我正在学习为 Windows API 编写 Hook ,为了练习,我正在为 pDeleteFileA 函数编写 Hook 。当调用该函数时,在删除文件之前我想检查文件名是否为“testfile.txt”,如果是,则不会删除它,而是会弹出一条消息,如果它调用了其他内容,则继续删除文件。
我已经编写了一些代码并且代码编译没有任何错误,但是当我尝试删除“testfile.txt”时,它只是被删除了。也许有人可以给我提示我做错了什么或没有做什么?
到目前为止,这是我的代码:
#include <Windows.h>
struct hook_t{// a datatype to store information about our hook
bool isHooked = false;
void* FunctionAddress = operator new(100);
void* HookAddress = operator new(100);
char Jmp[6] = { 0 };
char OriginalBytes[6] = {0};
void* OriginalFunction = operator new(100);
};
namespace hook {
bool InitializeHook(hook_t* Hook, char* Module, char* Function, void* HookFunction) {
HMODULE hModule;
DWORD OrigFunc, FuncAddr;
byte opcodes[] = {0x90, 0x90, 0x90, 0x90, 0x90, 0xe9, 0x00, 0x00, 0x00, 0x00};
if (Hook->isHooked) {
return false;
}
hModule = GetModuleHandleA(Module);
if (hModule == INVALID_HANDLE_VALUE) {
Hook->isHooked = false;
return false;
}
Hook->Jmp[0] = 0xe9;
*(PULONG)&Hook->Jmp[1] = (ULONG)HookFunction - (ULONG)Hook->FunctionAddress - 5;
memcpy(Hook->OriginalBytes, Hook->FunctionAddress, 5);
Hook->OriginalFunction = VirtualAlloc(0, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (Hook->OriginalFunction == NULL) {
return false;
}
memcpy(Hook->OriginalFunction, Hook->OriginalBytes, 5);
OrigFunc = (ULONG)Hook->OriginalFunction + 5;
FuncAddr = (ULONG)Hook->OriginalFunction + 5;
*(LPBYTE)((LPBYTE)Hook->OriginalFunction + 5) = 0xe9;
*(PULONG)((LPBYTE)Hook->OriginalFunction + 6) = (ULONG)FuncAddr;
Hook->isHooked = true;
return true;
}//end InitializeHook
bool InsertHook(hook_t* Hook) {
DWORD op;
if (!Hook->isHooked) {
return false;
}
VirtualProtect(Hook->FunctionAddress, 5, PAGE_EXECUTE_READWRITE, &op);
memcpy(Hook->FunctionAddress, Hook->Jmp, 5);
VirtualProtect(Hook->FunctionAddress, 5, op, &op);
return true;
}
bool Unhook(hook_t* Hook) {
DWORD op;
if (!Hook->isHooked) {
return false;
}
VirtualProtect(Hook->FunctionAddress, 5, PAGE_EXECUTE_READWRITE, &op);
memcpy(Hook->FunctionAddress, Hook->OriginalBytes, 5);
VirtualProtect(Hook->FunctionAddress, 5, op, &op);
Hook->isHooked = false;
return true;
}
bool FreeHook(hook_t* Hook) {
if (Hook->isHooked) {
return false;
}
VirtualFree(Hook->OriginalFunction, 0, MEM_RELEASE);
memset(Hook, 0, sizeof(hook_t*));
return true;
}
}//end namespase
==========================================================================
#define _CRT_SECURE_NO_WARNINGS
#include "apihook.h"
#include <stdlib.h>
#include <stdio.h>
#include <iostream>
using namespace hook;
//define the function to be hooked
typedef BOOL(WINAPI* pDeleteFileA)(LPCSTR lpFileName);//in this case this will be delete file a
pDeleteFileA pDeleteFile;//instance of it
hook_t* Hook = new hook_t();
//this function will replace the original API function in the process
BOOL WINAPI HookDeleteFileA(LPCSTR lpFileName) {
//we can do here whatever we want before the original API function is called
//for example disable deleting of a certain file
if (strstr(lpFileName, "testfile")) {//checks if parameter contains a string
//disable deleting of this file
SetLastError(ERROR_ACCESS_DENIED);
MessageBoxA(0, "You can't delete this file!", "error", 0);
return false;
}
return pDeleteFile(lpFileName);//if parameter does not contain our string, call the original API function
}
void StartRoutine() {
pDeleteFile = (pDeleteFileA)&Hook->OriginalFunction;
//the pDeleteFileA is located in "kernel32.dll"
InitializeHook(Hook, "kernel32.dll", "DeleteFileA", HookDeleteFileA);
InsertHook(Hook);//spawn the hook to the current process
}
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved) {
switch (dwReason) {
case DLL_PROCESS_ATTACH:
printf("API Hook Attached!");//notify
StartRoutine();
break;
case DLL_PROCESS_DETACH:
Unhook(Hook);//unhook the hook
FreeHook(Hook);//remove the hook from memory
}
}
int main() {
HMODULE hModule = GetModuleHandleA("kernel32.dll");
//The reason code that indicates why the DLL entry-point function is being called.
//This parameter can be one of the following values:
//DLL_PROCESS_ATTACH 1:
//The DLL is being loaded into the virtual address space of the current process
//as a result of the process starting up or as a result of a call to LoadLibrary.
//DLL_PROCESS_DETACH 0:
//The DLL is being unloaded from the virtual address space of the calling process
//because it was loaded unsuccessfully or the reference count has reached zero
//(the processes has either terminated or called FreeLibrary one time for each time it called LoadLibrary).
DWORD dwReason = DLL_PROCESS_ATTACH;
//If fdwReason is DLL_PROCESS_ATTACH, lpvReserved is NULL for dynamic loads and non-NULL for static loads
//If fdwReason is DLL_PROCESS_DETACH, lpvReserved is NULL if FreeLibrary has been called or the DLL load
//failed and non-NULL if the process is terminating.
LPVOID lpReserved = NULL;
DllMain(hModule, dwReason, lpReserved);
return 0;
}
最佳答案
每个进程都有自己的地址空间。
每个进程单独加载它的 DLL 并有单独的内存。因此,如果您尝试覆盖内存 - 您只是覆盖了加载到您的进程中的 DLL 拷贝。这样做是出于稳定性和安全原因。
要在另一个进程中写入内存并执行代码 - 你需要使用 DLL Injection , wiki 对场景和方法有很好的概述。
因此您需要将您的代码放入DLL 中,然后将此DLL 加载到目标进程中。然后你的 DLL 在它的 DLLMain 中将覆盖这个过程的函数(钩子(Hook)代码)。这也意味着 Hook 代码将在 Hook 进程的上下文中运行,因此 MessageBox 或 printf 可能无法按预期工作。
另外,我强烈建议使用带有远程调试或 VM 的第二台 PC,因为 Hook 系统进程可能会导致不稳定。
编辑:更多注释。您正在尝试 Hook DeleteFileA
,它是 ASCII 版本,较新的软件将改用 DeleteFileW
。
Edit2:您也不能将 32 位 DLL 加载到 64 位进程中,反之亦然。
关于c++ - Windows API 钩子(Hook) C++,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/36664116/