关于VEH Hook

2010-06-30 04:14:57 336 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

VEH hook 终止当前程序的执行-->调试器（进程必须被调试，向调试器发送EXCEPTION_DEBUG_EVENT消息）-->执行VEH-->执行SEH-->TopLevelEH(进程调试时不会被执行）-->执行VEH-->交给调试器（上面的异常处理都说处理不了，就再次交给调试器）-->调用异常端口通知csrss.exe。思路就是不断改变某一块内存属性，当执行命令或者某些操作的时候，执行的内存属性是可执行的，当功能模块进入睡眠的时候将内存属性改为不可执行。然后就是注册异常函数，这个异常函数就是为了恢复可执行内存属性。阅读详情



PVOID g_ExceptionHandler = NULL;

LPVOID g_JumpToMessageBoxA = NULL;

LPVOID g_lpOldMessageBoxA = NULL;



typedef int (__stdcall *pfnMessageBoxA) ( HWND hWnd, char *lpText, char *lpCaption, UINT uType );

void EnableVEHHook();

unsigned int __stdcall ThreadProc( void* lpParam );

LONG __stdcall VectoredHandler ( PEXCEPTION_POINTERS ExceptionInfo );

int __stdcall HookMessageBoxA( HWND hWnd, char *lpText, char *lpCaption, UINT uType );



int _tmain(int argc, _TCHAR* argv[])

{

    HANDLE hThread = NULL;

    EnableVEHHook();



    hThread = (HANDLE)_beginthreadex( 

        NULL, 0, ThreadProc, NULL, 0, NULL );



    WaitForSingleObject( hThread, INFINITE );

    system( "pause" );

    

    RemoveVectoredExceptionHandler( g_ExceptionHandler );

    return 0;

}



void EnableVEHHook()

{

    g_ExceptionHandler = AddVectoredExceptionHandler( 1, VectoredHandler );

    

    g_lpOldMessageBoxA = (LPVOID) GetProcAddress( LoadLibraryA( "user32.dll" ), "MessageBoxA" );

    printf( "User32!MessageBoxA : 0x%08X\n", g_lpOldMessageBoxA );

    

    unsigned char *pOpCode = NULL;

    DWORD CodeLength = 0;

    while ( CodeLength < 5 ) {



        CodeLength += SizeOfCode( (void*)( (DWORD)g_lpOldMessageBoxA + CodeLength ), &pOpCode );

    }

    

    g_JumpToMessageBoxA = VirtualAlloc( NULL, 0x100, MEM_COMMIT, PAGE_EXECUTE_READWRITE );

    

    unsigned char JumpCode[] = { 0x68, 0x00, 0x00, 0x00, 0x00, 0xC3 };



    memcpy( g_JumpToMessageBoxA, g_lpOldMessageBoxA, CodeLength );

    *(DWORD *)( JumpCode + 1 ) = (DWORD)g_lpOldMessageBoxA + CodeLength;

    memcpy( (LPVOID)((DWORD)g_JumpToMessageBoxA + CodeLength), JumpCode, sizeof(JumpCode) );



    DWORD OldProtect = 0;

    VirtualProtectEx( GetCurrentProcess(), g_lpOldMessageBoxA, 4, PAGE_EXECUTE_READWRITE, &OldProtect );

    *(unsigned char *) g_lpOldMessageBoxA = 0xCC; // Set Break Point



}



LONG __stdcall VectoredHandler ( PEXCEPTION_POINTERS ExceptionInfo )

{

    if ( ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_BREAKPOINT ) {

    

        PCONTEXT Context;

        Context = ExceptionInfo->ContextRecord;

        printf( "Exception Address : 0x%08X\n", Context->Eip );

        

        if ( Context->Eip == (DWORD)g_lpOldMessageBoxA ) {

        

            printf( "Catch it!\n" );

            Context->Eip = (DWORD) HookMessageBoxA;

            return EXCEPTION_CONTINUE_EXECUTION;

        }

    }

    return EXCEPTION_CONTINUE_SEARCH;

}



unsigned int __stdcall ThreadProc( void* lpParam )

{

    Sleep( 500 );

    MessageBoxA( 0, "Hello", "Hello", 0 );

    return 0;

}



int __stdcall HookMessageBoxA( HWND hWnd, char *lpText, char *lpCaption, UINT uType )

{

    return ( (pfnMessageBoxA)g_JumpToMessageBoxA )( hWnd, "TheCjw", lpCaption, uType );

}

以上代码是通过VEH HOOK的方法 HOOK了MessageBoxA..

其中：
if ( Context->Eip == (DWORD)g_lpOldMessageBoxA ) {

printf( "Catch it!\n" );
Context->Eip = (DWORD) HookMessageBoxA;
return EXCEPTION_CONTINUE_EXECUTION;
}

当EIP为g_lpOldMessageBoxA的时候则将EIP设为(DWORD) HookMessageBoxA;

我想请问下假如我已经用这段代码VEH HOOK了那么我该用什么方法来HOOK 达到他设置好(DWORD) HookMessageBoxA;之后得到的(DWORD) HookMessageBoxA;的地址呢？

...全文