VEH软件断点和硬件断点Hook管理

Core Objects

已于 2023-03-27 16:36:26 修改

阅读量560

点赞数

分类专栏： windows 文章标签： c++ c语言 windows 数据结构

于 2023-03-27 16:27:22 首次发布

本文链接：https://blog.csdn.net/qq_40363731/article/details/129798177

版权

#pragma once



using HookTargetProc = LONG(NTAPI*)(struct _EXCEPTION_POINTERS* ExceptionInfo);


struct VEH_HOOK {
   
	LPVOID HookAddress;
	HookTargetProc TargetAddress;
	UCHAR OldCode;
	struct VEH_HOOK* next;
};

struct VEHCPUHOOK {
   
	LPVOID lpHookAddress;
	HookTargetProc TargetAddress;
};
using HOOKNODE = struct VEH_HOOK;
using CPUHOOKINFO = struct VEHCPUHOOK;
void InitVehHook();

void SetVehHook(LPVOID lpHookAddress, HookTargetProc lpTarget);

void SetVehCpuHook(LPVOID lpHookAddress, HookTargetProc lpTarget);

void SetThreadHook(HANDLE hThread);

void DeleteAllHook();

#include "pch.h"
#include "VehHook.h"
#include <TlHelp32.h>
#include <iostream>
HOOKNODE* nodeExceptionHook;
CPUHOOKINFO cpuHookInfo[4] = {
    0 };

LONG NTAPI VehHookHandle(struct _EXCEPTION_POINTERS* ExceptionInfo) {
   

	if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_BREAKPOINT) {
   
		//		std::cout << 1;
		HOOKNODE* tempHookNode = nodeExceptionHook;
		while (tempHookNode != nullptr) {
   
			if (tempHookNode->HookAddress == ExceptionInfo->ExceptionRecord->ExceptionAddress) {
   
				DWORD dwOld;
				VirtualProtect(tempHookNode->HookAddress, 1, PAGE_EXECUTE_READWRITE, &dwOld);
				*(UCHAR*)(tempHookNode->HookAddress) = tempHookNode->OldCode;
				tempHookNode->TargetAddress(ExceptionInfo);
				ExceptionInfo->ContextRecord->EFlags |= 0x100;
				VirtualProtect(tempHookNode->HookAddress, 1, dwOld, &dwOld);
				return EXCEPTION_CONTINUE_EXECUTION;
			}
			tempHookNode = tempHookNode->next;
		}

		return EXCEPTION_CONTINUE_SEARCH;
	}
	else if (ExceptionInfo

最低0.47元/天解锁文章