Windows下的函数hook技术

Windows下的函数hook技术都是很成熟的东西了，这几天看了看，总结一下而已。讨论了Windows下hook函数的几种方法。提供了一个hookTextOutA的完整例子。通过CreateRemoteThread的方法把hookdll注入到一个普通的应用程序中。HookingImportedFunctionsbyname调用importedfunctions'时的步骤/实现在程序中调用从其它模块引入的函数的方法和普通的函数调用有所不同。对于普通的函数调用，直接使用calladdress来调用即可，但是对于importedfunctions，在编译的时候compiler/link并不知道实际的函数实现会被加载到那个地址，函数实现在那个地址在运行的时候才会确定。对于importedfunctions，首先是call引入表中的一个函数，在运行时再初始化引入表，使用jmp跳转到真实的函数实现。引入表：

ThePEfileIMAGE_IMPORT_DESCRIPTORstructure,whichholdsalltheinformationaboutfunctionsimportedfromaspecificDLL,haspointerstotwoarraysintheexecutable.Thesearraysarecalledimportaddresstables(IATs),orsometimesthunkdataarrays.ThefirstpointerreferencestherealIAT,whichtheprogramloaderfixesupwhentheexecutableisloaded.ThesecondpointerreferencestheoriginalIAT,whichisuntouchedbytheloaderandliststheimportedfunctions.实现原理找到PE文件的Image_Import_Descriptor结构找到OriginalLAT和RealLAT.通过要hook的函数的名字在OriginalLAT找到要hook的importedfunction在数组中的index.保存并修改RealLAT在相应index的functionaddress(refertoJohnRobbins,BugsLayerUtil.dll)HookingImportedFunctionsbyordinal原理和HookImportedfunctionsbyname一样，只是是通过要hook的函数的ordinal在originalLAT中找到index.Hookingafunctioninthisdll

当一个DLL是通过LoadLibrary载入的时候，我们无法通过hookimportedfunction的方法的hook它中的function

。有两种可能的办法处理这种情况：

第一种方法，遍历进程空间，发现call指定函数的地方替换为callhookFunction.太麻烦，而且不安全。

第二种方法，改写要hook的函数FuncA

。比较好的方法实现HookFuncA，最后的实现垫入n个nop.找到要hook的函数FuncA的绝对地址，改写前5个字节为jmphookFuncA(假定前5个字节为n个完整的指令)把FuncA的前5个字节拷贝到hookFuncA的后面，在加上一条指令jmpfuncA+5.

CodeofHookDLL.dll,可以通过CreateRemoteThread的方法把hookdll注入到一个普通的应用程序中。//HookDLL.cpp:DefinestheentrypointfortheDLLapplication.

//

#include"stdafx.h"

#include"HookDLL.h"

#include"Log.h"

//forwarddeclare.

LRESULTWINAPIInstallTextoutHook();

LRESULTWINAPIUninstallTextoutHook();

BOOLAPIENTRYDllMain(HANDLEhModule,

DWORDul_reason_for_call,

LPVOIDlpReserved

)

{

switch(ul_reason_for_call)

{

caseDLL_PROCESS_ATTACH:

if(InstallTextoutHook())

{

WriteLog("Installhooksuccess.\n");

}else

{

WriteLog("Intallhookfailed.\n");

}

break;

caseDLL_THREAD_ATTACH:

break;

caseDLL_THREAD_DETACH:

break;

caseDLL_PROCESS_DETACH:

if(UninstallTextoutHook())

{

WriteLog("Uninstallhooksuccess.\n");

}else

{

WriteLog("Unintallhookfailed.\n");

}

break;

}

returnTRUE;

}

#defineDWORD_PTRDWORD*

#define__LOCAL_SIZE40h

#defineNAKED_PROLOG()\

DWORD_PTRdwRet;\

DWORD_PTRdwESI;\

{\

__asmPUSHEBP/*Setupthestandardframe.*/\

__asmMOVEBP,ESP\

__asmSUBESP,__LOCAL_SIZE/*Saveroomforthelocal*/\

/*variables.*/\

__asmMOVEAX,EBP/*EBPhasthestackcoming*/\

/*intothefn.init.*/\

__asmADDEAX,4/*AccountforPUSHEBP*/\

__asmMOVEAX,[EAX]/*Getreturnaddress.*/\

__asmMOV[dwRet],EAX/*Savereturnaddress.*/\

__asmMOV[dwESI],ESI/*SaveESIsochkespindbg*/\

/*buildsworks.*/\

}//Thecommonepilogpartthatcanbesharedbetweenthestdcalland

//cdeclhookfunctions.

#defineEPILOG_COMMON()\

{\

__asmMOVESI,[dwESI]/*RestoreESI.*/\

__asmADDESP,__LOCAL_SIZE/*Takeawaylocalvarspace*/\

__asmMOVESP,EBP/*Restorestandardframe.*/\

__asmPOPEBP\

}

#defineCOPY_CODE_LENGTH5

BYTEg_abOriCode[COPY_CODE_LENGTH];

BYTEg_abJmpCode[COPY_CODE_LENGTH];

PROCg_oriTextout;

BOOLg_blHooked=FALSE;

LRESULTWINAPIInstallTextoutHook()

{

if(g_blHooked)

returnTRUE;

//GetTextOutA'saddress.

HMODULEhGdi32=::LoadLibrary(_T("Gdi32.dll"));

g_oriTextout=GetProcAddress(hGdi32,_T("TextOutA"));

if(NULL==g_oriTextout)

returnFALSE;

//Getthehook'aaddress.

HMODULEhModule=GetModuleHandle(_T("HookDLL.dll"));

if(NULL==hModule)

returnFALSE;

DWORDdwHookAddr=NULL;

__asm

{

movesi,offsetHookLabel;

movedi,0x10000000;//0x10000000isthedll'sbaseaddress.

subesi,edi;

addesi,hModule;

mov[dwHookAddr],esi;

}

//GettheNOP'saddress.

DWORDdwNOPAddr=NULL;

__asm

{

movesi,offsetNOPLabel;

movedi,0x10000000;//0x10000000isthedll'sbaseaddress.

subesi,edi;

addesi,hModule;

mov[dwNOPAddr],esi;

}

//Savethefirst5byteofTextOutAtog_abOriCode

__asm

{

movesi,g_oriTextout;

leaedi,g_abOriCode;

cld;

movsd;

movsb;

}

//GeneratethejmpHookfunction.

g_abJmpCode[0]=0xe9;

__asm

{

moveax,dwHookAddr;

movebx,g_oriTextout;

addebx,5;

subeax,ebx;

movdwordptr[g_abJmpCode+1],eax;

}

//WritethejumpinstructiontothetextoutA.

DWORDdwProcessId=GetCurrentProcessId();

HANDLEhProcess=OpenProcess(PROCESS_ALL_ACCESS,

FALSE,dwProcessId);

if(NULL==hProcess)

returnFALSE;

DWORDdwOldFlag;

VirtualProtectEx(hProcess,g_oriTextout,5,PAGE_READWRITE,&dwOldFlag);

WriteProcessMemory(hProcess,g_oriTextout,g_abJmpCode,sizeof(g_abJmpCode),NULL);

VirtualProtectEx(hProcess,g_oriTextout,5,dwOldFlag,NULL);

//Writeg_abOriTextouttotheendofHookfunction(NOPaddr),thenwritethejmpinstruction.

VirtualProtectEx(hProcess,(LPVOID)dwNOPAddr,10,PAGE_READWRITE,&dwOldFlag);

WriteProcessMemory(hProcess,(LPVOID)dwNOPAddr,g_abOriCode,sizeof(g_abOriCode),NULL);

//GeneratethejmpTextoutA+5

__asm

{

moveax,g_oriTextout;

movebx,dwNOPAddr;

addebx,5;

subeax,ebx;

movdwordptr[g_abJmpCode+1],eax;

}

WriteProcessMemory(hProcess,(LPVOID)(dwNOPAddr+5),g_abJmpCode,sizeof(g_abJmpCode),NULL);

VirtualProtectEx(hProcess,(LPVOID)dwNOPAddr,10,dwOldFlag,NULL);

g_blHooked=TRUE;

if(TRUE)

returnTRUE;

HookLabel:

NAKED_PROLOG();

intnx,ny;

LPCSTRlp;

lp=NULL;

_asm

{

movesi,ebp;

addesi,0Ch;

leaedi,nx;

movsd;

leaedi,ny;

movsd;

leaedi,lp;

movsd;

}

WriteLog_F("Trytoouput\"%s\"at(%d,%d)\n",lp,nx,ny);

//Dothecommonepilog.

EPILOG_COMMON();

NOPLabel:

_asmNO