能力值:
( LV7,RANK:140 )
|
-
-
2 楼
先上代码
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
理论上与HOOK几个函数的数量没关系的。
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
楼主错乱的逻辑,怎么能HOOK成功
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
GetAdaptersInfo和CreateProcessInternalW在一起就HOOK不成功。。。。为什么呢!
typedef BOOL (WINAPI* _CreateProcessInternalW)(
HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation,
PHANDLE hNewToken);
_CreateProcessInternalW TrueCreateProcessInternalW = (_CreateProcessInternalW)GetProcAddress(\
GetModuleHandle(TEXT("kernel32")), "CreateProcessInternalW");
BOOL
WINAPI
HookCreateProcessInternalW(
HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation,
PHANDLE hNewToken
)
{
MessageBox(NULL,"TrueCreateProcessInternalW","111111",MB_ICONINFORMATION);
return 0;
}
typedef DWORD (WINAPI* _GetAdaptersInfo)(PIP_ADAPTER_INFO pAdapterInfo,PULONG pOutBufLen);
_GetAdaptersInfo TrueGetAdaptersInfo = (_GetAdaptersInfo)GetProcAddress(GetModuleHandle(TEXT("iphlpapi")), "GetAdaptersInfo");
DWORD
WINAPI
HookGetAdaptersInfo(PIP_ADAPTER_INFO pAdapterInfo, PULONG pOutBufLen)
{ MessageBox(NULL,"HookGetAdaptersInfo","111111",MB_ICONINFORMATION);
return 0;
}
BOOL WINAPI DllMain(HINSTANCE hinstModule, DWORD dwReason, LPVOID lpvReserved)
{
if(dwReason == DLL_PROCESS_ATTACH)
{
DetourRestoreAfterWith();
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach((PVOID*)&TrueGetAdaptersInfo, HookGetAdaptersInfo ) ;
DetourAttach((PVOID*)&TrueCreateProcessInternalW, HookCreateProcessInternalW ) ;
DetourTransactionCommit();
}
return true;
}
|
能力值:
( LV2,RANK:10 )
|
-
-
6 楼
大牛们在不在!
|
能力值:
( LV4,RANK:40 )
|
-
-
7 楼
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
//这里可以调用多次DetourDetach
DetourDetach(&(PVOID&)oldfun,newfun);
DetourTransactionCommit();
讲道理再不行,开个线程做。。。
|
能力值:
( LV2,RANK:10 )
|
-
-
8 楼
这是撤销HOOK啊?都没HOOK成功 不用撤销吧......
|
能力值:
( LV7,RANK:140 )
|
-
-
9 楼
detour没玩过。但是感觉&不需要吧
|
能力值:
( LV2,RANK:10 )
|
-
-
10 楼
必须加的 不然直接崩溃!
|
能力值:
( LV7,RANK:110 )
|
-
-
11 楼
函数的指针正确么?获取到函数的指针了么?我自己已经做过很多的这个函数的HOOK,也没有任何问题啊!
|
能力值:
( LV7,RANK:110 )
|
-
-
12 楼
函数的指针正确么?获取到函数的指针了么?我自己已经做过很多的这个函数的HOOK,也没有任何问题啊!我刚才经过调试,我想我知道原因了!你注意看看这句DetourAttach((PVOID*)&TrueGetAdaptersInfo, HookGetAdaptersInfo ) ;这里的TrueGetAdaptersInfo为0,很明显,你加载的指针有误!
_GetAdaptersInfo TrueGetAdaptersInfo = (_GetAdaptersInfo)GetProcAddress(GetModuleHandle(TEXT("iphlpapi")), "GetAdaptersInfo");你看看你的这句话是在哪里定义的,是在CPP文件的开头就定义好了,这样定义的话,这句话会在DLL初始化的时候执行,这个时候你通过GetModuleHandle(TEXT("iphlpapi")),找到 iphlpapi 的句柄,通过这个句柄 查找 "GetAdaptersInfo" 函数,可是这个时候iphlpapi 可能还没有加载起来,GetModuleHandle(TEXT("iphlpapi"))自然就返回NULL啦,空的句柄会导致GetProcAddress出错!
现在我将修改好的代码给你
typedef BOOL (WINAPI* PCreateProcessInternalW)(
HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation,
PHANDLE hNewToken);
PCreateProcessInternalW TrueCreateProcessInternalW = 0;
BOOL
WINAPI
HookCreateProcessInternalW(
HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation,
PHANDLE hNewToken
)
{
MessageBox(NULL,L"TrueCreateProcessInternalW",L"111111",MB_ICONINFORMATION);
return 0;
}
DWORD
WINAPI
HookGetAdaptersInfo(PVOID pAdapterInfo, PULONG pOutBufLen)
{ MessageBox(NULL,L"HookGetAdaptersInfo",L"111111",MB_ICONINFORMATION);
return 0;
}
typedef DWORD (WINAPI* PGetAdaptersInfo)(PVOID pAdapterInfo,PULONG pOutBufLen);
PGetAdaptersInfo TrueGetAdaptersInfo = 0;
HMODULE hModule=0;
BOOL InitDll()
{
hModule=::LoadLibrary(TEXT("iphlpapi"));
TrueCreateProcessInternalW = (PCreateProcessInternalW)GetProcAddress(GetModuleHandle(TEXT("kernel32")), "CreateProcessInternalW");
TrueGetAdaptersInfo = (PGetAdaptersInfo)GetProcAddress(GetModuleHandle(TEXT("iphlpapi")), "GetAdaptersInfo");
if(!TrueCreateProcessInternalW||!TrueGetAdaptersInfo)
{
if(hModule)::FreeLibrary(hModule);
return FALSE;
}
return TRUE;
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
if(InitDll())//先检查DLL的加载情况,如果加载失败,只能放弃HOOK
{
DetourRestoreAfterWith();
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach((PVOID*)&TrueGetAdaptersInfo, HookGetAdaptersInfo ) ;
DetourAttach((PVOID*)&TrueCreateProcessInternalW, HookCreateProcessInternalW ) ;
DetourTransactionCommit();
}else
return FALSE;
}
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
if(hModule)
::FreeLibrary(hModule);
break;
}
return TRUE;
}
另外,说一句,做HOOK,你要长点心啊!千万要注意指针和句柄,要是获取这两个东西时,有任何一个返回NULL,那只能放弃下面的是有操作了!这还是在应用层,要是在内核层,你的机器早就不知道要蓝到哪里去了!
|
能力值:
( LV2,RANK:10 )
|
-
-
13 楼
膜拜大牛!小弟记住了。这么晚了 还在帮小弟解决。谢谢了。
|
能力值:
( LV2,RANK:10 )
|
-
-
14 楼
大牛再次请教下! 为啥win8.1下 HOOK CreateProcessInternalW 不成功呢?
|
能力值:
( LV7,RANK:110 )
|
-
-
15 楼
你仔细看一下HOOK地址对不?
|
能力值:
( LV2,RANK:10 )
|
-
-
16 楼
就是你上面给出的代码,在win7下可以 但是在win8.1和win10下不行
typedef BOOL (WINAPI* PCreateProcessInternalW)(
HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation,
PHANDLE hNewToken);
PCreateProcessInternalW TrueCreateProcessInternalW = 0;
BOOL
WINAPI
HookCreateProcessInternalW(
HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation,
PHANDLE hNewToken
)
{
MessageBox(NULL,L"TrueCreateProcessInternalW",L"111111",MB_ICONINFORMATION);
return 0;
}
DWORD
WINAPI
HookGetAdaptersInfo(PVOID pAdapterInfo, PULONG pOutBufLen)
{ MessageBox(NULL,L"HookGetAdaptersInfo",L"111111",MB_ICONINFORMATION);
return 0;
}
typedef DWORD (WINAPI* PGetAdaptersInfo)(PVOID pAdapterInfo,PULONG pOutBufLen);
PGetAdaptersInfo TrueGetAdaptersInfo = 0;
HMODULE hModule=0;
BOOL InitDll()
{
hModule=::LoadLibrary(TEXT("iphlpapi"));
TrueCreateProcessInternalW = (PCreateProcessInternalW)GetProcAddress(GetModuleHandle(TEXT("kernel32")), "CreateProcessInternalW");
TrueGetAdaptersInfo = (PGetAdaptersInfo)GetProcAddress(GetModuleHandle(TEXT("iphlpapi")), "GetAdaptersInfo");
if(!TrueCreateProcessInternalW||!TrueGetAdaptersInfo)
{
if(hModule)::FreeLibrary(hModule);
return FALSE;
}
return TRUE;
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
if(InitDll())//先检查DLL的加载情况,如果加载失败,只能放弃HOOK
{
DetourRestoreAfterWith();
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach((PVOID*)&TrueGetAdaptersInfo, HookGetAdaptersInfo ) ;
DetourAttach((PVOID*)&TrueCreateProcessInternalW, HookCreateProcessInternalW ) ;
DetourTransactionCommit();
}else
return FALSE;
}
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
if(hModule)
::FreeLibrary(hModule);
break;
}
return TRUE;
}
|
能力值:
( LV7,RANK:110 )
|
-
-
17 楼
我知道了,应该是WIN8以后取消了这个函数,你可以使用PE Explorer查看KERNEL32.DLL的导出表,如果没有发现这个函数,那么,你就不能HOOK这个函数了,CreateProcessInternalW属于非文档化函数,微软有可能随时取消,我在MSDN并没有用查到这个函数的文档化描述,WIN8中有可能取消了这个函数
|
能力值:
( LV2,RANK:10 )
|
-
-
18 楼
用PE Explorer查看KERNEL32.DLL的导出表,函数CreateProcessInternalW 存在的!
|
能力值:
( LV2,RANK:10 )
|
-
-
19 楼
嗯.是啊.感觉好像不经过这个函数一样.很奇怪.
|
能力值:
( LV2,RANK:10 )
|
-
-
20 楼
没有找到原因啊!
|
能力值:
( LV7,RANK:110 )
|
-
-
21 楼
那你就用WINDBG下断点自己跟踪一下呗
|
|
|