BOOL Set_EAT_Hook(LPCWSTR lpModuleName,LPCSTR lpFuncName,LPVOID lpHookFunction,LPVOID* lpTrueFunction)
{
	__try
	{
		LPVOID pBase = NULL;
		pBase = GetModuleHandleW(lpModuleName);
		if (NULL == pBase)
		{
			pBase = LoadLibraryW(lpModuleName);
			if (NULL == pBase)
			{
				return FALSE;
			}
		}
		PIMAGE_DOS_HEADER pDosHeader = NULL;
		PIMAGE_NT_HEADERS pNtHeader = NULL;
		PIMAGE_OPTIONAL_HEADER pOpHeader = NULL;
		PIMAGE_EXPORT_DIRECTORY pExportDes = NULL;
		pDosHeader = (PIMAGE_DOS_HEADER)pBase;
		if (IMAGE_DOS_SIGNATURE != pDosHeader->e_magic)
		{
			return FALSE;
		}
		pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pBase + pDosHeader->e_lfanew);
		if (IMAGE_NT_SIGNATURE != pNtHeader->Signature)
		{
			return FALSE;
		}
		pOpHeader = (PIMAGE_OPTIONAL_HEADER)(&pNtHeader->OptionalHeader);
		if (NULL == pOpHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress
			|| 0 == pOpHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size)
		{
			return FALSE;
		}
		pExportDes = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)pBase + pOpHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
		PUCHAR pFuncName = NULL;
		PULONG pAddressOfFunctions = (PULONG)((PBYTE)pBase + pExportDes->AddressOfFunctions); 
		PULONG pAddressOfNames = (PULONG)((PBYTE)pBase + pExportDes->AddressOfNames); 
		//pExportDes->AddressOfNameOrdinals是一个DWORD的数值，指向一个word类型的数值
		PUSHORT pAddressOfNameOrdinals = (PUSHORT)((PBYTE)pBase + pExportDes->AddressOfNameOrdinals); 

		ULONG uMax = pExportDes->NumberOfNames;
		for (ULONG uLoop = 0; uLoop <uMax;  uLoop++)
		{
			USHORT index = pAddressOfNameOrdinals[uLoop];//得到在ENT里面的索引
			pFuncName = (PUCHAR)( (PBYTE)pBase + pAddressOfNames[uLoop]);//函数名字
			if(!_stricmp((const char*)pFuncName,lpFuncName))
			{
				//取函数地址的防范跟函数名字不一样
				LPVOID lpOldAddr = (LPVOID)((PBYTE)pBase + pAddressOfFunctions[index]);
				*lpTrueFunction = lpOldAddr;
				MEMORY_BASIC_INFORMATION mbi;
				RtlZeroMemory(&mbi,sizeof(MEMORY_BASIC_INFORMATION));
				VirtualQueryEx(GetCurrentProcess(),&pAddressOfFunctions[index],&mbi,sizeof(MEMORY_BASIC_INFORMATION));
				VirtualProtectEx(GetCurrentProcess(),mbi.BaseAddress,mbi.RegionSize,PAGE_READWRITE,&mbi.Protect);
				pAddressOfFunctions[index] = (ULONG)((PBYTE)lpHookFunction - (PBYTE)pBase);//这个在X64下，好像差值超过一个dword的大小，怎么办
				ULONG uOldProtect;
				VirtualProtectEx(GetCurrentProcess(),mbi.BaseAddress,mbi.RegionSize,mbi.Protect,&uOldProtect);
				break;
			}
		}
		return TRUE;
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		DWORD DwException = GetExceptionCode();
		WCHAR szDbg[MAX_PATH] = {0};
		swprintf_s(szDbg,L"EATHook except code = 0x%08lx\n",DwException);
		OutputDebugStringW(szDbg);
		return FALSE;
	}
}

typedef BOOL (WINAPI* P_GetVersionExW)(
				 _Inout_  LPOSVERSIONINFOW lpVersionInfo
				 );

P_GetVersionExW g_pGetVersionExW = NULL;

BOOL WINAPI Fake_GetVersionExW(
				       _Inout_  LPOSVERSIONINFOW lpVersionInfo
				       )
{
	OutputDebugStringW(L"Fake_GetVersionExW\r\n"); 
	return g_pGetVersionExW(lpVersionInfo);
}

int _tmain(int argc, _TCHAR* argv[])
{
	BOOL bRet4 = Set_EAT_Hook(L"kernelbase.dll","GetVersionExW",Fake_GetVersionExW,(LPVOID*)&g_pGetVersionExW);
	P_GetVersionExW pVer = (P_GetVersionExW)GetProcAddress(GetModuleHandleW(L"kernelbase.dll"),"GetVersionExW");
	OSVERSIONINFOW osvi;
	ZeroMemory(&osvi, sizeof(OSVERSIONINFOW));
	osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOW);
	pVer(&osvi);
	return 0;
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)