//定义函数原型
typedef int (WINAPI *PFNMESSAGEBOX)(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType);
//保存原始的MessageBox地址,注意这里
PROC g_orgProc = (PROC)MessageBox;
int WINAPI MyMessageBox(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType)
{
printf("%x",(DWORD)MyMessageBox);
printf("123");
return ((PFNMESSAGEBOX)g_orgProc)(hWnd, "mymessagebox1111", "成功", uType);
}
//=========================================
// 函数名: EnableDebugPrivilege
// 输 入: bEnable(BOOL) - 提升:TRUE, 恢复:FALSE
// 输 出: BOOL - 成功:TRUE, 失败:FALSE
// 功 能: 提升/恢复权限
//=========================================
bool EnableDebugPriv(const char * name)
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
LUID luid;
//打开进程令牌环
if(!OpenProcessToken(GetCurrentProcess(),//取得句柄的令牌 OpenProcessToken()函数
TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,
&hToken) )
{
printf("OpenProcessToken error./n");
return FALSE;
}
//获得进程本地唯一ID
if(!LookupPrivilegeValue(NULL,name,&luid) )//一个权限对应的LUID值
{
printf("LookupPrivilege error!/n");
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
tp.Privileges[0].Luid = luid;
//调整权限
if(!AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL) )//调用AdjustTokenPrivileges对这个访问令牌进行修改
{
printf("AdjustTokenPrivileges error!/n");
return FALSE;
}
return TRUE;
}
void SetHook()
{
HMODULE hModule = ::GetModuleHandleA(NULL);
IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)hModule;
IMAGE_OPTIONAL_HEADER* pOpNtHeader = (IMAGE_OPTIONAL_HEADER*)((BYTE*)hModule + pDosHeader->e_lfanew + 24); //这里加24
IMAGE_IMPORT_DESCRIPTOR* pImportDesc = (IMAGE_IMPORT_DESCRIPTOR*)((BYTE*)hModule + pOpNtHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
BOOL bFindDll = FALSE;
while (pImportDesc->FirstThunk)
{
char* pszDllName = (char*)((BYTE*)hModule + pImportDesc->Name);
printf("模块名称:%s\n", pszDllName);
if (stricmp(pszDllName, "user32.dll") == 0)//如果是user32.dll
{
bFindDll = TRUE;
break;
}
pImportDesc++;
}
if (bFindDll)
{
DWORD n = 0;
//一个IMAGE_THUNK_DATA就是一个导入函数
IMAGE_THUNK_DATA* pThunk = (IMAGE_THUNK_DATA*)((BYTE*)hModule + pImportDesc->OriginalFirstThunk);
while (pThunk->u1.Function)
{
//取得函数名称
char* pszFuncName = (char*)((BYTE*)hModule+pThunk->u1.AddressOfData+2); //函数名前面有两个..
printf("function name:%-25s, ", pszFuncName);
//在这里是比较的函数名称
if (stricmp(pszFuncName, "MessageBoxA") == 0)
{
//取得函数地址
PDWORD lpAddr = (DWORD*)((BYTE*)hModule + pImportDesc->FirstThunk) + n; //从第一个函数的地址，以后每次+4字节
//在这里是比较的函数地址
printf("addrss:%X\n", lpAddr);
DWORD* lpNewProc = (DWORD*)MyMessageBox;
DWORD OldProtect = 0;
DWORD NewProtect = 0;
VirtualProtect(lpAddr, sizeof(DWORD), PAGE_READWRITE, &OldProtect); //将指定内存设为可读写
if (!WriteProcessMemory(GetCurrentProcess(), lpAddr, &lpNewProc, sizeof(DWORD), NULL))
{
printf("写入失败！\n");
return;
}
VirtualProtect(lpAddr, sizeof(DWORD), OldProtect, &NewProtect );
printf("成功写入！\n");
return;
}
n++; //每次增加一个DWORD
}
printf("\n");
}
}
/*
int main(int argc, char* argv[])
{
::MessageBoxA(NULL, "before hook", "", MB_OK);
EnableDebugPriv(SE_DEBUG_NAME);
SetHook();
::MessageBoxA(NULL, "AFTERE hook", "", MB_OK);
return 0;
}*/
BOOL WINAPI DllMain( HMODULE hInstance,
DWORD fdwReason,
LPVOID lp)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
MessageBox(NULL, "DLL加载成功！", NULL, MB_OK);
if (!EnableDebugPriv(SE_DEBUG_NAME))
{
MessageBox(NULL, "提权失败！", NULL, MB_OK);
}
MessageBox(NULL, "提权成功！", NULL, MB_OK);
MessageBox(NULL, "提权成功！11111", NULL, MB_OK);
SetHook();
break;
case DLL_THREAD_ATTACH:
case DLL_PROCESS_DETACH:
case DLL_THREAD_DETACH:
break;
}
return TRUE;
}
