用CreateFile为例子,讲解一下Ring3下的Inline Hook API,基本原理很简单
1、获取CreateFile函数的地址
2、读取CreateFile函数的前8个字节
3、将CreateFile函数的前8个字节,修改成mov eax,我的函数地址 jmp eax
4、进入我的函数地址之后,记得恢复CreateFile函数原来的8个字节,不然没法正常使用CreateFile
#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <tchar.h>
//修改API入口为 mov eax, 00400000;jmp eax是程序能跳转到自己的函数
BYTE NewBytes[8] = { 0xB8, 0x0, 0x0, 0x40, 0x0, 0xFF, 0xE0, 0x0 };
BYTE OldBytes[8] = { 0 };
FARPROC CreateFile_Addr;
HANDLE WINAPI MyCreateFile(
__in LPCTSTR lpFileName,
__in DWORD dwDesiredAccess,
__in DWORD dwShareMode,
__in LPSECURITY_ATTRIBUTES lpSecurityAttributes,
__in DWORD dwCreationDisposition,
__in DWORD dwFlagsAndAttributes,
__in HANDLE hTemplateFile
)
{
MessageBox(0, "MyCreateFile", 0, 0);
//恢复API头8个字节
WriteProcessMemory(INVALID_HANDLE_VALUE, (void*)CreateFile_Addr,
(void*)OldBytes, 8, NULL);
printf("lpFileName is %s\n", lpFileName);
//调用正确的函数
HANDLE hFile = CreateFileA(lpFileName, dwDesiredAccess, dwShareMode,
lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
//写入跳转语句,继续Hook
WriteProcessMemory(INVALID_HANDLE_VALUE, (void*)CreateFile_Addr,
(void*)NewBytes, 8, NULL);
return hFile;
}
void main()
{
HMODULE hModule_Kernel32 = LoadLibrary("Kernel32.dll");
CreateFile_Addr = GetProcAddress(hModule_Kernel32, "CreateFileA");
printf("CreateFileA_Addr is %x\n", CreateFile_Addr);
printf("MyCreateFile Addr is %x\n", MyCreateFile);
//读CreateFile函数的前8个字节
if (ReadProcessMemory(INVALID_HANDLE_VALUE, CreateFile_Addr, OldBytes, 8, NULL) == 0)
{
printf("ReadProcessMemory error\n");
return;
}
printf("OldBytes is %x%x%x%x%x%x%x%x\n", OldBytes[0], OldBytes[1], OldBytes[2],
OldBytes[3], OldBytes[4], OldBytes[5], OldBytes[6], OldBytes[7]);
//将NewBytes改成My函数地址
*(DWORD*)(NewBytes + 1) = (DWORD)MyCreateFile;
printf("NewBytes is %x%x%x%x%x%x%x%x\n", NewBytes[0], NewBytes[1], NewBytes[2], NewBytes[3],
NewBytes[4], NewBytes[5], NewBytes[6], NewBytes[7]);
//写入跳转,开始Hook
WriteProcessMemory(INVALID_HANDLE_VALUE, CreateFile_Addr, NewBytes, 8, NULL);
//调用CreateFileA测试一下。
HANDLE hFile = CreateFileA("C:\\1.txt", GENERIC_ALL, FILE_SHARE_READ, 0, CREATE_ALWAYS, 0, 0);
CloseHandle(hFile);
}