Qt库实现WebView下自解析功能

Qt WebEngineView解析功能是由QtWebEngineProcess.exe模块完成，此模块的启动参数中可设置自定义的域名到ip的解析参数

因此主要思路在于修改QtWebEngineProcess.exe启动参数，在我们自己的Webview程序启动QtWebEngineProcess.exe进程时将它hook住，然后修改参数后，让它加入自定义的域名解析参数后启动，hook采用远程线程注入的方式，hook工程以资源上传

调用hook相关代码如下，外部进程直接调用SetDnsHook与UnHookDns即可：

void SetDNSHook()

{

#if defined(_WIN64)/* || defined(_WIN32)*/

    EnableDebugPriv();

    int nMode = INJECT_MODE;

    wchar_t szpath[256] = {0};

    QString currentPath = QCoreApplication::applicationDirPath();

    currentPath.replace("/", "\\");

    currentPath.toWCharArray(szpath);

    int size = sizeof(szpath) - wcslen(szpath) -1;

    wcscat_s(szpath, size, L"\\stealth.dll");

    InjectAllProcess(nMode, szpath);

#else

#endif

    return;

}

void UnHookDNS()

{

#if defined(_WIN64)/* || defined(_WIN32)*/

    EnableDebugPriv();

    int nMode = EJECT_MODE;

    TCHAR szpath[256] = {0};

    QString currentPath = QCoreApplication::applicationDirPath();

    currentPath.replace("/", "\\");

    currentPath.toWCharArray(szpath);

    int size = sizeof(szpath) - wcslen(szpath) -1;

    wcscat_s(szpath, size, L"\\stealth.dll");

    InjectAllProcess(nMode, szpath);

#else

#endif

    return;

}

BOOL EnableDebugPriv()

{

    HANDLE hToken;

    LUID Luid;

    TOKEN_PRIVILEGES tkp;

    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))

    {

        qDebug()<<"OpenProcessToken failed!";

        return FALSE;

    }

    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &Luid))

    {

        CloseHandle(hToken);

        qDebug()<<"LookupPrivilegeValue failed!";

        return FALSE;

    }

    tkp.PrivilegeCount = 1;

    tkp.Privileges[0].Luid = Luid;

    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof tkp, NULL, NULL))

    {

        qDebug()<<"AdjustTokenPrivileges failed!";

        CloseHandle(hToken);

    }

    else

    {

        qDebug()<<"privilege get!";

        return TRUE;

    }

}

BOOL InjectAllProcess(int nMode, LPCTSTR szDllPath)

{

    DWORD dwPID = 0;

    HANDLE hSnapshot = NULL;

    PROCESSENTRY32 pe = { sizeof(PROCESSENTRY32) };

    if (!(hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL)))

    {

        qDebug()<<"CreateToolhelp32Snapshot failed!";

        return FALSE;

    }

    Process32First(hSnapshot, &pe);

    do

    {

        dwPID = pe.th32ProcessID;

        char proinfo[256] = { 0 };

        sprintf(proinfo, "-processpid:%d-", pe.th32ProcessID);

        qDebug()<<proinfo;

        if (_wcsicmp(pe.szExeFile, L"TrustedWeb.exe") == 0 ||
_wcsicmp(pe.szExeFile, L"QtWebEngineProcess.exe") == 0) //TrustedWeb.exe是自身进程

        {

            char proinfo[256] = { 0 };

            sprintf(proinfo, "------processpid:%d------", pe.th32ProcessID);

            qDebug()<<proinfo;

            if (dwPID < 100)

                continue;

            if (nMode == INJECT_MODE)

            {

                char strinfo[256] = { 0 };

                if (!(inject(dwPID, szDllPath)))

                {

                    sprintf(strinfo, "%d inject failed!", dwPID);

                }

                else

                {

                    sprintf(strinfo, "%d inject suc!", dwPID);

                }

                qDebug()<<strinfo;

            }

            else if (nMode == EJECT_MODE)

            {

                char strinfo[256] = { 0 };

                if (!Eject(dwPID, szDllPath))

                {

                    sprintf(strinfo, "%d Eject failed!", dwPID);

                }

                else

                {

                    sprintf(strinfo, "%d Eject suc!", dwPID);

                }

                qDebug()<<strinfo;

            }

        }

    } while (Process32Next(hSnapshot, &pe));

    CloseHandle(hSnapshot);

    qDebug()<<"InjectAllProcess succ";

    return TRUE;

}

BOOL Eject(DWORD dwPID, LPCTSTR szDllPath)

{

    HANDLE hSnapshot = NULL;

    HANDLE hProcess = NULL;

    HANDLE hThread = NULL;

    BOOL bMore = FALSE;

    BOOL bFound = FALSE;

    LPTHREAD_START_ROUTINE pThreadProc;

    MODULEENTRY32 me = { sizeof(MODULEENTRY32) };

    if (!(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID)))

    {

        qDebug()<<"OpenProcess failed!";

        return FALSE;

    }

    if ((hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID)) == INVALID_HANDLE_VALUE)

    {

        qDebug()<<"CreateToolhelp32Snapshot failed!";

        CloseHandle(hProcess);

        return FALSE;

    }

    bMore = Module32First(hSnapshot, &me);

    for (; bMore; bMore = Module32Next(hSnapshot, &me))

    {

        if (!_wcsicmp(me.szModule, szDllPath) || !_wcsicmp(me.szExePath, szDllPath))

        {

            bFound = TRUE;

            break;

        }

    }

    if (!bFound)

    {

        qDebug()<<"Dll no found!";

        CloseHandle(hProcess);

        CloseHandle(hSnapshot);

        return FALSE;

    }

    pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "FreeLibrary");

    hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, (LPVOID)me.modBaseAddr, 0, NULL);

    if (!hThread)

    {

        qDebug()<<"Eject failed!";

        CloseHandle(hProcess);

        CloseHandle(hThread);

        return FALSE;

    }

    WaitForSingleObject(hThread, INFINITE);

    CloseHandle(hSnapshot);

    CloseHandle(hProcess);

    CloseHandle(hThread);

    qDebug()<<"Eject Succ";

    return TRUE;

}