Ring3下Inline Hook API

用CreateFile为例子，讲解一下Ring3下的Inline Hook API，基本原理很简单

1、获取CreateFile函数的地址

2、读取CreateFile函数的前8个字节

3、将CreateFile函数的前8个字节，修改成mov eax,我的函数地址  jmp eax

4、进入我的函数地址之后，记得恢复CreateFile函数原来的8个字节，不然没法正常使用CreateFile

 

#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <tchar.h>

//修改API入口为 mov eax, 00400000;jmp eax是程序能跳转到自己的函数
BYTE NewBytes[8] = { 0xB8, 0x0, 0x0, 0x40, 0x0, 0xFF, 0xE0, 0x0 };
BYTE OldBytes[8] = { 0 };

FARPROC CreateFile_Addr;

HANDLE WINAPI MyCreateFile(
	__in          LPCTSTR lpFileName,
	__in          DWORD dwDesiredAccess,
	__in          DWORD dwShareMode,
	__in          LPSECURITY_ATTRIBUTES lpSecurityAttributes,
	__in          DWORD dwCreationDisposition,
	__in          DWORD dwFlagsAndAttributes,
	__in          HANDLE hTemplateFile
)
{
	MessageBox(0, "MyCreateFile", 0, 0);
	//恢复API头8个字节
	WriteProcessMemory(INVALID_HANDLE_VALUE, (void*)CreateFile_Addr,
		(void*)OldBytes, 8, NULL);

	printf("lpFileName is %s\n", lpFileName);

	//调用正确的函数
	HANDLE hFile = CreateFileA(lpFileName, dwDesiredAccess, dwShareMode,
		lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);

	//写入跳转语句，继续Hook
	WriteProcessMemory(INVALID_HANDLE_VALUE, (void*)CreateFile_Addr,
		(void*)NewBytes, 8, NULL);

	return hFile;
}


void main()
{
	HMODULE hModule_Kernel32 = LoadLibrary("Kernel32.dll");
	CreateFile_Addr = GetProcAddress(hModule_Kernel32, "CreateFileA");

	printf("CreateFileA_Addr is %x\n", CreateFile_Addr);
	printf("MyCreateFile Addr is %x\n", MyCreateFile);

	//读CreateFile函数的前8个字节
	if (ReadProcessMemory(INVALID_HANDLE_VALUE, CreateFile_Addr, OldBytes, 8, NULL) == 0)
	{
		printf("ReadProcessMemory error\n");
		return;
	}

	printf("OldBytes is %x%x%x%x%x%x%x%x\n", OldBytes[0], OldBytes[1], OldBytes[2],
		OldBytes[3], OldBytes[4], OldBytes[5], OldBytes[6], OldBytes[7]);

	//将NewBytes改成My函数地址
	*(DWORD*)(NewBytes + 1) = (DWORD)MyCreateFile;

	printf("NewBytes is %x%x%x%x%x%x%x%x\n", NewBytes[0], NewBytes[1], NewBytes[2], NewBytes[3],
		NewBytes[4], NewBytes[5], NewBytes[6], NewBytes[7]);

	//写入跳转，开始Hook
	WriteProcessMemory(INVALID_HANDLE_VALUE, CreateFile_Addr, NewBytes, 8, NULL);

	//调用CreateFileA测试一下。
	HANDLE hFile = CreateFileA("C:\\1.txt", GENERIC_ALL, FILE_SHARE_READ, 0, CREATE_ALWAYS, 0, 0);
	CloseHandle(hFile);
}