常用Hook技术解析

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

// 获取目标函数地址
g_pOrgFunc = (FARPROC)GetProcAddress(GetModuleHandle(hModToHook), hFuncToHook);

// 挂钩
// 遍历IID结构体
while (pImportDescriptor->Characteristics && pImportDescriptor->FirstThunk != NULL)
{
    // 如果IID结构体的Name成员值为目标函数所属DLL的名称
	szLibName = (LPCSTR)(uiBaseAddr + pImportDescriptor->Name);
	if (!_strcmpi(szLibName, szDllName))
	{
    	//获取IAT地址
		pThunk = (PIMAGE_THUNK_DATA)(uiBaseAddr + pImportDescriptor->FirstThunk);
        // 遍历IAT数组
		for (; pThunk->u1.Function; pThunk++)
		{
            // 判断IAT数组当前值是不是目标函数的地址
			lpAddr = (ULONG_PTR*)pThunk;
			if ((*lpAddr) == (ULONG_PTR)pfnOrg)
                {
                	// 让IAT所在内存获得可读写权限
                    MEMORY_BASIC_INFORMATION mbi;
                    VirtualQuery(lpAddr, &mbi, sizeof(mbi));
                    VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOldProtect);
                	// 保存旧地址，更新为Detour函数地址
                	// 保存旧地址是为了能执行完Detour后还能继续执行目标函数，以及脱钩
                    g_pToIATThunk = lpAddr;
                    *lpAddr = (ULONG_PTR)pfnNew;
                	// 恢复内存权限
                    VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, dwOldProtect, &dwOldProtect);
                    return TRUE;
                }
            }
        }
    	// 移动到下一个IID结构体判断
        else
            pImportDescriptor++;
}

// 脱钩
// 让IAT所在内存获得可读写权限
VirtualQuery((LPCVOID)g_pToIATThunk, &mbi, sizeof(mbi));
VirtualProtectEx(hProcess, mbi.BaseAddress,mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOldProcetect);
*g_pToIATThunk = (ULONG_PTR)g_pOrgFunc;
// 恢复内存原权限
VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, dwOldProcetect, &dwOldProcetect);

//测试用Detour
int WINAPI MyDetourFunc(
    _In_opt_ HWND   hWnd,
    _In_opt_ LPCSTR lpText,
    _In_opt_ LPCSTR lpCaption,
    _In_     UINT   uType
)
{
    int ret;
    WinExec("C:\\Windows\\System32\\calc.exe", SW_SHOW);
    ret = ((PFN_MessageBoxA)g_pOrgFunc)(
        hWnd,
        lpText,
        lpCaption,
        uType);
    return ret;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

// 获取目标函数相对DLL基址的RVA
g_hModule = GetModuleHandle(hModToHook);
g_pOrgFunc = (ULONG_PTR)GetProcAddress(g_hModule, hFuncToHook);
g_pOrgFunc = (ULONG)(g_pOrgFunc - (ULONG_PTR)g_hModule);

// 挂钩
hProcess = GetCurrentProcess();
uiBaseAddr = (PBYTE)g_hModule;
// 获取EAT地址
uiNtHeader = uiBaseAddr + ((PIMAGE_DOS_HEADER)uiBaseAddr)->e_lfanew;
pExportDir = (PIMAGE_EXPORT_DIRECTORY)(uiBaseAddr + ((PIMAGE_NT_HEADERS)uiNtHeader)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
FuncAddr = (PULONG)(uiBaseAddr + pExportDir->AddressOfFunctions);
// 遍历EAT中的AddressOfFunctions数组寻找目标函数所在位置
while (*FuncAddr)
{
   // 如果遍历到的值与目标函数的RVA相同     
   if (*FuncAddr == g_pOrgFunc)
   {
       // 修改EAT所在内存空间的权限为可读写
      MEMORY_BASIC_INFORMATION mbi;
      VirtualQuery(FuncAddr, &mbi, sizeof(mbi));
      VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOldProtect);
       // 保存旧地址
      g_pToEATThunk = (PULONG_PTR)FuncAddr;
       // 更新为Detour函数的相对DLL基址的RVA
      *FuncAddr = (ULONG)((ULONG_PTR)pfnNew - (ULONG_PTR)g_hModule ) ;
       // 恢复内存原权限
      VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, dwOldProtect, &dwOldProtect);     
   }
      else
        FuncAddr++;
}

// 脱钩
// 修改EAT所在内存空间的权限为可读写
VirtualQuery((LPCVOID)g_pToEATThunk, &mbi, sizeof(mbi));
VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOldProcetect);
// 还原EAT
*g_pToEATThunk = (ULONG)g_pOrgFunc;
VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, dwOldProcetect, &dwOldProcetect);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

//获取目标虚函数所在类的虚表地址
PULONG_PTR pvfTableToHook = 目标虚函数所在类的虚表地址

// 挂钩
// 让Trampoline类的虚表所在内存获得可读写权限
ULONG_PTR* vfTableTrampoline = (ULONG_PTR*)*(ULONG_PTR*)&Trampoline;
VirtualQuery(vfTableTrampoline, &mbi, sizeof(mbi));
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOld);
// 将原虚函数地址保存在Trampoline类虚表中
vfTableTrampoline[0] = pvfTableToHook[0];
// 恢复内存原权限
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, dwOld, 0);
// 让目标虚函数所在类的虚表所在内存获得可读写权限
VirtualQuery(pvfTableToHook, &mbi, sizeof(mbi));
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOld);
// 将目标类的虚表对应的虚函数地址替换为Detour类的虚表中保存的第一个函数地址
ULONG_PTR* vfTable = (ULONG_PTR*)*(ULONG_PTR*)&Detour;
pvfTableToHook[0] = (ULONG_PTR)vfTable[0];
// 恢复内存原权限
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, dwOld, 0);

// 脱钩
// 让Trampoline类的虚表所在内存获得可读写权限
VirtualQuery(vfTableTrampoline, &mbi, sizeof(mbi));
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOld);
// 获取原徐函数地址
OrigAddr = vfTableTrampoline[0];
// 恢复内存原权限
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, dwOld, 0);
// 让目标虚函数所在类的虚表所在内存获得可读写权限
VirtualQuery(pvfTableToHook, &mbi, sizeof(mbi));
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOld);
// 恢复虚表所存地址为原徐函数地址
pvfTableToHook[0] = OrigAddr;
// 恢复内存原权限
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, dwOld, 0);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

class MyTest
{
public:
	virtual int Add(int a, int b);
	virtual void g() { cout << "test::g" << endl; };
	virtual void h() { cout << "test::h" << endl; };
	void novirtual() { cout << "test::not virtual" << endl; };

};
int MyTest::Add(int a, int b)
{
	printf("Test::Add\n");
	return a + b;
}

int main()
{
	MyTest test;
	MyTest* ptest = &test;
	ptest->Add(1, 2);
	ULONG_PTR vfTable = *(ULONG_PTR*)ptest;
	getchar();
	ptest->Add(1, 2);
	getchar();
	return 0;
}

1
2
3
4

bp <目的断点地址>
g
dv //查看变量名
dt <目标变量>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// 存储HOOK 前的代码
BYTE oldCode[5];
// 存储HOOK 后的代码
BYTE newCode[5] = {0xE9,0,};

// 挂钩
// 获取目标函数地址
HookData.HookAddr = (ULONG_PTR)GetProcAddress(GetModuleHandleA(HookData.szApiDllName), HookData.szHookApiName);
// 判断目标函数是否已经被Hook了
pByte = (PBYTE)HookData.HookAddr;
// 被Hook则不进行挂钩
if (pByte[0] == 0xE9)
	return FALSE;
// 将jmp指令与Detour函数地址写入目标函数的前五个字节
hProcess = GetCurrentProcess();
ReadProcessMemory(hProcess, (LPCVOID)HookData.HookAddr, HookData.oldCode, HookData.HookCodeLen, 0);
// 计算相对地址，公式为目标地址-当前地址-指令长度
* (ULONG*)(HookData.newCode + 1) = (ULONG)HookData.pfnDetourFun - (ULONG)HookData.HookAddr - 5;
WriteProcessMemory(hProcess, (LPVOID)HookData.HookAddr, HookData.newCode, HookData.HookCodeLen, 0);

// 脱钩
// 如果挂钩才进行脱钩，将原指令恢复
if (pByte[0] == 0xE9)
{
	WriteProcessMemory(GetCurrentProcess(), (LPVOID)HookData.HookAddr, HookData.oldCode, HookData.HookCodeLen, 0);
	return TRUE;
}

// Detour函数模板
Unhook() //脱钩
....  //执行目的代码
Hook() //挂钩

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

// 存储HOOK后第一个jmp
BYTE newJmp1[2] = { 0xEB,0xF9 };
// 存储HOOK后第二个jmp
BYTE newJmp2[5] = { 0xE9,0, };
// 存储HOOK前的Code
BYTE OldCode1[5] = { 0xCC,0xCC,0xCC,0xCC,0xCC };
BYTE OldCode2[2] = { 0x8B,0xFF };

// 挂钩
// 获取目标函数地址
HookData.HookAddr = (ULONG_PTR)GetProcAddress(GetModuleHandleA(HookData.szApiDllName), HookData.szHookApiName);
// 判断是否挂钩
if (pByte[0] == 0xEB)
   return FALSE;
hProcess = GetCurrentProcess();
// 计算Detour的相对地址并写入jmp指令中
*(ULONG_PTR*)(HookData.newJmp2 + 1) = HookData.pfnDetourFun - HookData.HookAddr;
// 将7字节指令替换原函数指令
WriteProcessMemory(hProcess, (LPVOID)(HookData.HookAddr - 5), HookData.newJmp2, HookData.HookCodeLen[0], 0);
WriteProcessMemory(hProcess, (LPVOID)HookData.HookAddr, HookData.newJmp1, HookData.HookCodeLen[1], 0);

// 脱钩
if (pByte[0] == 0xEB)
{
    // 恢复原函数指令
    WriteProcessMemory(GetCurrentProcess(), (LPVOID)(HookData.HookAddr - 5), HookData.OldCode1, HookData.HookCodeLen[0], 0);
    WriteProcessMemory(GetCurrentProcess(), (LPVOID)HookData.HookAddr, HookData.OldCode2, HookData.HookCodeLen[1], 0);
    return TRUE;
}

// Detour函数模板
// 如果需要在执行完目的代码后继续执行原函数
.... // 需要执行的目的函数
pFunc = GetProcAddress(GetModuleHandleA(HookData.szApiDllName), HookData.szHookApiName);
pFunc = pFunc + 2; //pFunc为原函数起始地址 + 2即跳过Short jmp到被替换指令的下一条指令
(定义的目标函数类型)pFunc(目标函数参数); //调用目标函数，从函数第二条指令开始执行函数

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// 检查目标函数起始指令是否存在jmp指令，有则跳过该指令，将Hook地址定位到下一条指令
pHookData->HookPoint = SkipJmpAddress(pHookData->HookPoint);
pHookData->JmpBackAddr = pHookData->HookPoint + pHookData->HookCodeLen;

// 将要替换的指令准备好，即jmp Detour地址指令的机器码
memset(pHookData->newEntry, 0, 14);
pHookData->newEntry[0] = 0xFF;
pHookData->newEntry[1] = 0x25;
*(ULONG_PTR*)(pHookData->newEntry + 6) = (ULONG_PTR)pHookData->pfnDetourFun;

// 将原函数指令保存好，并写入跳回原函数指令
PBYTE pFun = (PBYTE)pHookData->pfnTrampolineFun;
memcpy(pFun, (PVOID)pHookData->HookPoint, 14);
// 在原MessageBox中，存在一个cmp指令，该指令使用了一个相对地址，因此对相对地址要进行重定位
//cmp的目标地址与当前地址相差0x38600左右，
// 因此我们申请的128字节大小空间不能容纳 cmp取的地址，已经超出我们的范围
// 所以通过申请的内存空间中空余的空间作为该相对地址的目标地址
*(ULONG*)(pFun + 10) = (ULONG)(((ULONG_PTR)pFun + 20) - ((ULONG_PTR)pFun + 14));
pFun += 14;
pFun[0] = 0xff;
pFun[1] = 0x25;
*(ULONG_PTR*)(pFun + 6) = pHookData->JmpBackAddr;

// 挂钩
// 保存原指令
ReadProcessMemory(hProcess, OriginalAddr, pHookData->oldEntry, pHookData->HookCodeLen, &dwBytesReturned);
// 替换原指令
WriteProcessMemory(hProcess, OriginalAddr, pHookData->newEntry, pHookData->HookCodeLen, &dwBytesReturned);

// 脱钩
// 恢复原指令
WriteProcessMemory(hProcess, OrigianlAddr, pHookData->oldEntry, pHookData->HookCodeLen, &dwBytesReturned);

1
2
3
4
5
6

ULONG DataOffset;
// 计算原目的地址
ULONG_PTR pData = (ULONG_PTR)pHookData->HookPoint + 7 + 7 + *(ULONG*)(pHookData->HookPoint + 10);
// 计算相对地址 = 目的地址-当前地址-指令长度
DataOffset = (ULONG)(pData - ((ULONG_PTR)pFun + 14));
*(ULONG*)(pFun + 10) = DataOffset;

1
2
3
4
5
6

// 计算原目的地址
ULONG_PTR pData = (ULONG_PTR)pHookData->HookPoint + 7 + 7 + *(ULONG*)(pHookData->HookPoint + 10);
// 获取原目的地址的值并写入空闲空间
*(ULONG*)((ULONG_PTR)pFun + 30) = *(ULONG*)pData;
// 将重定位的目的地址计算出的相对地址写入cmp指令
*(ULONG*)(pFun + 10) = (ULONG)(((ULONG_PTR)pFun + 30) - ((ULONG_PTR)pFun + 14));

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

// 获取目标函数地址
HMODULE hMod = LoadLibrary(hModToHook);
g_AddrofMessageBoxA = (PVOID)GetProcAddress(hMod, hFuncToHook);

// 获取trampoline函数地址
g_OriginalMessageBoxA = (PFN_MessageBox)InitTrampolineFunc();
// InitTrampolineFunc()函数
AddrofTrampoline = (PBYTE)VirtualAlloc(NULL, 128, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
retAddrOfTrampoline = (ULONG_PTR)AddrofTrampoline;
memset(AddrofTrampoline, 0, 128);
memcpy(AddrofTrampoline, (PVOID)g_AddrofMessageBoxA, 4);
AddrofTrampoline += 4;
AddrofTrampoline[0] = 0xff;
AddrofTrampoline[1] = 0x25;
*(ULONG_PTR*)(AddrofTrampoline + 6) = (ULONG_PTR)g_AddrofMessageBoxA + 4;
return retAddrOfTrampoline;

// Detour函数
int result;
result = g_OriginalMessageBoxA(hWnd, "Hooked By VEH", lpCaption, uType);
return result;

// VEH异常处理函数
 ULONG_PTR* uRsp = 0;
// 可以直接更改参数后再次调用trampoline(已经跳过0xCC)
// 
//pContextRecord->Rdx = (ULONG_PTR)szNewText;
//pContextRecord->Rip = (ULONG_PTR)g_OriginalMessageBoxA;
// 
// 也可以把Rip改为自己写的Detour,但是要把Rsp对应变化 并在调用Detour后让Rip指向返回地址
// 刚调用目标函数时，栈顶为调用MessageBox时存的返回地址
//保存原RSP的值
uRsp = (ULONG_PTR*)pContextRecord->Rsp;
// 调用Detour
ret = MyDetour((HWND)pContextRecord->Rcx, (LPCSTR)pContextRecord->Rdx, (LPCSTR)pContextRecord->R8, (int)pContextRecord->R9);
// 手动保持栈平衡，模拟pop，因为将要手动设置异常处理结束后要执行的代码地址，程序就不会自动pop出去。
pContextRecord->Rsp += sizeof(ULONG_PTR);
// 将RIP设置为调用MessageBox时存的返回地址
pContextRecord->Rip = uRsp[0];

// 设置INT3断点
// 保存原指令
g_OldCode[0] = *pTarget;
MEMORY_BASIC_INFORMATION mbi;
// 写入0XCC
VirtualQuery(pTarget, &mbi, sizeof(mbi));
VirtualProtectEx(GetCurrentProcess(), mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOld);
*pTarget = 0xCC;
VirtualProtectEx(GetCurrentProcess(), mbi.BaseAddress, mbi.RegionSize, dwOld, 0);

// 脱钩
BYTE* pTarget = (BYTE*)pFuncAddr;
MEMORY_BASIC_INFORMATION mbi;
// 将INT3指令还原
VirtualQuery(pTarget, &mbi, sizeof(mbi));
VirtualProtectEx(GetCurrentProcess(), mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &dwOld);
*pTarget = g_OldCode[0];
VirtualProtectEx(GetCurrentProcess(), mbi.BaseAddress, mbi.RegionSize, dwOld, 0);
// 卸载VEH异常处理程序
UninstallVEH();