typedef LONG NTSTATUS;
CHookApi_Jmp msgbox;
HHOOK g_hHook;
BOOL bHook=false;
BOOL Init();
typedef enum _SYSTEM_INFORMATION_CLASS // Q S
{
SystemBasicInformation, // 00 Y N
SystemProcessorInformation, // 01 Y N
SystemPerformanceInformation, // 02 Y N
SystemTimeOfDayInformation, // 03 Y N
SystemNotImplemented1, // 04 Y N
SystemProcessesAndThreadsInformation, // 05 Y N
SystemCallCounts, // 06 Y N
SystemConfigurationInformation, // 07 Y N
SystemProcessorTimes, // 08 Y N
SystemGlobalFlag, // 09 Y Y
SystemNotImplemented2, // 10 Y N
SystemModuleInformation, // 11 Y N
SystemLockInformation, // 12 Y N
SystemNotImplemented3, // 13 Y N
SystemNotImplemented4, // 14 Y N
SystemNotImplemented5, // 15 Y N
SystemHandleInformation, // 16 Y N
SystemObjectInformation, // 17 Y N
SystemPagefileInformation, // 18 Y N
SystemInstructionEmulationCounts, // 19 Y N
SystemInvalidInfoClass1, // 20
SystemCacheInformation, // 21 Y Y
SystemPoolTagInformation, // 22 Y N
SystemProcessorStatistics, // 23 Y N
SystemDpcInformation, // 24 Y Y
SystemNotImplemented6, // 25 Y N
SystemLoadImage, // 26 N Y
SystemUnloadImage, // 27 N Y
SystemTimeAdjustment, // 28 Y Y
SystemNotImplemented7, // 29 Y N
SystemNotImplemented8, // 30 Y N
SystemNotImplemented9, // 31 Y N
SystemCrashDumpInformation, // 32 Y N
SystemExceptionInformation, // 33 Y N
SystemCrashDumpStateInformation, // 34 Y Y/N
SystemKernelDebuggerInformation, // 35 Y N
SystemContextSwitchInformation, // 36 Y N
SystemRegistryQuotaInformation, // 37 Y Y
SystemLoadAndCallImage, // 38 N Y
SystemPrioritySeparation, // 39 N Y
SystemNotImplemented10, // 40 Y N
SystemNotImplemented11, // 41 Y N
SystemInvalidInfoClass2, // 42
SystemInvalidInfoClass3, // 43
SystemTimeZoneInformation, // 44 Y N
SystemLookasideInformation, // 45 Y N
SystemSetTimeSlipEvent, // 46 N Y
SystemCreateSession, // 47 N Y
SystemDeleteSession, // 48 N Y
SystemInvalidInfoClass4, // 49
SystemRangeStartInformation, // 50 Y N
SystemVerifierInformation, // 51 Y Y
SystemAddVerifier, // 52 N Y
SystemSessionProcessesInformation // 53 Y N
} SYSTEM_INFORMATION_CLASS;
typedef struct _SYSTEM_MODULE_INFORMATION // Information Class 11
{
ULONG Reserved[2];
PVOID Base;
ULONG Size;
ULONG Flags;
USHORT Index;
USHORT Unknown;
USHORT LoadCount;
USHORT ModuleNameOffset;
CHAR ImageName[256];
}SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
typedef NTSTATUS ( __stdcall *NtQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL );
static NtQUERYSYSTEMINFORMATION NtQuerySystemInformation = NULL;
NTSTATUS __stdcall MyNtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL )
{
msgbox.SetHookOff();
NtQuerySystemInformation=(NtQUERYSYSTEMINFORMATION)GetProcAddress(LoadLibrary("ntdll.dll"),"NtQuerySystemInformation");
if(NtQuerySystemInformation==NULL) MessageBox(NULL, "can't get NtQueryInformationThread", "", MB_OK);
NTSTATUS nReturn=NtQuerySystemInformation(SystemInformationClass,SystemInformation,SystemInformationLength,ReturnLength);
msgbox.SetHookOn();
return(nReturn);
}
// 空的钩子函数
LRESULT WINAPI Hook(int nCode,WPARAM wParam,LPARAM lParam)
{
return(CallNextHookEx(g_hHook,nCode,wParam,lParam));
}
//---------------------------------------------------------------------------
BOOL Init()
{
msgbox.Initialize("ntdll.dll","NtQuerySystemInformation",(FARPROC)MyNtQuerySystemInformation);
msgbox.SetHookOn(); // 开始拦截
return(true);
}
// 输出,安装空的钩子函数
extern"C"__declspec(dllexport) bool InstallHook()
{
g_hHook=SetWindowsHookEx(WH_GETMESSAGE,(HOOKPROC)Hook,LoadLibrary("dll.dll"),0);
if (!g_hHook)
{
MessageBoxA(NULL,"启用进程保护失败，请把本程序加入进程白名单后再试一次！","失败",MB_OK);
return(false);
}
return(true);
}
//---------------------------------------------------------------------------
// 输出,Uninstall钩子函数
extern"C"__declspec(dllexport) bool UninstallHook()
{
msgbox.SetHookOff();
return(UnhookWindowsHookEx(g_hHook));
}
//---------------------------------------------------------------------------
// 初始化得到MessageBoxA的地址，并生成Jmp XXX(MyMessageBoxA)的跳转指令
//---------------------------------------------------------------------------
int WINAPI DllMain(HINSTANCE hinst,unsigned long reason,void* lpReserved)
{
switch (reason)
{
case DLL_PROCESS_ATTACH:
if(!Init()) return(false);
break;
case DLL_PROCESS_DETACH:
if(bHook) UninstallHook();
break;
}
return TRUE;
}
