今天看到论坛里一篇文章:
http://bbs.pediy.com/showthread.php?t=143432
我也想试试,就写了一段奇丑无比的代码,尝试用veh进行hook一个函数:(4楼有C写的代码)
.386
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\user32.inc
includelib \masm32\lib\user32.lib
include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib
;数据段
.data
ctx CONTEXT <0>
hcurrentthread dd 0h
szkernel32 db "kernel32.dll",0h
hkernel32 dd 0h
szExitProcess db "ExitProcess",0h
hExitProcess dd 0h
sztext db "breakpoint occured!",0h
sztitle db "qqand360",0h
;数据段?
.data?
;代码段
.code
sethwbreakpoint proc address:dword
pushad
mov ctx.ContextFlags,CONTEXT_ALL
invoke GetCurrentThread
mov hcurrentthread,eax
invoke GetThreadContext,eax,addr ctx
mov eax,address
mov ctx.iDr0,eax
invoke SetThreadContext,hcurrentthread,addr ctx
popad
ret
sethwbreakpoint endp
exceptionhandler proc exceptioninfo:dword
local @dwret:dword
pushad
mov ebx,exceptioninfo
assume ebx:ptr EXCEPTION_POINTERS
mov eax,[ebx].pExceptionRecord
assume eax:ptr EXCEPTION_RECORD
mov eax,[eax].ExceptionAddress
assume eax:nothing
mov edx,hExitProcess
.if eax == edx
invoke MessageBoxA,NULL,addr sztext,addr sztitle,MB_OK
invoke GetThreadContext,hcurrentthread,addr ctx
mov ctx.iDr0,0h
invoke SetThreadContext,hcurrentthread,addr ctx
invoke Sleep,3000
.endif
popad
mov eax,EXCEPTION_CONTINUE_EXECUTION
ret
exceptionhandler endp
start:
main proc
invoke GetModuleHandle,addr szkernel32
mov hkernel32,eax
invoke GetProcAddress,eax,addr szExitProcess
mov hExitProcess,eax
invoke sethwbreakpoint,eax
invoke AddVectoredExceptionHandler,1,addr exceptionhandler
invoke ExitProcess,NULL
ret
main endp
end start
我用od调试的时候在sethwbreakpoint里的setthreadcontext返回的值显示已经设置成功,但是调用ExitProcess的时候并没有被断下来,exceptionhandler也没有被调用。请问各位坛子里的兄弟,我的代码在哪里错了,或者是我对那篇文章的理解有问题?
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)