Windows下的函數(shù)hook技術(shù)

Windows下的函數(shù)hook技術(shù)都是很成熟的東西了，這幾天看了看，總結(jié)一下而已。討論了Windows下hook函數(shù)的幾種方法。提供了一個hookTextOutA的完整例子。通過CreateRemoteThread的方法把hookdll注入到一個普通的應(yīng)用程序中。HookingImportedFunctionsbyname調(diào)用importedfunctions'時的步驟/實(shí)現(xiàn)在程序中調(diào)用從其它模塊引入的函數(shù)的方法和普通的函數(shù)調(diào)用有所不同。對于普通的函數(shù)調(diào)用，直接使用calladdress來調(diào)用即可，但是對于importedfunctions，在編譯的時候compiler/link并不知道實(shí)際的函數(shù)實(shí)現(xiàn)會被加載到那個地址，函數(shù)實(shí)現(xiàn)在那個地址在運(yùn)行的時候才會確定。對于importedfunctions，首先是call引入表中的一個函數(shù)，在運(yùn)行時再初始化引入表，使用jmp跳轉(zhuǎn)到真實(shí)的函數(shù)實(shí)現(xiàn)。引入表：

ThePEfileIMAGE_IMPORT_DESCRIPTORstructure,whichholdsalltheinformationaboutfunctionsimportedfromaspecificDLL,haspointerstotwoarraysintheexecutable.Thesearraysarecalledimportaddresstables(IATs),orsometimesthunkdataarrays.ThefirstpointerreferencestherealIAT,whichtheprogramloaderfixesupwhentheexecutableisloaded.ThesecondpointerreferencestheoriginalIAT,whichisuntouchedbytheloaderandliststheimportedfunctions.實(shí)現(xiàn)原理找到PE文件的Image_Import_Descriptor結(jié)構(gòu)找到OriginalLAT和RealLAT.通過要hook的函數(shù)的名字在OriginalLAT找到要hook的importedfunction在數(shù)組中的index.保存并修改RealLAT在相應(yīng)index的functionaddress(refertoJohnRobbins,BugsLayerUtil.dll)HookingImportedFunctionsbyordinal原理和HookImportedfunctionsbyname一樣，只是是通過要hook的函數(shù)的ordinal在originalLAT中找到index.Hookingafunctioninthisdll

當(dāng)一個DLL是通過LoadLibrary載入的時候，我們無法通過hookimportedfunction的方法的hook它中的function

。有兩種可能的辦法處理這種情況：

第一種方法，遍歷進(jìn)程空間，發(fā)現(xiàn)call指定函數(shù)的地方替換為callhookFunction.太麻煩，而且不安全。

第二種方法，改寫要hook的函數(shù)FuncA

。比較好的方法實(shí)現(xiàn)HookFuncA，最后的實(shí)現(xiàn)墊入n個nop.找到要hook的函數(shù)FuncA的絕對地址，改寫前5個字節(jié)為jmphookFuncA(假定前5個字節(jié)為n個完整的指令)把FuncA的前5個字節(jié)拷貝到hookFuncA的后面，在加上一條指令jmpfuncA+5.

CodeofHookDLL.dll,可以通過CreateRemoteThread的方法把hookdll注入到一個普通的應(yīng)用程序中。//HookDLL.cpp:DefinestheentrypointfortheDLLapplication.

//

#include"stdafx.h"

#include"HookDLL.h"

#include"Log.h"

//forwarddeclare.

LRESULTWINAPIInstallTextoutHook();

LRESULTWINAPIUninstallTextoutHook();

BOOLAPIENTRYDllMain(HANDLEhModule,

DWORDul_reason_for_call,

LPVOIDlpReserved

)

{

switch(ul_reason_for_call)

{

caseDLL_PROCESS_ATTACH:

if(InstallTextoutHook())

{

WriteLog("Installhooksuccess.\n");

}else

{

WriteLog("Intallhookfailed.\n");

}

break;

caseDLL_THREAD_ATTACH:

break;

caseDLL_THREAD_DETACH:

break;

caseDLL_PROCESS_DETACH:

if(UninstallTextoutHook())

{

WriteLog("Uninstallhooksuccess.\n");

}else

{

WriteLog("Unintallhookfailed.\n");

}

break;

}

returnTRUE;

}

#defineDWORD_PTRDWORD*

#define__LOCAL_SIZE40h

#defineNAKED_PROLOG()\

DWORD_PTRdwRet;\

DWORD_PTRdwESI;\

{\

__asmPUSHEBP/*Setupthestandardframe.*/\

__asmMOVEBP,ESP\

__asmSUBESP,__LOCAL_SIZE/*Saveroomforthelocal*/\

/*variables.*/\

__asmMOVEAX,EBP/*EBPhasthestackcoming*/\

/*intothefn.init.*/\

__asmADDEAX,4/*AccountforPUSHEBP*/\

__asmMOVEAX,[EAX]/*Getreturnaddress.*/\

__asmMOV[dwRet],EAX/*Savereturnaddress.*/\

__asmMOV[dwESI],ESI/*SaveESIsochkespindbg*/\

/*buildsworks.*/\

}//Thecommonepilogpartthatcanbesharedbetweenthestdcalland

//cdeclhookfunctions.

#defineEPILOG_COMMON()\

{\

__asmMOVESI,[dwESI]/*RestoreESI.*/\

__asmADDESP,__LOCAL_SIZE/*Takeawaylocalvarspace*/\

__asmMOVESP,EBP/*Restorestandardframe.*/\

__asmPOPEBP\

}

#defineCOPY_CODE_LENGTH5

BYTEg_abOriCode[COPY_CODE_LENGTH];

BYTEg_abJmpCode[COPY_CODE_LENGTH];

PROCg_oriTextout;

BOOLg_blHooked=FALSE;

LRESULTWINAPIInstallTextoutHook()

{

if(g_blHooked)

returnTRUE;

//GetTextOutA'saddress.

HMODULEhGdi32=::LoadLibrary(_T("Gdi32.dll"));

g_oriTextout=GetProcAddress(hGdi32,_T("TextOutA"));

if(NULL==g_oriTextout)

returnFALSE;

//Getthehook'aaddress.

HMODULEhModule=GetModuleHandle(_T("HookDLL.dll"));

if(NULL==hModule)

returnFALSE;

DWORDdwHookAddr=NULL;

__asm

{

movesi,offsetHookLabel;

movedi,0x10000000;//0x10000000isthedll'sbaseaddress.

subesi,edi;

addesi,hModule;

mov[dwHookAddr],esi;

}

//GettheNOP'saddress.

DWORDdwNOPAddr=NULL;

__asm

{

movesi,offsetNOPLabel;

movedi,0x10000000;//0x10000000isthedll'sbaseaddress.

subesi,edi;

addesi,hModule;

mov[dwNOPAddr],esi;

}

//Savethefirst5byteofTextOutAtog_abOriCode

__asm

{

movesi,g_oriTextout;

leaedi,g_abOriCode;

cld;

movsd;

movsb;

}

//GeneratethejmpHookfunction.

g_abJmpCode[0]=0xe9;

__asm

{

moveax,dwHookAddr;

movebx,g_oriTextout;

addebx,5;

subeax,ebx;

movdwordptr[g_abJmpCode+1],eax;

}

//WritethejumpinstructiontothetextoutA.

DWORDdwProcessId=GetCurrentProcessId();

HANDLEhProcess=OpenProcess(PROCESS_ALL_ACCESS,

FALSE,dwProcessId);

if(NULL==hProcess)

returnFALSE;

DWORDdwOldFlag;

VirtualProtectEx(hProcess,g_oriTextout,5,PAGE_READWRITE,&dwOldFlag);

WriteProcessMemory(hProcess,g_oriTextout,g_abJmpCode,sizeof(g_abJmpCode),NULL);

VirtualProtectEx(hProcess,g_oriTextout,5,dwOldFlag,NULL);

//Writeg_abOriTextouttotheendofHookfunction(NOPaddr),thenwritethejmpinstruction.

VirtualProtectEx(hProcess,(LPVOID)dwNOPAddr,10,PAGE_READWRITE,&dwOldFlag);

WriteProcessMemory(hProcess,(LPVOID)dwNOPAddr,g_abOriCode,sizeof(g_abOriCode),NULL);

//GeneratethejmpTextoutA+5

__asm

{

moveax,g_oriTextout;

movebx,dwNOPAddr;

addebx,5;

subeax,ebx;

movdwordptr[g_abJmpCode+1],eax;

}

WriteProcessMemory(hProcess,(LPVOID)(dwNOPAddr+5),g_abJmpCode,sizeof(g_abJmpCode),NULL);

VirtualProtectEx(hProcess,(LPVOID)dwNOPAddr,10,dwOldFlag,NULL);

g_blHooked=TRUE;

if(TRUE)

returnTRUE;

HookLabel:

NAKED_PROLOG();

intnx,ny;

LPCSTRlp;

lp=NULL;

_asm

{

movesi,ebp;

addesi,0Ch;

leaedi,nx;

movsd;

leaedi,ny;

movsd;

leaedi,lp;

movsd;

}

WriteLog_F("Trytoouput\"%s\"at(%d,%d)\n",lp,nx,ny);

//Dothecommonepilog.

EPILOG_COMMON();

NOPLabel:

_asmNO