win原理Day006.zip

TestDll

  1. // dllmain.cpp : 定义 DLL 应用程序的入口点。
  2. #include "stdafx.h"
  3. #include <windows.h>
  5. BOOL APIENTRY DllMain( HMODULE hModule,
  6.                        DWORD  ul_reason_for_call,
  7.                        LPVOID lpReserved
  8.                      )
  9. {
  10.     switch (ul_reason_for_call)
  11.     {
  12.     case DLL_PROCESS_ATTACH:
  13.         MessageBox(0, L"注入成功", L"good", 0);
  14.     case DLL_THREAD_ATTACH:
  15.     case DLL_THREAD_DETACH:
  16.     case DLL_PROCESS_DETACH:
  17.         break;
  18.     }
  19.     return TRUE;
  20. }

消息钩子

消息钩子DLL

  1. // dllmain.cpp : 定义 DLL 应用程序的入口点。
  2. #include "stdafx.h"
  3. #include <windows.h>
  4. #include <stdlib.h>
  5. #include <stdio.h>
  7. HHOOK g_hook;
  8. HMODULE g_mod;
  10. LRESULT CALLBACK KeyboardProc(
  11.     _In_  int code,
  12.     _In_  WPARAM wParam,
  13.     _In_  LPARAM lParam
  14.     )
  15. {
  17.     // 判断是否wParam与lParam都有键盘消息，是的话则执行打印操作
  18.     if (code == HC_ACTION){
  19.         // 将256个虚拟键的状态拷贝到指定的缓冲区中，如果成功则继续
  20.         BYTE KeyState[256] = { 0 };
  21.         if (GetKeyboardState(KeyState)) {
  22.             // 得到第16–23位，键盘虚拟码
  23.             LONG  KeyInfo = lParam;
  24.             UINT  keyCode = (KeyInfo >> 16) & 0x00ff;
  25.             WCHAR wKeyCode = 0;
  26.             ToAscii((UINT)wParam, keyCode, KeyState, (LPWORD)&wKeyCode, 0);
  27.             // 将其打印出来
  28.             CHAR szInfo[10] = { 0 };
  29.             sprintf_s(szInfo, _countof(szInfo), "Hook_%c", wKeyCode);
  30.             OutputDebugStringA(szInfo);
  31.             return 0;
  32.         }
  33.     }
  36. //     char str[10] = {};
  37. //     str[0] = wParam;
  38. //     OutputDebugStringA(str);
  39.     return CallNextHookEx(g_hook, code, wParam, lParam);
  40. }
  43. void OnHook()
  44. {
  45.     g_hook = SetWindowsHookEx(WH_KEYBOARD, 
  46.                 KeyboardProc, g_mod, 0);
  48. //     if ()
  49. //     {
  50. //     }
  52. }
  53. void UnHook()
  54. {
  55.     if (!g_hook)
  56.     {
  57.         UnhookWindowsHookEx(g_hook);
  58.     }
  59. }
  60. BOOL APIENTRY DllMain( HMODULE hModule,
  61.                        DWORD  ul_reason_for_call,
  62.                        LPVOID lpReserved
  63.                      )
  64. {
  65.     switch (ul_reason_for_call)
  66.     {
  67.     case DLL_PROCESS_ATTACH:
  68.         MessageBoxW(0, 0, 0, 0);
  69.         g_mod = hModule;//模块句柄
  70.         OnHook();
  71.     //case DLL_THREAD_ATTACH:
  72.     //case DLL_THREAD_DETACH:
  73.     //case DLL_PROCESS_DETACH:
  74.         //UnHook();
  75.         break;
  76.     }
  77.     return TRUE;
  78. }

内联HOOK

  1. // 内联HOOK.cpp : 定义控制台应用程序的入口点。
  2. //
  4. #include "stdafx.h"
  5. #include <windows.h>
  7. void UnHook();
  8. void OnHook();
  10. char g_OldCode[5];
  11. char g_NewCode[5] = { 0xE9 };
  13. int WINAPI MyMessageBoxW(
  14. _In_opt_ HWND hWnd,
  15. _In_opt_ LPCWSTR lpText,
  16. _In_opt_ LPCWSTR lpCaption,
  17. _In_ UINT uType)
  18. {
  19.     lpText = L"你被HOOK\n";
  20.     lpCaption = L"嘿嘿";
  22.     //先卸载
  23.     UnHook();
  24.     //调用MessageBoxW
  25.     int nRet = MessageBoxW(hWnd, lpText, lpCaption, uType);
  26.     //再次挂上钩子
  27.     OnHook();
  28.     return nRet;
  29. }
  31. void OnHook()
  32. {
  33.     //1.保存原函数被修改的代码
  34.     memcpy(g_OldCode, MessageBoxW, 5);
  35.     //2.计算偏移量
  36.     DWORD dwOffset = (DWORD)MyMessageBoxW - (DWORD)MessageBoxW - 5;
  37.     //3.写入指令
  38.     memcpy(g_NewCode + 1, &dwOffset, 4);
  39.     //修改内存属性（代码段没有可写属性）
  40.     DWORD dwOld;
  41.     VirtualProtect(MessageBoxW, 5, PAGE_EXECUTE_READWRITE, &dwOld);
  42.     memcpy(MessageBoxW, g_NewCode, 5);
  43.     VirtualProtect(MessageBoxW, 5, dwOld, &dwOld);
  45. }
  47. void UnHook()
  48. {
  49.     DWORD dwOld;
  50.     VirtualProtect(MessageBoxW, 5, PAGE_EXECUTE_READWRITE, &dwOld);
  51.     memcpy(MessageBoxW, g_OldCode, 5);
  52.     VirtualProtect(MessageBoxW, 5, dwOld, &dwOld);
  53. }
  55. int _tmain(int argc, _TCHAR* argv[])
  56. {
  57.     MessageBoxW(0, 0, 0, 0);
  59.     OnHook();
  60.     MessageBoxW(0, 0, 0, 0);
  63.     return 0;
  64. }

内联HOOK_DLL

  1. // dllmain.cpp : 定义 DLL 应用程序的入口点。
  2. #include "stdafx.h"
  3. #include <windows.h>
  6. void UnHook();
  7. void OnHook();
  9. char g_OldCode[5];
  10. char g_NewCode[5] = { 0xE9 };
  12. int WINAPI MyMessageBoxW(
  13.     _In_opt_ HWND hWnd,
  14.     _In_opt_ LPCWSTR lpText,
  15.     _In_opt_ LPCWSTR lpCaption,
  16.     _In_ UINT uType)
  17. {
  18.     lpText = L"你被HOOK\n";
  19.     lpCaption = L"嘿嘿";
  21.     //先卸载
  22.     UnHook();
  23.     //调用MessageBoxW
  24.     int nRet = MessageBoxW(hWnd, lpText, lpCaption, uType);
  25.     //再次挂上钩子
  26.     OnHook();
  27.     return nRet;
  28. }
  30. void OnHook()
  31. {
  32.     //1.保存原函数被修改的代码
  33.     memcpy(g_OldCode, MessageBoxW, 5);
  34.     //2.计算偏移量
  35.     DWORD dwOffset = (DWORD)MyMessageBoxW - (DWORD)MessageBoxW - 5;
  36.     //3.写入指令
  37.     memcpy(g_NewCode + 1, &dwOffset, 4);
  38.     //修改内存属性（代码段没有可写属性）
  39.     DWORD dwOld;
  40.     VirtualProtect(MessageBoxW, 5, PAGE_EXECUTE_READWRITE, &dwOld);
  41.     memcpy(MessageBoxW, g_NewCode, 5);
  42.     VirtualProtect(MessageBoxW, 5, dwOld, &dwOld);
  44. }
  46. void UnHook()
  47. {
  48.     DWORD dwOld;
  49.     VirtualProtect(MessageBoxW, 5, PAGE_EXECUTE_READWRITE, &dwOld);
  50.     memcpy(MessageBoxW, g_OldCode, 5);
  51.     VirtualProtect(MessageBoxW, 5, dwOld, &dwOld);
  52. }
  54. BOOL APIENTRY DllMain( HMODULE hModule,
  55.                        DWORD  ul_reason_for_call,
  56.                        LPVOID lpReserved
  57.                      )
  58. {
  59.     switch (ul_reason_for_call)
  60.     {
  61.     case DLL_PROCESS_ATTACH:
  62.         OnHook();
  63.     //case DLL_THREAD_ATTACH:
  64.     //case DLL_THREAD_DETACH:
  65.     //case DLL_PROCESS_DETACH:
  66.     //    UnHook();
  67.         break;
  68.     }
  69.     return TRUE;
  70. }

IAT_HOOK

  1. // dllmain.cpp : 定义 DLL 应用程序的入口点。
  2. #include "stdafx.h"
  3. #include <windows.h>
  6. DWORD g_IatAddr;
  7. DWORD g_FunOldAddr;
  9. typedef int (WINAPI* FP_MessageBoxW)(
  10.     _In_opt_ HWND hWnd,
  11.     _In_opt_ LPCWSTR lpText,
  12.     _In_opt_ LPCWSTR lpCaption,
  13.     _In_ UINT uType);
  14. int WINAPI MyMessageBoxW(
  15.     _In_opt_ HWND hWnd,
  16.     _In_opt_ LPCWSTR lpText,
  17.     _In_opt_ LPCWSTR lpCaption,
  18.     _In_ UINT uType)
  19. {
  20.     lpText = L"你被HOOK\n";
  21.     lpCaption = L"嘿嘿";
  23.     FP_MessageBoxW FpMsg = (FP_MessageBoxW)g_FunOldAddr;
  25.     return FpMsg(hWnd, lpText, lpCaption, uType);
  26. }
  29. void OnHook(char* pFunName, char* pDllName)
  30. {
  31.     //遍历导入表（INT）
  32.     HMODULE hMod = GetModuleHandle(NULL);
  33.     PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)hMod;
  34.     PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pDos->e_lfanew + (DWORD)hMod);
  36.     DWORD dwImportRVA = pNt->OptionalHeader.DataDirectory[1].VirtualAddress;
  38.     PIMAGE_IMPORT_DESCRIPTOR pImport = 
  39.         (PIMAGE_IMPORT_DESCRIPTOR)
  40.         (dwImportRVA + (DWORD)hMod);
  42.     while (pImport->Name)
  43.     {
  44.         char* pDll = (char*)(pImport->Name + (DWORD)hMod);
  45.         if (!_stricmp(pDll,pDllName))
  46.         {
  47.             //遍历INT
  48.             IMAGE_THUNK_DATA* pInt =
  49.                 (IMAGE_THUNK_DATA*)
  50.                 (pImport->OriginalFirstThunk + (DWORD)hMod);
  51.             IMAGE_THUNK_DATA* pIat =
  52.                 (IMAGE_THUNK_DATA*)
  53.                 (pImport->FirstThunk + (DWORD)hMod);
  54.             while (pInt->u1.AddressOfData)
  55.             {
  56.                 if (!IMAGE_SNAP_BY_ORDINAL(pInt->u1.AddressOfData))
  57.                 {
  58.                     PIMAGE_IMPORT_BY_NAME pName = (PIMAGE_IMPORT_BY_NAME)(pInt->u1.AddressOfData + (DWORD)hMod);
  59.                     if (!_stricmp(pName->Name,pFunName))
  60.                     {
  61.                         //函数地址
  62.                         g_FunOldAddr = pIat->u1.Function;
  63.                         g_IatAddr = (DWORD)pIat;
  65.                         //修改地址
  66.                         //修改内存属性
  67.                         DWORD dwOld;
  68.                         VirtualProtect(pIat, 4, PAGE_READWRITE, &dwOld);
  69.                         *(DWORD*)pIat = (DWORD)MyMessageBoxW;
  70.                         VirtualProtect(pIat, 4, dwOld, &dwOld);
  71.                         return;
  72.                     }
  73.                 }
  74.                 //下一个函数
  75.                 pInt++;
  76.                 pIat++;
  77.             }
  78.         }
  79.         //下一个模块
  80.         pImport++;
  81.     }
  82. }
  84. void UnHook()
  85. {
  86.     DWORD dwOld;
  87.     VirtualProtect((LPVOID)g_IatAddr, 4, PAGE_READWRITE, &dwOld);
  88.     *(DWORD*)g_IatAddr = g_FunOldAddr;
  89.     VirtualProtect((LPVOID)g_IatAddr, 4, dwOld, &dwOld);
  90. }
  92. BOOL APIENTRY DllMain( HMODULE hModule,
  93.                        DWORD  ul_reason_for_call,
  94.                        LPVOID lpReserved
  95.                      )
  96. {
  97.     switch (ul_reason_for_call)
  98.     {
  99.     case DLL_PROCESS_ATTACH:
  100.         OnHook("MessageBoxW", "user32.dll");
  101.     case DLL_THREAD_ATTACH:
  102.     case DLL_THREAD_DETACH:
  103.     case DLL_PROCESS_DETACH:
  104.         break;
  105.     }
  106.     return TRUE;
  107. }

注入工具代码

  1. // win原理Day006.cpp : 定义控制台应用程序的入口点。
  2. //
  4. #include "stdafx.h"
  5. #include <windows.h>
  7. #define DLL_MESSAGE "D:\\ProgramVS\\win原理Day006\\Debug\\消息钩子DLL.dll"
  8. #define DLL_PATH "D:\\ProgramVS\\win原理Day006\\Debug\\TestDll.dll"
  9. #define DLL_INLINE "D:\\ProgramVS\\win原理Day006\\Debug\\内联HOOK_DLL.dll"
  10. #define DLL_IAT "D:\\ProgramVS\\win原理Day006\\Debug\\IAT_HOOK.dll"
  11. //远程线程注入
  12. void Inject(char* pDllPath, DWORD dwPid)
  13. {
  14.     //1.打开进程获取句柄
  15.     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
  16.     if (!hProcess)
  17.     {
  18.         printf("句柄打开失败\n");
  19.         return;
  20.     }
  21.     //2. 再目标进程中申请足够大的内存，存储DLL的全路径
  22.     LPVOID lpBuf = VirtualAllocEx(hProcess, NULL,
  23.         strlen(pDllPath), MEM_COMMIT, PAGE_READWRITE);
  25.     if (!lpBuf)
  26.     {
  27.         printf("内存申请失败\n");
  28.         CloseHandle(hProcess);
  29.         return;
  30.     }
  32.     //3.把DLL全路径写入进去
  33.     DWORD dwWrite;
  34.     WriteProcessMemory(hProcess, lpBuf, 
  35.          pDllPath, strlen(pDllPath), &dwWrite);
  36.     //4.创建远程线程
  37.     HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL,
  38.         (LPTHREAD_START_ROUTINE)LoadLibraryA, lpBuf, NULL, NULL);
  40.     //5.等待线程结束
  41.     WaitForSingleObject(hThread, -1);
  43.     //6.释放内存
  44.     VirtualFreeEx(hProcess, lpBuf, 0, MEM_RELEASE);
  45.     CloseHandle(hProcess);
  47. }
  50. //注入代码
  51. void InjectCode(char* pCode, DWORD dwSize,DWORD dwPid)
  52. {
  53.     //1.打开进程获取句柄
  54.     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
  55.     if (!hProcess)
  56.     {
  57.         printf("句柄打开失败\n");
  58.         return;
  59.     }
  60.     //2. 再目标进程中申请足够大的内存，存储DLL的全路径
  61.     LPVOID lpBuf = VirtualAllocEx(hProcess, NULL,
  62.         strlen(pCode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  64.     if (!lpBuf)
  65.     {
  66.         printf("内存申请失败\n");
  67.         CloseHandle(hProcess);
  68.         return;
  69.     }
  71.     //3.把DLL全路径写入进去
  72.     DWORD dwWrite;
  73.     WriteProcessMemory(hProcess, lpBuf,
  74.         pCode, dwSize, &dwWrite);
  75.     //4.创建远程线程
  76.     HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL,
  77.         (LPTHREAD_START_ROUTINE)lpBuf, NULL, NULL, NULL);
  79.     //5.等待线程结束
  80.     WaitForSingleObject(hThread, -1);
  82.     //6.释放内存
  83.     VirtualFreeEx(hProcess, lpBuf, 0, MEM_RELEASE);
  84.     CloseHandle(hProcess);
  86. }
  89. int _tmain(int argc, _TCHAR* argv[])
  90. {
  92.     //HMODULE hMod = LoadLibraryA(DLL_MESSAGE);
  94.     int nPid;
  95.     printf("输入PID：");
  96.     scanf_s("%d", &nPid);
  97.     Inject(DLL_IAT, nPid);
  99.     //DWORD dwAddr;
  100. //     __asm
  101. //     {
  102. //         push 0;
  103. //         push 0;
  104. //         push 0;
  105. //         push 0;
  106. //         mov eax, 0x99999999;
  107. //         call eax;
  108. //     }
  109. // 
  111. //      char pCode[] = "\x6A\x00\x6A\x00\x6A\x00\x6A\x00\xB8\x99\x99\x99\x99\xFF\xD0";
  112. //     DWORD dwAddr;
  113. //     scanf_s("%x", &dwAddr);
  114. //     *(int*)(pCode + 9) = dwAddr;
  116. //     DWORD dwPid;
  117. //     scanf_s("%d", &dwPid);
  118. //     InjectCode(pCode, sizeof(pCode),dwPid);
  120. //测试
  121. //     printf("MessageBoxW:0x%08X\n", (DWORD)MessageBoxW);
  124.     system("pause");
  128.     return 0;
  129. }