内联Hook管理

最新推荐文章于 2024-10-08 12:54:42 发布

Core Objects

最新推荐文章于 2024-10-08 12:54:42 发布

阅读量64

点赞数

分类专栏： windows 文章标签： c++ windows 安全数据结构

本文链接：https://blog.csdn.net/qq_40363731/article/details/129797967

版权

windows 专栏收录该内容

10 篇文章 0 订阅

订阅专栏

该代码实现了一个InlineHook类，用于在内存中设置、删除和重新加载函数挂钩。InlineHook使用HookNode结构体存储原始和新代码，以及目标地址。通过VirtualProtect修改内存保护属性，实现代码替换。类提供了单个和全部钩子的管理功能。

摘要由CSDN通过智能技术生成

InlineHook .h

#pragma once
#include "framework.h"
struct HookNode {
	struct HookNode* next;
	char m_OldCode[5] = { 0 };
	char m_NewCode[5] = { 0 };
	PROC m_HookAddr = NULL;
	PROC m_HookTarget = NULL;
};
class InlineHook {
public:
	InlineHook();
	~InlineHook();
	void SetHook(PROC fpAddress, PROC fpTarget);
	void DeleteHook(PROC fpAddress);
	void UnLoadHook(PROC fpAddress);
	void ReLoadHook(PROC fpAddress);
	void DeleteAllHook();
	void UnLoadAllHook();
	void ReLoadAllHook();
private:
	HookNode* hooknode;
};

InlineHook.cpp

#include "pch.h"
#include "InlineHook.h"

InlineHook::InlineHook() {
	hooknode = nullptr;
}

InlineHook::~InlineHook() {
	DeleteAllHook();
}

void InlineHook::SetHook(PROC fpAddress, PROC fpTarget) {
	HookNode* curHookNode;
	if (hooknode == nullptr) {
		hooknode = new HookNode;
		hooknode->next = nullptr;
		curHookNode = hooknode;
	}
	else {
		curHookNode = hooknode;
		while (curHookNode->next) {
			curHookNode = curHookNode->next;
		}
		curHookNode->next = new struct HookNode;
		curHookNode = curHookNode->next; 
		curHookNode->next = nullptr;
	}
	curHookNode->m_HookAddr = fpAddress;
	curHookNode->m_HookTarget = fpTarget;
	curHookNode->m_NewCode[0] = 0xE9;
	*(DWORD*)((char*)curHookNode->m_NewCode + 1) = (DWORD)fpTarget - ((DWORD)fpAddress + 5);
	DWORD dwOld;
	BOOL bRet = VirtualProtect(fpAddress, 5, PAGE_EXECUTE_READWRITE, &dwOld);
	if (bRet) {
		memcpy(curHookNode->m_OldCode, fpAddress, 5);
		memcpy(fpAddress, curHookNode->m_NewCode, 5);
	}
	VirtualProtect(fpAddress, 5, dwOld, &dwOld);
}

void InlineHook::DeleteHook(PROC fpAddress) {
	HookNode* curHookNode = hooknode;
	HookNode* preHookNode = hooknode;
	while (curHookNode) {
		if (curHookNode->m_HookAddr == fpAddress)
			break;
		curHookNode = curHookNode->next;
		preHookNode = curHookNode;
	}
	if (curHookNode != nullptr) {
		DWORD dwOld;
		BOOL bRet = VirtualProtect(fpAddress, 5, PAGE_EXECUTE_READWRITE, &dwOld);
		if (bRet) {
			memcpy(fpAddress, curHookNode->m_OldCode, 5);
		}
		VirtualProtect(fpAddress, 5, dwOld, &dwOld);
		preHookNode->next = curHookNode->next;
		delete curHookNode;
	}
}

void InlineHook::UnLoadHook(PROC fpAddress) {
	HookNode* curHookNode = hooknode;
	while (curHookNode) {
		if(curHookNode->m_HookAddr == fpAddress)
			break;
		curHookNode = curHookNode->next;
	}
	if (curHookNode != nullptr) {
		DWORD dwOld;
		BOOL bRet = VirtualProtect(fpAddress, 5, PAGE_EXECUTE_READWRITE, &dwOld);
		if (bRet) {
			memcpy(fpAddress, curHookNode->m_OldCode, 5);
		}
		VirtualProtect(fpAddress, 5, dwOld, &dwOld);
	}
	
}

void InlineHook::ReLoadHook(PROC fpAddress) {
	HookNode* curHookNode = hooknode;
	while (curHookNode) {
		if (curHookNode->m_HookAddr == fpAddress)
			break;
		curHookNode = curHookNode->next;
	}
	if (curHookNode != nullptr) {
		DWORD dwOld;
		BOOL bRet = VirtualProtect(fpAddress, 5, PAGE_EXECUTE_READWRITE, &dwOld);
		if (bRet) {
			memcpy(fpAddress, curHookNode->m_NewCode, 5);
		}
		VirtualProtect(fpAddress, 5, dwOld, &dwOld);
	}
	
}

void InlineHook::DeleteAllHook() {
	HookNode* curHookNode = hooknode;
	while (curHookNode) {
		DWORD dwOld;
		BOOL bRet = VirtualProtect(curHookNode->m_HookAddr, 5, PAGE_EXECUTE_READWRITE, &dwOld);
		if (bRet) {
			memcpy(curHookNode->m_HookAddr, curHookNode->m_OldCode, 5);
		}
		VirtualProtect(curHookNode->m_HookAddr, 5, dwOld, &dwOld);
		HookNode* tempHookNode = curHookNode;
		curHookNode = curHookNode->next;
		delete tempHookNode;
	}
	hooknode = nullptr;
}

void InlineHook::UnLoadAllHook() {
	HookNode* curHookNode = hooknode;
	while (curHookNode) {
		DWORD dwOld;
		BOOL bRet = VirtualProtect(curHookNode->m_HookAddr, 5, PAGE_EXECUTE_READWRITE, &dwOld);
		if (bRet) {
			memcpy(curHookNode->m_HookAddr, curHookNode->m_OldCode, 5);
		}
		VirtualProtect(curHookNode->m_HookAddr, 5, dwOld, &dwOld);
		curHookNode = curHookNode->next;
	}
}

void InlineHook::ReLoadAllHook() {
	HookNode* curHookNode = hooknode;
	while (curHookNode) {
		DWORD dwOld;
		BOOL bRet = VirtualProtect(curHookNode->m_HookAddr, 5, PAGE_EXECUTE_READWRITE, &dwOld);
		if (bRet) {
			memcpy(curHookNode->m_HookAddr, curHookNode->m_NewCode, 5);
		}
		VirtualProtect(curHookNode->m_HookAddr, 5, dwOld, &dwOld);
		curHookNode = curHookNode->next;
	}
}