#include "stdafx.h"
#include <tchar.h>
#include <strsafe.h>

LONG WINAPI MyUnFilterA (_EXCEPTION_POINTERS *lpExceptionInfo);
const unsigned long Hookaddr = 0x100675B;

unsigned long ulProtect;

void DebugPrint(__format_string STRSAFE_LPCWSTR pszFormat, ...)
{
	va_list va;
	va_start(va, pszFormat);

	wchar_t* pszDebug = new wchar_t[256];

	StringCchVPrintf(pszDebug, 256, pszFormat, va);
	OutputDebugString(pszDebug);

	delete[] pszDebug;

	va_end(va);
}

__declspec(naked) VOID MyHook()
{
	OutputDebugString(_T("Hook_"));
	__asm
	{
		push ebx
		mov eax,Hookaddr
		add eax,1
		jmp eax
	}
}

DWORD WINAPI MyThreadFunction( LPVOID lpParam ) 
{
	//添加VEH处理
	SetUnhandledExceptionFilter(MyUnFilterA);
	//修改内存属性
	VirtualProtect((LPVOID)Hookaddr, 1, PAGE_NOACCESS, &ulProtect);
	return 0;
}

BOOL APIENTRY DllMain( HMODULE hModule,
	DWORD  ul_reason_for_call,
	LPVOID lpReserved
	)
{
	UNREFERENCED_PARAMETER(lpReserved);
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		{
			CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&MyThreadFunction, (void*)hModule, 0, NULL);
		}
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

LONG WINAPI MyUnFilterA (_EXCEPTION_POINTERS *lpExceptionInfo)
{
	if (lpExceptionInfo->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION)
	{
		if (lpExceptionInfo->ContextRecord->Eip == Hookaddr)
		{
			//如果报错的地址是Hookaddr就跳转
			lpExceptionInfo->ContextRecord->Eip = (DWORD)MyHook;
			return EXCEPTION_CONTINUE_EXECUTION;
		}
		else
		{
			//如果不是就修改内存属性，记录下地址。
			DebugPrint(L"addr %X ,EIP %X",lpExceptionInfo->ExceptionRecord->ExceptionAddress,lpExceptionInfo->ContextRecord->Eip);
			VirtualProtect((LPVOID)lpExceptionInfo->ExceptionRecord->ExceptionAddress, 1, PAGE_EXECUTE_READWRITE, &ulProtect);
			return EXCEPTION_CONTINUE_EXECUTION;
		}
	}
	else return EXCEPTION_CONTINUE_SEARCH;
}

[课程]Linux pwn 探索篇！