAttributes,
  45.         lpThreadAttributes,
  46.         bInheritHandles,
  47.         dwCreationFlags,
  48.         lpEnvironment,
  49.         lpCurrentDirectory,
  50.         lpStartupInfo,
  51.         lpProcessInformation);

  53.     set_hook(g_CreateFunc, (PROC)MyCreateProcessW1);

  55.     return bRetCode;
  56. }


  59. void set_hook(PROC pfnOrigAddr, PROC pfnNewAddr )
  60. {
  61.     unsigned char *pSrcAddr =
  62.         reinterpret_cast<unsigned char *>( pfnOrigAddr );

  64.     unsigned char *pDestAddr =
  65.         reinterpret_cast<unsigned char *>( pfnNewAddr );

  67.     ULONG uOperand = static_cast<ULONG>
  68.         ( pDestAddr - (pSrcAddr + 5) );

  70.     CopyMemory(g_StubCode, pSrcAddr, 5);

  72.     DWORD dwOldProtect = 0;
  73.     VirtualProtect( pSrcAddr, 5, PAGE_READWRITE, &dwOldProtect );

  75.     unsigned char szJMPCode[5] = {0xE9};
  76.     CopyMemory(&szJMPCode[1], &uOperand, 4);
  77.     CopyMemory(pSrcAddr, szJMPCode, 5 );

  79.     VirtualProtect( pSrcAddr, 5, dwOldProtect, NULL );
  80. }

  82. void restore_hook(PROC pfnOrigAddr)
  83. {
  84.     unsigned char *pSrcAddr =
  85.         reinterpret_cast<unsigned char *>( pfnOrigAddr );
  86.     DWORD dwOldProtect = 0;
  87.     VirtualProtect( pSrcAddr, 5, PAGE_READWRITE, &dwOldProtect );
  88.     CopyMemory(pSrcAddr, g_StubCode, 5);
  89.     VirtualProtect( pSrcAddr, 5, dwOldProtect, NULL );
  90. }

  92. int _tmain(int argc, _TCHAR* argv[])
  93. {
  94.     g_CreateFunc = GetProcAddress(GetModuleHandle(L"kernel32.dll"),"CreateProcessW");
  95.     
  96.     set_hook(g_CreateFunc, (PROC)MyCreateProcessW1);
  97.     wchar_t szProcessName[] = L"notepad.exe";
  98.     STARTUPINFO si = {sizeof(si)};
  99.     PROCESS_INFORMATION pi;
  100.     CreateProcessW(NULL,
  101.         szProcessName,
  102.         NULL,
  103.         NULL,
  104.         FALSE,
  105.         0,
  106.         NULL,
  107.         NULL,
  108.         &si,
  109.         &pi);

  111.     return 0;
  112. }

阅读(911) | 评论(0) | 转发(0) |
0

上一篇： Run-Time Check Failure #2 - Stack around the variable

下一篇：Detours vs. Mhook

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6