code hook findfirstfileEx

最新推荐文章于 2023-08-28 09:48:25 发布

pengdawei521

最新推荐文章于 2023-08-28 09:48:25 发布

阅读量309

点赞数

CC 4.0 BY-SA版权

分类专栏： Programming 文章标签： hook winapi search dll null struct

本文链接：https://blog.youkuaiyun.com/pengdawei521/article/details/1757901

Programming 专栏收录该内容

17 篇文章

订阅专栏

本文介绍了一个DLL应用示例，通过DLL注入技术重定向Windows API函数FindFirstFileEx，实现文件搜索操作的日志记录功能。该技术使用Detours库进行函数钩子设置，适用于Windows系统下的文件操作监控。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

// HookFindFirstFileEx.cpp : Defines the entry point for the DLL application.
//

#include "stdafx.h"
#include "stdio.h"
#include <Windows.h>
#include "./include/detours.h"

///////////////////////////////////////
#define _WIN32_WINNT 0x0400

/*typedef struct _WIN32_FIND_DATA2
{
   DWORD dwFileAttributes;
   FILETIME ftCreationTime;
   FILETIME ftLastAccessTime;
   FILETIME ftLastWriteTime;
   DWORD nFileSizeHigh;
   DWORD nFileSizeLow;
   DWORD dwReserved0;
   DWORD dwReserved1;
   WCHAR cFileName[MAX_PATH];
   WCHAR cAlternateFileName[14];
}
WIN32_FIND_DATA2, *PWIN32_FIND_DATA2;*/

typedef enum _FINDEX_INFO_LEVELS
{
   FindExInfoStandard
}
FINDEX_INFO_LEVELS;

typedef enum _FINDEX_SEARCH_OPS
{
   FindExSearchNameMatch,
   FindExSearchLimitToDirectories,
   FindExSearchLimitToDevices
} FINDEX_SEARCH_OPS;

extern "C" HANDLE WINAPI FindFirstFileExA(
LPCTSTR lpFileName,
FINDEX_INFO_LEVELS fInfoLevelId,
LPVOID lpFindFileData,
FINDEX_SEARCH_OPS fSearchOp,
LPVOID lpSearchFilter,
DWORD dwAdditionalFlags
);

extern "C" HANDLE WINAPI FindFirstFileExW(
LPCWSTR lpFileName,
FINDEX_INFO_LEVELS fInfoLevelId,
LPVOID lpFindFileData,
FINDEX_SEARCH_OPS fSearchOp,
LPVOID lpSearchFilter,
DWORD dwAdditionalFlags
);

BOOL InstallProbes();
BOOL UninstallProbes();

DETOUR_TRAMPOLINE( HANDLE WINAPI Real_FindFirstFileExA( LPCTSTR a0, FINDEX_INFO_LEVELS a1, LPVOID a2, FINDEX_SEARCH_OPS a3, LPVOID a4, DWORD a5 ), FindFirstFileExA );
DETOUR_TRAMPOLINE( HANDLE WINAPI Real_FindFirstFileExW( LPCWSTR a0, FINDEX_INFO_LEVELS a1, LPVOID a2, FINDEX_SEARCH_OPS a3, LPVOID a4, DWORD a5 ), FindFirstFileExW );

HANDLE WINAPI MyFindFirstFileExA( LPCTSTR lpFileName,
                                  FINDEX_INFO_LEVELS fInfoLevelId,
                                  LPVOID lpFindFileData,
                                  FINDEX_SEARCH_OPS fSearchOp,
                                  LPVOID lpSearchFilter,
                                  DWORD dwAdditionalFlags );

HANDLE WINAPI MyFindFirstFileExW( LPCWSTR lpFileName,
                                  FINDEX_INFO_LEVELS fInfoLevelId,
                                  LPVOID lpFindFileData,
                                  FINDEX_SEARCH_OPS fSearchOp,
                                  LPVOID lpSearchFilter,
                                  DWORD dwAdditionalFlags );

/////////////////////////////
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD ul_reason_for_call,
                       LPVOID lpReserved
                   )
{
   if( DLL_PROCESS_ATTACH == ul_reason_for_call )//dll加载
   {
       InstallProbes();
   }
   else if( DLL_PROCESS_DETACH == ul_reason_for_call )//dll卸载
   {
       UninstallProbes();
   }
   else;

    return TRUE;
}

BOOL InstallProbes()
{
   DetourFunctionWithTrampoline( (PBYTE)Real_FindFirstFileExA, (PBYTE)MyFindFirstFileExA );
   DetourFunctionWithTrampoline( (PBYTE)Real_FindFirstFileExW, (PBYTE)MyFindFirstFileExW );
#ifdef _DEBUG
   OutputDebugString("InstallProbes ok./n");
#endif
   return TRUE;
}

BOOL UninstallProbes()
{
   DetourRemove( (PBYTE)Real_FindFirstFileExA, (PBYTE)MyFindFirstFileExA );
   DetourRemove( (PBYTE)Real_FindFirstFileExW, (PBYTE)MyFindFirstFileExW );

#ifdef _DEBUG
   OutputDebugString("UNInstallProbes ok./n");
#endif
   return TRUE;
}

////////////////////////////////////////////////////////
HANDLE WINAPI MyFindFirstFileExA( LPCTSTR lpFileName,
                                  FINDEX_INFO_LEVELS fInfoLevelId,
                                  LPVOID lpFindFileData,
                                  FINDEX_SEARCH_OPS fSearchOp,
                                  LPVOID lpSearchFilter,
                                  DWORD dwAdditionalFlags )
{
   TCHAR sz[300];
   sprintf( sz, "MyFindFirstFileExA :%s /n", lpFileName );
   OutputDebugString( sz );

   return Real_FindFirstFileExA( lpFileName, fInfoLevelId, lpFindFileData, fSearchOp, lpSearchFilter, dwAdditionalFlags );
}

HANDLE WINAPI MyFindFirstFileExW( LPCWSTR lpFileName,
                                  FINDEX_INFO_LEVELS fInfoLevelId,
                                  LPVOID lpFindFileData,
                                  FINDEX_SEARCH_OPS fSearchOp,
                                  LPVOID lpSearchFilter,
                                  DWORD dwAdditionalFlags )
{
   char strTemp[256*2];
   TCHAR sz[300];

   WideCharToMultiByte( CP_ACP, 0, (LPCWSTR)lpFileName, -1, strTemp, 256, NULL, NULL );
   sprintf( sz, "MyFindFirstFileExW :%s /n", strTemp );
   OutputDebugString( sz );

   return Real_FindFirstFileExW( lpFileName, fInfoLevelId, lpFindFileData, fSearchOp, lpSearchFilter, dwAdditionalFlags );
}