Chinaunix首页 | 论坛 | 博客

毛毛的ChinaUnix博客

首页　| 　博文目录　| 　关于我

zyicai

  • 博客访问： 24680
  • 博文数量： 14
  • 博客积分： 0
  • 博客等级： 民兵
  • 技术积分： 10
  • 用 户 组： 普通用户
  • 注册时间： 2014-03-28 18:06
文章分类

全部博文（14）

文章存档

2017年（2）

2016年（5）

2015年（6）

2014年（1）

我的朋友
最近访客
推荐博文
相关博文
[windows平台] HOOK 系统 API

分类： WINDOWS

2016-11-10 16:51:27

原文地址：[windows平台] HOOK 系统 API 作者：_kevin_lee

这里只把我的视线作为一个例子来说明一下, 读者用自己的方法去实现也没问题.
关于如何把自己的DLL导入到指定的进程，请参考我的另一篇博文[windows平台] 给进程注入代码 -- 导入DLL到指定进程的地址空间
1. DLL 入口函数的相关逻辑
在DLL加载的时候HOOK所有我们希望追踪的系统API.
在DLL卸载的时候取消所有的HOOK.
  1. #include "hooksTable.h"
  2. BOOL APIENTRY DllMain( HMODULE hModule,
  3.                        DWORD ul_reason_for_call,
  4.                        LPVOID lpReserved
  5.                      )
  6. {
  7.     switch (ul_reason_for_call)
  8.     {
  9.     case DLL_PROCESS_ATTACH:
  10.         {
  11.             // 挂钩系统API.
  12.             ReplaceIATEntryInCurrentModules();
  13.         } break;
  14.     case DLL_THREAD_ATTACH:
  15.     case DLL_THREAD_DETACH:
  16.         break;
  17.     case DLL_PROCESS_DETACH:
  18.         {
  19.             // 还原系统API.
  20.             ReplaceIATEntryInCurrentModules(true);
  21.         } break;
  22.     }
  23.     return TRUE;
  24. }
2. HOOK的API列表管理. 
2.1. 对外接口 hooksTable.h
GetHookData ==>> 访问被HOOK系统API的相关数据
ReplaceIATEntryInMoudule ==>> 在指定模块中 HOOK 系统 API
ReplaceIATEntryInCurrentModules ==>> 在所有模块中 HOOK 系统 API
  1. #pragma once

  3. #include <string>
  4. #include "windows.h"

  6. ///////////////////////////////////////////////////////////////////
  7. ///////////// Data Structure Define Begin./////////////////

  9. struct HookData{
  10.     std::string nameDLL;
  11.     std::string nameAPI;
  12.     FARPROC originalAPI;
  13.     HookData(){}
  14.     HookData(std::string dll,std::string API);
  15. };

  17. // As a key. Reference to 'HookData'.
  18. typedef void * NewEntryFunc;

  20. //////////// Data Structure Define End.////////////////////
  21. ///////////////////////////////////////////////////////////////////

  23. ///////////////////////////////////////////////////////////////////
  24. /////////// Interfaces Define Begin.///////////////////////

  26. HookData * GetHookData(NewEntryFunc pHookFunc);
  27. void ReplaceIATEntryInMoudule(HMODULE hMoudule);
  28. void ReplaceIATEntryInCurrentModules(bool bIsRestoreBack = false);

  30. ////////////// Interfaces Define End.//////////////////////
  31. ///////////////////////////////////////////////////////////////////
2.2. 内部实现 hooksTable.cpp
HOOK 表格数据的初始化会在全局变量 g_mapHooksTable 的初始化中完成.
  1. #include "hooksTable.h"
  2. #include "ApiHooks.h"

  4. #include <map>
  5. #include <string>
  6. #include <cstdio>

  8. #include "Tlhelp32.h"
  9. #include "imagehlp.h"
  10. #pragma comment(lib, "ImageHlp")

  12. ///////////////////////////////////////////////////////////////////
  13. ///////////// Data Structure Implementation Begin./////////////////

  15. HookData::HookData(std::string dll,std::string API) : nameDLL(dll),nameAPI(API),originalAPI(NULL)
  16. {
  17.  HMODULE hModule = GetModuleHandleA(nameDLL.c_str());
  18.  if ( ! hModule ) hModule = LoadLibraryA(nameDLL.c_str());
  19.  if ( hModule ) originalAPI = GetProcAddress(hModule,nameAPI.c_str());
  20.  else
  21.  {
  22.      _ASSERTE( ! "LoadLibraryA failed !" );
  23.  }
  24. }

  26. struct MapHooks : public std::map<NewEntryFunc,HookData>
  27. {
  28.     MapHooks()
  29.     {
  30.         insert( std::make_pair( MyLoadLibraryW ,HookData( "Kernel32.dll","LoadLibraryW" ) ) );
  31.         insert( std::make_pair( MyLoadLibraryA ,HookData( "Kernel32.dll","LoadLibraryA" ) ) );
  32.         insert( std::make_pair( MyLoadLibraryExA ,HookData( "Kernel32.dll","LoadLibraryExA" ) ) );
  33.         insert( std::make_pair( MyLoadLibraryExW ,HookData( "Kernel32.dll","LoadLibraryExW" ) ) );
  34.         insert( std::make_pair( MyFreeLibrary ,HookData( "Kernel32.dll","FreeLibrary" ) ) );
  35.         insert( std::make_pair( MyFreeLibraryAndExitThread ,HookData( "Kernel32.dll","FreeLibraryAndExitThread" ) ) );
  36.         
  37.         // TODO. Add the APIs we want to hook here. Take 'ExitProcess' for example.
  38.         insert( std::make_pair( MyExitProcess ,HookData( "Kernel32.dll","ExitProcess" ) ) );
  39.     }

  41. } g_mapHooksTable;

  43. //////////// Data Structure Implementation End.////////////////////
  44. ///////////////////////////////////////////////////////////////////

  46. ///////////////////////////////////////////////////////////////////
  47. /////////// Interfaces Implementation Begin.///////////////////////

  49. HookData * GetHookData(NewEntryFunc pHookFunc)
  50. {
  51.     MapHooks::iterator it = g_mapHooksTable.find(pHookFunc);
  52.     if ( it != g_mapHooksTable.end() )
  53.         return &(it->second);
  54.     return NULL;
  55. }

  57. void ReplaceIATEntryInOneMod(const char * pszCalleeModName, FARPROC pfnCurrent, FARPROC pfnNew, HMODULE hMoudule)
  58. {
  59.     // Step 1. Get the base address.
  60.     PVOID addressBase = (PVOID)hMoudule;

  62.     // Step 2. Get the address of the module's import section
  63.     PIMAGE_IMPORT_DESCRIPTOR pImportDesc = NULL;
  64.     __try {
  65.         ULONG ulSize;
  66.         pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR) ImageDirectoryEntryToData(
  67.             addressBase, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize);
  68.     } __except (EXCEPTION_EXECUTE_HANDLER) { }

  70.     if (pImportDesc == NULL)
  71.         return; // This module has no import section or is no longer loaded

  73.     // Find the import descriptor containing references to callee's functions
  74.     for (; pImportDesc->Name; pImportDesc++)
  75.     {
  76.         PSTR pszModName = (PSTR) ((PBYTE) addressBase + pImportDesc->Name);
  77.         if (lstrcmpiA(pszModName, pszCalleeModName) != 0) continue ;

  79.         // Get caller's import address table (IAT) for the callee's functions
  80.         PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)
  81.             ((PBYTE) addressBase + pImportDesc->FirstThunk);

  83.         FARPROC* ppfn = NULL;
  84.         // Get the address of the function address
  85.         for (; pThunk->u1.Function; pThunk++)
  86.         {
  87.             FARPROC* ppfnTmp = (FARPROC*)&pThunk->u1.Function;
  88.             if ( *ppfnTmp == pfnCurrent )
  89.                 ppfn = ppfnTmp;
  90.         }
  91.         if (ppfn == NULL) continue ;

  93.         // Replace current function address with new function address
  94.         if ( !WriteProcessMemory(GetCurrentProcess(), ppfn, &pfnNew,
  95.             sizeof(pfnNew), NULL) && (ERROR_NOACCESS == GetLastError()) )
  96.         {
  97.             DWORD dwOldProtect;
  98.             if (VirtualProtect(ppfn, sizeof(pfnNew), PAGE_WRITECOPY, &dwOldProtect))
  99.             {
  100.                 WriteProcessMemory(GetCurrentProcess(), ppfn, &pfnNew,
  101.                     sizeof(pfnNew), NULL);
  102.                 VirtualProtect(ppfn, sizeof(pfnNew), dwOldProtect,
  103.                     &dwOldProtect);
  104.             }
  105.         }
  106.         return; // We did it, get out
  107.     }
  108. }

  110. void ReplaceIATEntryInMoudule(HMODULE hMoudule)
  111. {
  112.     MapHooks::iterator it = g_mapHooksTable.begin();
  113.     for ( ; it != g_mapHooksTable.end(); ++it )
  114.     {
  115.         FARPROC funcHook = (FARPROC)it->first;
  116.         const char* nameDll = it->second.nameDLL.c_str();
  117.         FARPROC funcOrig = it->second.originalAPI;
  118.         ReplaceIATEntryInOneMod(nameDll,funcHook,funcOrig,hMoudule);
  119.     }
  120. }

  122. void ReplaceIATEntryInCurrentModules(bool bIsRestoreBack)
  123. {
  124.     MEMORY_BASIC_INFORMATION mbi;
  125.     HMODULE hmodThisMod = ((VirtualQuery(ReplaceIATEntryInCurrentModules, &mbi, sizeof(mbi)) != 0)
  126.         ? (HMODULE) mbi.AllocationBase : NULL);

  128.     HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId());
  129.     MODULEENTRY32 me = { sizeof(me) };
  130.     Module32First(hSnapshot,&me);
  131.     do {
  132.         // NOTE: We don't hook functions in our own module
  133.         if (me.hModule != hmodThisMod) {
  134.             MapHooks::iterator it = g_mapHooksTable.begin();
  135.             for ( ; it != g_mapHooksTable.end(); ++it )
  136.             {
  137.                 FARPROC funcHook = (FARPROC)it->first;
  138.                 const char* nameDll = it->second.nameDLL.c_str();
  139.                 FARPROC funcOrig = GetProcAddress(GetModuleHandleA(nameDll),it->second.nameAPI.c_str());
  140.                 if ( bIsRestoreBack )
  141.                     ReplaceIATEntryInOneMod(nameDll,funcHook,funcOrig,me.hModule);
  142.                 else
  143.                     ReplaceIATEntryInOneMod(nameDll,funcOrig,funcHook,me.hModule);
  144.             }
  145.         }
  146.     }while (Module32Next(hSnapshot,&me));
  147. }

  149. ////////////// Interfaces Implementation End.//////////////////////
  150. ///////////////////////////////////////////////////////////////////
3. 具体要HOOK的系统API的实现代码
除了加载模块和卸载模块的部分, 其他部分没什么特别的意思.
3.1. 头文件明细 ApiHooks.h
  1. #pragma once

  3. HMODULE WINAPI MyLoadLibraryW(LPCWSTR lpLibFileName);
  4. HMODULE WINAPI MyLoadLibraryA(LPCSTR lpLibFileName);
  5. HMODULE WINAPI MyLoadLibraryExA(LPCSTR lpLibFileName,HANDLE hFile,DWORD dwFlags);
  6. HMODULE WINAPI MyLoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile,DWORD dwFlags);
  7. BOOL WINAPI MyFreeLibrary(HMODULE hLibModule);
  8. VOID WINAPI MyFreeLibraryAndExitThread (HMODULE hLibModule,DWORD dwExitCode);

  10. VOID WINAPI MyExitProcess( UINT uExitCode );
3.2. 具体实现 ApiHooks.cpp
  1. #include "stdafx.h"
  2. #include "hooksTable.h"

  4. HMODULE WINAPI MyLoadLibraryW(LPCWSTR lpLibFileName)
  5. {
  6.     //MessageBoxA(NULL,"MyLoadLibraryW","MyLoadLibraryW",0);
  7.     HookData * pHookData = GetHookData(MyLoadLibraryW);
  8.     if ( ! pHookData )
  9.     {
  10.         _ASSERTE( ! "the MyLoadLibraryW has no original API on table g_mapHooksTable!" );
  11.         return NULL;
  12.     }

  14.     // Step 1. Load the module into memory.
  15.     typedef HMODULE (WINAPI *PtrMyApiFunction)(LPCWSTR);
  16.     PtrMyApiFunction funOrig = (PtrMyApiFunction)(pHookData->originalAPI);

  18.     HMODULE hModule = funOrig(lpLibFileName);

  20.     // Step 2. Hook the APIs on this moudle.
  21.     ReplaceIATEntryInCurrentModules();

  23.     return hModule;
  24. }

  26. HMODULE WINAPI MyLoadLibraryA(LPCSTR lpLibFileName)
  27. {
  28.     //MessageBoxA(NULL,"MyLoadLibraryA","MyLoadLibraryA",0);
  29.     HookData * pHookData = GetHookData(MyLoadLibraryA);
  30.     if ( ! pHookData )
  31.     {
  32.         _ASSERTE( ! "the MyLoadLibraryA has no original API on table g_mapHooksTable!" );
  33.         return NULL;
  34.     }

  36.     // Step 1. Load the module into memory.
  37.     typedef HMODULE (WINAPI *PtrMyApiFunction)(LPCSTR);
  38.     PtrMyApiFunction funOrig = (PtrMyApiFunction)(pHookData->originalAPI);

  40.     HMODULE hModule = funOrig(lpLibFileName);

  42.     // Step 2. Hook the APIs on this moudle.
  43.     ReplaceIATEntryInCurrentModules();

  45.     return hModule;
  46. }

  48. HMODULE WINAPI MyLoadLibraryExA
  49. (LPCSTR lpLibFileName,HANDLE hFile,DWORD dwFlags)
  50. {
  51.     //MessageBoxA(NULL,"","",0);
  52.     HookData * pHookData = GetHookData(MyLoadLibraryExA);
  53.     if ( ! pHookData )
  54.     {
  55.         _ASSERTE( ! "the MyLoadLibraryExA has no original API on table g_mapHooksTable!" );
  56.         return NULL;
  57.     }

  59.     // Step 1. Load the module into memory.
  60.     typedef HMODULE (WINAPI *PtrMyApiFunction)(LPCSTR, HANDLE,DWORD);
  61.     PtrMyApiFunction funOrig = (PtrMyApiFunction)(pHookData->originalAPI);

  63.     HMODULE hModule = funOrig(lpLibFileName,hFile,dwFlags);

  65.     // Step 2. Hook the APIs on this moudle.
  66.     ReplaceIATEntryInCurrentModules();

  68.     return hModule;
  69. }

  71. HMODULE WINAPI MyLoadLibraryExW
  72. (LPCWSTR lpLibFileName, HANDLE hFile,DWORD dwFlags)
  73. {
  74.     // MessageBoxA(NULL,"","",0);
  75.     HookData * pHookData = GetHookData(MyLoadLibraryExW);
  76.     if ( ! pHookData )
  77.     {
  78.         _ASSERTE( ! "the MyLoadLibraryExW has no original API on table g_mapHooksTable!" );
  79.         return NULL;
  80.     }

  82.     // Step 1. Load the module into memory.
  83.     typedef HMODULE (WINAPI *PtrMyApiFunction)(LPCWSTR, HANDLE,DWORD);
  84.     PtrMyApiFunction funOrig = (PtrMyApiFunction)(pHookData->originalAPI);

  86.     HMODULE hModule = funOrig(lpLibFileName,hFile,dwFlags);

  88.     // Step 2. Hook the APIs on this moudle.
  89.     ReplaceIATEntryInCurrentModules();

  91.     return hModule;
  92. }

  94. BOOL WINAPI MyFreeLibrary(HMODULE hLibModule)
  95. {
  96.     // MessageBoxA(NULL,"MyFreeLibrary","MyFreeLibrary",0);
  97.     // Step 1. Restore the APIs on the current moudle.
  98.     ReplaceIATEntryInMoudule(hLibModule);

  100.     // Step 2. Unload the module out of memory.
  101.     HookData * pHookData = GetHookData(MyFreeLibrary);
  102.     if ( ! pHookData )
  103.     {
  104.         _ASSERTE( ! "the MyFreeLibrary has no original API on table g_mapHooksTable!" );
  105.         return FALSE;
  106.     }

  108.     typedef BOOL (WINAPI *PtrMyApiFunction)(HMODULE);
  109.     PtrMyApiFunction funOrig = (PtrMyApiFunction)(pHookData->originalAPI);

  111.     return funOrig(hLibModule);
  112. }

  114. VOID WINAPI MyFreeLibraryAndExitThread (HMODULE hLibModule,DWORD dwExitCode)
  115. {
  116.     //MessageBoxA(NULL,"MyFreeLibraryAndExitThread","MyFreeLibraryAndExitThread",0);
  117.     // Step 1. Restore the APIs on the current moudle.
  118.     ReplaceIATEntryInMoudule(hLibModule);

  120.     // Step 2. Unload the module out of memory.
  121.     HookData * pHookData = GetHookData(MyFreeLibraryAndExitThread);
  122.     if ( ! pHookData )
  123.     {
  124.         _ASSERTE( ! "the MyFreeLibrary has no original API on table g_mapHooksTable!" );
  125.         return ;
  126.     }

  128.     typedef BOOL (WINAPI *PtrMyApiFunction)(HMODULE,DWORD);
  129.     PtrMyApiFunction funOrig = (PtrMyApiFunction)(pHookData->originalAPI);

  131.     funOrig(hLibModule,dwExitCode);
  132. }

  134. VOID WINAPI MyExitProcess( __in UINT uExitCode )
  135. {
  136.     MessageBoxA(NULL,"MyExitProcess","MyExitProcess",0);

  138.     HookData * pHookData = GetHookData(MyExitProcess);
  139.     if ( ! pHookData )
  140.     {
  141.         _ASSERTE( ! "the MyExitProcess has no original API on table g_mapHooksTable!" );
  142.         return ;
  143.     }

  145.     typedef VOID (WINAPI *PtrMyApiFunction)(UINT);
  146.     PtrMyApiFunction funOrig = (PtrMyApiFunction)(pHookData->originalAPI);

  148.     funOrig(uExitCode);
  149. }

阅读(596) | 评论(0) | 转发(0) |
0

上一篇：[windows平台] Windows内存管理的API函数

下一篇：[windows平台] 给进程注入代码 -- 导入DLL到指定进程的地址空间

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6