使用x86的detours库编写hook-dll

最新推荐文章于 2024-04-19 10:21:00 发布

deerleaper

最新推荐文章于 2024-04-19 10:21:00 发布

阅读量917

点赞数

CC 4.0 BY-SA版权

分类专栏： Windows

本文链接：https://blog.youkuaiyun.com/deerleaper/article/details/17997787

Windows 专栏收录该内容

88 篇文章

订阅专栏

以CreateFileW为例，一般都要hook带W的api，因为windows系统底层调用的基本上都是W版本的API。

1、定义detour库需要hook的windows api

//filehookdetour.h
#include <Windows.h>
#include <detours.h>

#pragma comment(lib,"detours.lib")


typedef HANDLE (WINAPI *HOOK_CreateFileW)(LPCWSTR lpFileName,
										DWORD dwDesiredAcces, 
										DWORD dwShareMode, 
										LPSECURITY_ATTRIBUTES lpSecurityAttributes,
										DWORD dwCreationDisposition, 
										DWORD dwFlagsAndAttributes,
										HANDLE hTemplateFile);

HOOK_CreateFileW						g_initCreateFileW = NULL;
HOOK_CreateFileW						g_finalCreateFileW = NULL;

HANDLE WINAPI MY_CreateFileW( LPCWSTR lpFileName,
							  DWORD dwDesiredAcces, 
							  DWORD dwShareMode, 
							  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
							  DWORD dwCreationDisposition, 
							  DWORD dwFlagsAndAttributes,
							  HANDLE hTemplateFile)
{
	if (lpFileName)
	{
		//TO DO...
	}
	return g_finalCreateFileW(lpFileName, dwDesiredAcces, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
}


void InitHook()
{
	g_initCreateFileW = (HOOK_CreateFileW)DetourFindFunction("Kernel32.dll", "CreateFileW");
	g_finalCreateFileW = (HOOK_CreateFileW)DetourFunction((PBYTE)g_initCreateFileW, (PBYTE)MY_CreateFileW);
	
}

void UnHook()
{
	DetourRemove((PBYTE)g_finalCreateFileW,(PBYTE)MY_CreateFileW);
}

2、定义dll导出接口

//filehook.h
#ifdef FILEHOOK_EXPORTS
#define FILEHOOK_API __declspec(dllexport)
#else
#define FILEHOOK_API __declspec(dllimport)
#endif

FILEHOOK_API  bool InstallHook(HINSTANCE hInstance);
FILEHOOK_API  bool RemoveHook();

3、定义define文件

LIBRARY FileHook
EXPORTS
InstallHook @1
RemoveHook @2

SECTIONS
.phk READ WRITE SHARED

编译之后的文件名为：FileHook.dll

4、定义DllMain

//filehook.cpp

#include"filehook.h"
#include"filehookdetour.h"

#pragma data_seg(".phk")
HHOOK g_Hook = NULL;//放在共享数据区
#pragma data_seg()


BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved
					 )
{
    switch (ul_reason_for_call)
	{
		case DLL_PROCESS_ATTACH:
			InitHook();//call InitHook() here
			break;
		case DLL_THREAD_ATTACH:
			break;
		case DLL_THREAD_DETACH:
			break;
		case DLL_PROCESS_DETACH:
			UnHook();//call UnHook() here
			break;
    }
    return TRUE;
}


LRESULT CALLBACK CallWndProc(int nCode,WPARAM wParam,LPARAM lParam)
{
	return CallNextHookEx(g_Hook, nCode,wParam,lParam);
}


bool InstallHook(HINSTANCE hInstance)
{
	if(g_Hook == NULL)
	{
		g_Hook = SetWindowsHookEx(WH_CALLWNDPROC,CallWndProc,hInstance,0);
		if(g_Hook)
		{ 
		   return true;
		}
		else
		{
		   return false;
		}
	}
	return true;
}


bool RemoveHook()
{
	if(g_Hook != NULL)
	{
		if(!UnhookWindowsHookEx(g_Hook))
		{	
			DWORD dwEr= GetLastError();
			if (dwEr==0)//句柄非法
			{
				ghPrintHook=NULL;
			}
			return false;
		}
		g_Hook = NULL;
	}
	return true;
}

5、调用

void TestFileHook()
{
	typedef bool (*API_InstallHook)(HINSTANCE);
	API_InstallHook pInstallHook;
	typedef bool (*API_RemoveHook)();
	API_RemoveHook m_pRemoveHook;

	HINSTANCE hInstance = LoadLibrary(TEXT("FileHook.dll"));

	if(hInstance  != NULL)
	{
		pInstallHook = (API_InstallHook)GetProcAddress((hInstance  ,"InstallHook");
		pRemoveHook = (API_RemoveHook)GetProcAddress((hInstance  ,"RemoveHook");
	}
	
	pInstallHook(hInstance);
	//to do your actions here...
	
	pRemoveHook();
	FreeLibrary(hInstance);
	hInstance = NULL;
}