C++封裝IATHOOK類實例

2020-01-26 15:13:38

字體：大中小

來源：轉載

供稿：網友

本文實例講述了C++封裝IATHOOK類的實現方法。分享給大家供大家參考。具體方法如下：

1. 定義成類的靜態成員，從而實現自動調用

static CAPIHOOK sm_LoadLibraryA;  
static CAPIHOOK sm_LoadLibraryW;  
static CAPIHOOK sm_LoadLibraryExA;  
static CAPIHOOK sm_LoadLibraryExW;  
static CAPIHOOK sm_GetProcAddress;

2. ReplaceIATEntryInAllMods中遍歷模塊的框架

復制代碼代碼如下:

void CAPIHOOK::ReplaceIATEntryInAllMods(LPCTSTR pszExportMod, PROC pfnCurrent, PROC pfnNewFunc, BOOL bExcludeAPIHookMod)  
{  
    //取得當前模塊句柄  
    HMODULE hModThis = NULL;  
    if (bExcludeAPIHookMod)  
    {  
        MEMORY_BASIC_INFORMATION mbi;  
        if (0 != ::VirtualQuery(ReplaceIATEntryInAllMods, &mbi, sizeof(MEMORY_BASIC_INFORMATION))) //ReplaceIATEntryInAllMods必須為類的static函數  
        {  
            hModThis = (HMODULE)mbi.AllocationBase;  
        }  
    }  
    //取得本進程的模塊列表  
    HANDLE hModuleSnap = INVALID_HANDLE_VALUE;   
    MODULEENTRY32 me32;  
    hModuleSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId());  
    if (INVALID_HANDLE_VALUE == hModuleSnap)  
    {  
        return;  
    }  
    me32.dwSize = sizeof( MODULEENTRY32 );   
    if( !Module32First( hModuleSnap, &me32 ) )   
    {   
        return;  
    }  
    do   
    { //對每一個模塊  
        if (me32.hModule != hModThis)  
        {  
            ReplaceIATEntryInOneMod(pszExportMod, pfnCurrent, pfnNewFunc, me32.hModule);  
        }  
    } while( Module32Next( hModuleSnap, &me32 ) );   
  
  
    ::CloseHandle(hModuleSnap); //配對寫  
  
}

3. 遍歷鏈表摘除自己的框架

復制代碼代碼如下:

CAPIHOOK::~CAPIHOOK(void)  
{  
    //取消對函數的HOOK  
    ReplaceIATEntryInAllMods(m_pszModName, m_pfnHook, m_pfnOrig, TRUE);  
  
    //把自己從鏈表中刪除  
    CAPIHOOK* p = sm_pHeader;  
    if (p == this)  
    {  
        sm_pHeader = this->m_pNext;  
    }  
    else  
    {  
        while(p != NULL)  
        {  
            if (p->m_pNext == this)  
            {  
                p->m_pNext = this->m_pNext;  
                break;  
            }  
            p = p->m_pNext;  
        }  
    }  
}

4. 在cpp中靜態變量寫好后，再編譯，不然容易出現LINK錯誤

復制代碼代碼如下:

CAPIHOOK *CAPIHOOK::sm_pHeader = NULL;

源碼：

.cpp源文件如下：

復制代碼代碼如下:

#include "APIHOOK.h"
#include <Tlhelp32.h>

CAPIHOOK *CAPIHOOK::sm_pHeader = NULL;
CAPIHOOK CAPIHOOK::sm_LoadLibraryA("kernel32.dll", "LoadLibraryA", (PROC)CAPIHOOK::LoadLibraryA, TRUE);
CAPIHOOK CAPIHOOK::sm_LoadLibraryW("kernel32.dll", "LoadLibraryW", (PROC)CAPIHOOK::LoadLibraryW, TRUE);
CAPIHOOK CAPIHOOK::sm_LoadLibraryExA("kernel32.dll", "LoadLibraryExA", (PROC)CAPIHOOK::LoadLibraryExA, TRUE);
CAPIHOOK CAPIHOOK::sm_LoadLibraryExW("kernel32.dll", "LoadLibraryExW", (PROC)CAPIHOOK::LoadLibraryExW, TRUE);
CAPIHOOK CAPIHOOK::sm_GetProcAddress("kernel32.dll", "GetProcAddress", (PROC)CAPIHOOK::GetProcess, TRUE);
CAPIHOOK::CAPIHOOK(LPTSTR lpszModName, LPSTR pszFuncName, PROC pfnHook, BOOL bExcludeAPIHookMod)
{
    //初始化變量
    m_pszModName = lpszModName;
    m_pszFuncName = pszFuncName;
    m_pfnOrig = ::GetProcAddress(::GetModuleHandleA(lpszModName), pszFuncName);
    m_pfnHook = pfnHook;

    //將此對象加入鏈表中
    m_pNext = sm_pHeader;
    sm_pHeader = this;

    //在當前已加載的模塊中HOOK這個函數
    ReplaceIATEntryInAllMods(lpszModName, m_pfnOrig, m_pfnHook, bExcludeAPIHookMod);
}

CAPIHOOK::~CAPIHOOK(void)
{
    //取消對函數的HOOK
    ReplaceIATEntryInAllMods(m_pszModName, m_pfnHook, m_pfnOrig, TRUE);

    //把自己從鏈表中刪除
    CAPIHOOK* p = sm_pHeader;
    if (p == this)
    {
        sm_pHeader = this->m_pNext;
    }
    else
    {
        while(p != NULL)
        {
            if (p->m_pNext == this)
            {
                p->m_pNext = this->m_pNext;
                break;
            }
            p = p->m_pNext;
        }
    }
}
//防止程序運行期間動態加載模塊
void CAPIHOOK::HookNewlyLoadedModule(HMODULE hModule, DWORD dwFlags)
{
    if (hModule!=NULL && (dwFlags&LOAD_LIBRARY_AS_DATAFILE)==0)
    {
        CAPIHOOK* p = sm_pHeader; //循環遍歷鏈表，對每個CAPIHOOK進入HOOK
        if (p != NULL)
        {
            ReplaceIATEntryInOneMod(p->m_pszModName, p->m_pfnOrig, p->m_pfnHook, hModule);
            p = p->m_pNext;
        }
    }
}

//防止程序運行期間動態調用API函數
FARPROC WINAPI CAPIHOOK::GetProcess(HMODULE hModule, PCSTR pszProcName)
{
    //得到函數的真實地址
    FARPROC pfn = ::GetProcAddress(hModule, pszProcName);
    //遍歷列表看是不是要HOOK的函數
    CAPIHOOK* p = sm_pHeader;
    while(p != NULL)
    {
        if (p->m_pfnOrig == pfn) //是要HOOK的函數
        {
            pfn = p->m_pfnHook; //HOOK掉
            break;
        }
        p = p->m_pNext;
    }
    return pfn;
}

void CAPIHOOK::ReplaceIATEntryInOneMod(LPCTSTR pszExportMod, PROC pfnCurrent, PROC pfnNewFunc, HMODULE hModCaller)
{
    IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)hModCaller;
    IMAGE_OPTIONAL_HEADER* pOpNtHeader = (IMAGE_OPTIONAL_HEADER*)((BYTE*)hModCaller + pDosHeader->e_lfanew + 24); //這里加24
    IMAGE_IMPORT_DESCRIPTOR* pImportDesc = (IMAGE_IMPORT_DESCRIPTOR*)((BYTE*)hModCaller + pOpNtHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

    BOOL bFindDll = FALSE;
    while (pImportDesc->FirstThunk)
    {
        char* pszDllName = (char*)((BYTE*)hModCaller + pImportDesc->Name);

        if (stricmp(pszDllName, pszExportMod) == 0)//如果找到pszExportMod模塊,相當于hook messageboxa時的“user32.dll”
        {
            bFindDll = TRUE;
            break;
        }
        pImportDesc++;
    }

    if (bFindDll)
    {
        DWORD n = 0;
        //一個IMAGE_THUNK_DATA就是一個導入函數
        IMAGE_THUNK_DATA* pThunk = (IMAGE_THUNK_DATA*)((BYTE*)hModCaller + pImportDesc->OriginalFirstThunk);
        while (pThunk->u1.Function)
        {
            //取得函數名稱
            char* pszFuncName = (char*)((BYTE*)hModCaller+pThunk->u1.AddressOfData+2); //函數名前面有兩個..
            //printf("function name:%-25s, ", pszFuncName);
            //取得函數地址
            PDWORD lpAddr = (DWORD*)((BYTE*)hModCaller + pImportDesc->FirstThunk) + n; //從第一個函數的地址，以后每次+4字節
            //printf("addrss:%X/n", lpAddr);
            //在這里是比較的函數地址
            if (*lpAddr == (DWORD)pfnCurrent) //找到iat中的函數地址
            {
                DWORD* lpNewProc = (DWORD*)pfnNewFunc;
                MEMORY_BASIC_INFORMATION mbi;
                DWORD dwOldProtect;
                //修改內存頁的保護屬性
                ::VirtualQuery(lpAddr, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
                ::VirtualProtect(lpAddr, sizeof(DWORD), PAGE_READWRITE, &dwOldProtect);
                ::WriteProcessMemory(GetCurrentProcess(), lpAddr, &lpNewProc, sizeof(DWORD), NULL);
                ::VirtualProtect(lpAddr, sizeof(DWORD), dwOldProtect, NULL);
                return;
            }
            n++; //每次增加一個DWORD
        }
    }
}

void CAPIHOOK::ReplaceIATEntryInAllMods(LPCTSTR pszExportMod, PROC pfnCurrent, PROC pfnNewFunc, BOOL bExcludeAPIHookMod)
{
    //取得當前模塊句柄
    HMODULE hModThis = NULL;
    if (bExcludeAPIHookMod)
    {
        MEMORY_BASIC_INFORMATION mbi;
        if (0 != ::VirtualQuery(ReplaceIATEntryInAllMods, &mbi, sizeof(MEMORY_BASIC_INFORMATION))) //ReplaceIATEntryInAllMods必須為類的static函數
        {
            hModThis = (HMODULE)mbi.AllocationBase;
        }
    }
    //取得本進程的模塊列表
    HANDLE hModuleSnap = INVALID_HANDLE_VALUE;
    MODULEENTRY32 me32;
    hModuleSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId());
    if (INVALID_HANDLE_VALUE == hModuleSnap)
    {
        return;
    }
    me32.dwSize = sizeof( MODULEENTRY32 );
    if( !Module32First( hModuleSnap, &me32 ) )
    {
        return;
    }
    do
    { //對每一個模塊
        if (me32.hModule != hModThis)
        {
            ReplaceIATEntryInOneMod(pszExportMod, pfnCurrent, pfnNewFunc, me32.hModule);
        }
    } while( Module32Next( hModuleSnap, &me32 ) );

    ::CloseHandle(hModuleSnap); //配對寫
}

//防止自動加載
HMODULE WINAPI CAPIHOOK::LoadLibraryA(LPCTSTR lpFileName)
{
    HMODULE hModule = LoadLibraryA(lpFileName);
    HookNewlyLoadedModule(hModule, 0); //這個函數中憶檢測hModule 了
    return hModule;
}
HMODULE WINAPI CAPIHOOK::LoadLibraryW(LPCTSTR lpFileName)
{
    HMODULE hModule = LoadLibraryW(lpFileName);
    HookNewlyLoadedModule(hModule, 0); //這個函數中憶檢測hModule 了
    return hModule;
}
HMODULE WINAPI CAPIHOOK::LoadLibraryExA(LPCTSTR lpFileName, HANDLE hFile, DWORD dwFlags)
{
    HMODULE hModule = LoadLibraryExA(lpFileName, hFile, dwFlags);
    HookNewlyLoadedModule(hModule, dwFlags); //這個函數中憶檢測hModule 了
    return hModule;
}
HMODULE WINAPI CAPIHOOK::LoadLibraryExW(LPCTSTR lpFileName, HANDLE hFile, DWORD dwFlags)
{
    HMODULE hModule = LoadLibraryExW(lpFileName, hFile, dwFlags);
    HookNewlyLoadedModule(hModule, dwFlags); //這個函數中憶檢測hModule 了
    return hModule;
}

.h頭文件如下：

復制代碼代碼如下:

#pragma once  
#include <Windows.h>  
  
class CAPIHOOK  
{  
public:  
    CAPIHOOK(LPTSTR lpszModName, LPSTR pszFuncName, PROC pfnHook, BOOL bExcludeAPIHookMod = TRUE);  
    ~CAPIHOOK(void);  
  
private:  
    static void ReplaceIATEntryInOneMod(LPCTSTR pszExportMod, PROC pfnCurrent, PROC pfnNewFunc, HMODULE hModCaller);  
    static void ReplaceIATEntryInAllMods(LPCTSTR pszExportMod, PROC pfnCurrent, PROC pfnNewFunc, BOOL bExcludeAPIHookMod);  
    //防止程序運行期間動態加載模塊, 當一個新DLL被加載時調用  
    static void HookNewlyLoadedModule(HMODULE hModule,  DWORD dwFlags);  
  
    //跟蹤當前進程加載新的DLL  
    static HMODULE WINAPI LoadLibraryA(LPCTSTR lpFileName);  
    static HMODULE WINAPI LoadLibraryW(LPCTSTR lpFileName);  
    static HMODULE WINAPI LoadLibraryExA(LPCTSTR lpFileName, HANDLE hFile,  DWORD dwFlags);  
    static HMODULE WINAPI LoadLibraryExW(LPCTSTR lpFileName, HANDLE hFile,  DWORD dwFlags);  
    //防止程序運行期間動態調用API函數 對于請求已HOOK的API函數，返回用戶自定義的函數地址  
    static FARPROC WINAPI GetProcess(HMODULE hModule, PCSTR pszProcName); 
  
private: //定義成靜態的，會自動調用，從而實現自動HOOK  
    static CAPIHOOK sm_LoadLibraryA;  
    static CAPIHOOK sm_LoadLibraryW;  
    static CAPIHOOK sm_LoadLibraryExA;  
    static CAPIHOOK sm_LoadLibraryExW;  
    static CAPIHOOK sm_GetProcAddress;  
  
private:  
    static CAPIHOOK* sm_pHeader; //鉤子鏈表  
    CAPIHOOK* m_pNext;  
  
    //要鉤子的函數  
    PROC m_pfnOrig;  
    PROC m_pfnHook;  
  
    //要鉤子的函數所在的dll  
    LPSTR m_pszModName;  
    //要鉤子的函數名稱  
    LPSTR m_pszFuncName;  
};