HOOK NtDeviceIoControlFile,注入浏览器,浏览器不崩溃了,但打开浏览器却无法连接网络。怎么查看也没有发现问题,小弟拜请大家给检查检查吧!
//钩子函数
NTSTATUS __stdcall NewNtDeviceIoControlFile(
HANDLE FileHandle,
HANDLE Event OPTIONAL,
PVOID ApcRoutine OPTIONAL,
PVOID ApcContext OPTIONAL,
PVOID IoStatusBlock,
ULONG IoControlCode,
PVOID InputBuffer OPTIONAL,///////////////////g.关注这里面的数据
ULONG InputBufferLength,
PVOID OutputBuffer OPTIONAL,
ULONG OutputBufferLength
)
{
//从InputBuffer得到Buffer和Len
if (IoControlCode == AFD_SEND)
{
PAFD_INFO AfdInfo = (PAFD_INFO)InputBuffer ;
PVOID Buffer = AfdInfo->BufferArray->buf ;
ULONG Len = AfdInfo->BufferArray->len;
if (LookupSendPacket(Buffer , Len))
{
char *string=(char*)Buffer;
char *substring="Host: www.google.com";
int result= strindex(string,substring);//检查请求包中是否是主机为google
if(result>0)
OutputDebugString("please replace google!!!!!!!!!!");
}
AfdInfo->BufferArray->buf=(PCHAR)Buffer;
AfdInfo->BufferArray->len=strlen((char*)Buffer);
//调用原生函数
LONG stat ;
__asm
{
push OutputBufferLength
push OutputBuffer
push InputBufferLength
push InputBuffer
push IoControlCode
push IoStatusBlock
push ApcContext
push ApcRoutine
push Event
push FileHandle
call pNtDeviceIoControl
mov stat ,eax
}
}
}
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课