Win32，如何用C ++鈎住編譯程序中的函數？

Question

以這個功能為例（在Ollydbg調試器中查看）

第一條PUSH EBP指令是void * f（int32_t n）（它返回的結果，只是猜測void *）的開始，我知道輸入參數n在堆棧中，並且EBP + 8是指向該變量，我想這就像int * n =（int *）（uint32_t（EBP）+ 0x08）; / *假設EBP為void *，並且sizeof（EBP）== sizeof（uint32_t）== sizeof（void *），並且+8數學在c ++ uint32_t和x86匯編中是相同的。.* /

我想制作一個鈎子，它將檢查n是否大於7或小於0，如果是，則將其更改為1。使用ollydbg，直接編寫匯編代碼，我可以這樣做：修補第一個MOV EBP， ESP指令將JMP縮短到其后面的INT3指令（我需要7個字節），然后將（未使用的）INT3更改為MOV EBP，ESP JMP LONG 0068BCCD，其中0068BCCD指向文件末尾的未使用的0x000000000000

，然后在0068BCCD上，我可以編寫匯編代碼以檢查EBP + 8指向的int，並在必要時進行修改：

PUSHAD
CMP DWORD PTR SS:[EBP+8],7
JA SHORT Error
CMP DWORD PTR SS:[EBP+8],0
JL SHORT Error
JMP SHORT Finished
Error:
PUSHAD
PUSH OFFSET TheString
CALL Onlink-x86.App::Output
ADD ESP,4
POPAD
MOV DWORD PTR SS:[EBP+8],1
Finished:
POPAD
JMP LONG 00447493
TheString:
"Warning: label assertion failed, but (pretending its 1 and) trying to ignore.."+0x00

哪一個（如果我沒搞砸的話）基本上等於

void FilterIntAtEBP_8(){
int i=*(int*)(uint32_t(EBP)+8);
if(i>7 || i<0){
Output("Warning: label assertion failed, but (pretending its 1 and) trying to ignore..");
*(int*)(uint32_t(EBP)+8)=1;
}
return;
}

最后，這里是一個問題：我該如何使用C ++而不是Ollydbg來創建此鈎子？ （我看到一個源代碼，一個MMORPG作弊程序，鈎住了客戶端，這樣做，但是代碼對我來說是丟失的）

Answer 1

首先，您將要在目標進程中注入一個dll。 為此，您可以使用以下代碼：

噴油器

#ifndef INJECTOR_H_INCLUDED
#define INJECTOR_H_INCLUDED

#include <Windows.h>
#include <string>

class Injector
{
public:
    /**
     * Loads a DLL into the remote process
     * @Return true on sucess, false on failure
    */
    bool InjectDll(DWORD processId, std::string dllPath);
private:
};

#endif // INJECTOR_H_INCLUDED

噴油器

#include "Injector.h"

bool Injector::InjectDll(DWORD processId, std::string dllPath)
{
    HANDLE hThread, hProcess;
    void*  pLibRemote = 0;  // the address (in the remote process) where szLibPath will be copied to;

    HMODULE hKernel32 = GetModuleHandle("Kernel32");
    HINSTANCE hInst = GetModuleHandle(NULL);

    char DllFullPathName[_MAX_PATH];
    GetFullPathName(dllPath.c_str(), _MAX_PATH, DllFullPathName, NULL);

    // Get process handle
    hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);

    // copy file path in szLibPath
    char szLibPath[_MAX_PATH];
    strcpy_s(szLibPath, DllFullPathName);

    // 1. Allocate memory in the remote process for szLibPath
    pLibRemote = VirtualAllocEx( hProcess, NULL, sizeof(szLibPath), MEM_COMMIT, PAGE_READWRITE );

    if (pLibRemote == NULL)
    {
        // probably because you don't have administrator's right
        return false;
    }

    // 2. Write szLibPath to the allocated memory
    WriteProcessMemory(hProcess, pLibRemote, (void*)szLibPath, sizeof(szLibPath), NULL);

    // 3. Force remote process to load dll
    hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE) GetProcAddress(hKernel32,"LoadLibraryA"), pLibRemote, 0, NULL);

    if (hThread == NULL)
    {
        return false;
    }

    return true;
}

main.cpp

#include "Injector.h"
int main()
{
    Injector injector;
    DWORD processId = 1653; // change the process id here. 

    if (injector.InjectDll(processId, "injected.dll"))
    {
        printf("Good job, you injected the dll\n");
    }
    else
    {
        printf("Something wrong happened\n");
    }

    while (true);
}

然后，您必須制作您的dll。 這就是它變得更加復雜的地方。 首先包括：

注入文件

#include <Windows.h>
#include <stdio.h>

然后，我們需要制作一個可以繞開正確位置的函數：

void DetourAddress(void* funcPtr, void* hook, BYTE* mem)
{
    BYTE cmd[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 }; // jump place holder
    void* RVAaddr = (void*)((DWORD)funcPtr + (DWORD)GetModuleHandle(NULL)); // base + relative address

    // make memory readable/writable
    DWORD dwProtect;
    VirtualProtect(RVAaddr, 5, PAGE_EXECUTE_READWRITE, &dwProtect);

    // read memory
    ReadProcessMemory(GetCurrentProcess(), (LPVOID)RVAaddr, &mem[2], 5, NULL);

    // write jmp in cmd
    DWORD offset = ((DWORD)hook - (DWORD)RVAaddr - 5);  // (dest address) - (source address) - (jmp size)
    memcpy(&cmd[1], &offset, 4); // write address into jmp
    WriteProcessMemory(GetCurrentProcess(), (LPVOID)RVAaddr, cmd, 5, 0); // write jmp

    // write mem
    VirtualProtect(mem, 13, PAGE_EXECUTE_READWRITE, &dwProtect);

    void* returnAdress = (void*)((DWORD)RVAaddr + 5);
    memcpy(&mem[8], &returnAdress, 4); // write return address into mem

    // reprotect
    VirtualProtect(RVAaddr, 5, dwProtect, NULL);
}

如果您需要在某個時候刪除dll，則需要恢復代碼：

void PatchAddress(void* funcPtr, BYTE* mem)
{
    void* RVAaddr = (void*)((DWORD)funcPtr + (DWORD)GetModuleHandle(NULL)); // base + relative address

    // make memory readable/writable
    DWORD dwProtect;
    VirtualProtect(funcPtr, 5, PAGE_EXECUTE_READWRITE, &dwProtect);

    WriteProcessMemory(GetCurrentProcess(), (LPVOID)RVAaddr, &mem[2], 5, NULL); // write jmp

    VirtualProtect(RVAaddr, 5, dwProtect, NULL);
}

接下來，我們需要從繞行的字節中創建一個函數，以便程序執行它們，以便它不受繞行的影響。 將其添加到全局空間：

// memory (0x5E = pop esi, 0x68 = push DWORD, 0xC3 = RETN)
BYTE detourMem[13] = { 0x5E, 0x5E, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x00, 0x00, 0x00, 0x00, 0xC3 };

// Convert bytes array to function
typedef void ( * pFunc)();
pFunc funcMem = (pFunc) &detourMem;

// I also added a variable as an example of what you can do with it.
DWORD var = 0;

之后，您需要繞行功能：

_declspec(naked) void DetourFunction()
{
    // we need to push all flag and registers on the stack so we don't modify them by accident
    __asm
    {
        PUSHFD
        PUSHAD

        // You can do "whatever" you want here in assembly code
        // ex, put eax value into var:
        mov var, eax
    }

    printf("this code is executed everytime the detoured function is called\n");
    // Do whatever you want in c++ here
    if (var < 7)
    {
        // eax was smaller than 7
    }

    // We pop every flags and registers we first pushed so that the program continue as it was supposed to
    __asm
    {
        // we set everything back to normal
        POPAD
        POPFD
        push esi

        // we call our funcMem
        mov edx, funcMem;
        call edx
    }
}

最后，這是您的DLLMain的樣子：

BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved  )
{
    DWORD detouredAddress = 0x689B; // add the RELATIVE ADDRESS of the location you want to detour
    FILE *stream;
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        // Only add this if you want a console to appears when you inject your dll (don't forget FreeConsole when you remove the dll)
        AllocConsole();
        freopen_s(&stream, "CONOUT$", "w", stdout);

        // If you need to know the base address of the process your injected:   
        printf("base address: 0x%X\n", (DWORD)GetModuleHandle(NULL));

        // Our detour function
        DetourAddress((void*)detouredAddress, (void*)&DetourFunction, detourMem);
        break;
    case DLL_PROCESS_DETACH:
        // We restore the process to have what it was before it was injected
        PatchAddress((void*)detouredAddress, detourMem);

        FreeConsole();
        break;
    }

    return true;
}

我了解這是一次很多，所以如果您有任何疑問，請不要猶豫！