关于VEH Hook

[codediy2]

PVOID g_ExceptionHandler = NULL;
LPVOID g_JumpToMessageBoxA = NULL;
LPVOID g_lpOldMessageBoxA = NULL;

typedef int (__stdcall *pfnMessageBoxA) ( HWND hWnd, char *lpText, char *lpCaption, UINT uType );
void EnableVEHHook();
unsigned int __stdcall ThreadProc( void* lpParam );
LONG __stdcall VectoredHandler ( PEXCEPTION_POINTERS ExceptionInfo );
int __stdcall HookMessageBoxA( HWND hWnd, char *lpText, char *lpCaption, UINT uType );

int _tmain(int argc, _TCHAR* argv[])
{
    HANDLE hThread = NULL;
    EnableVEHHook();

    hThread = (HANDLE)_beginthreadex( 
        NULL, 0, ThreadProc, NULL, 0, NULL );

    WaitForSingleObject( hThread, INFINITE );
    system( "pause" );
    
    RemoveVectoredExceptionHandler( g_ExceptionHandler );
    return 0;
}

void EnableVEHHook()
{
    g_ExceptionHandler = AddVectoredExceptionHandler( 1, VectoredHandler );
    
    g_lpOldMessageBoxA = (LPVOID) GetProcAddress( LoadLibraryA( "user32.dll" ), "MessageBoxA" );
    printf( "User32!MessageBoxA : 0x%08X\n", g_lpOldMessageBoxA );
    
    unsigned char *pOpCode = NULL;
    DWORD CodeLength = 0;
    while ( CodeLength < 5 ) {

        CodeLength += SizeOfCode( (void*)( (DWORD)g_lpOldMessageBoxA + CodeLength ), &pOpCode );
    }
    
    g_JumpToMessageBoxA = VirtualAlloc( NULL, 0x100, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
    
    unsigned char JumpCode[] = { 0x68, 0x00, 0x00, 0x00, 0x00, 0xC3 };

    memcpy( g_JumpToMessageBoxA, g_lpOldMessageBoxA, CodeLength );
    *(DWORD *)( JumpCode + 1 ) = (DWORD)g_lpOldMessageBoxA + CodeLength;
    memcpy( (LPVOID)((DWORD)g_JumpToMessageBoxA + CodeLength), JumpCode, sizeof(JumpCode) );

    DWORD OldProtect = 0;
    VirtualProtectEx( GetCurrentProcess(), g_lpOldMessageBoxA, 4, PAGE_EXECUTE_READWRITE, &OldProtect );
    *(unsigned char *) g_lpOldMessageBoxA = 0xCC; // Set Break Point

}

LONG __stdcall VectoredHandler ( PEXCEPTION_POINTERS ExceptionInfo )
{
    if ( ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_BREAKPOINT ) {
    
        PCONTEXT Context;
        Context = ExceptionInfo->ContextRecord;
        printf( "Exception Address : 0x%08X\n", Context->Eip );
        
        if ( Context->Eip == (DWORD)g_lpOldMessageBoxA ) {
        
            printf( "Catch it!\n" );
            Context->Eip = (DWORD) HookMessageBoxA;
            return EXCEPTION_CONTINUE_EXECUTION;
        }
    }
    return EXCEPTION_CONTINUE_SEARCH;
}

unsigned int __stdcall ThreadProc( void* lpParam )
{
    Sleep( 500 );
    MessageBoxA( 0, "Hello", "Hello", 0 );
    return 0;
}

int __stdcall HookMessageBoxA( HWND hWnd, char *lpText, char *lpCaption, UINT uType )
{
    return ( (pfnMessageBoxA)g_JumpToMessageBoxA )( hWnd, "TheCjw", lpCaption, uType );
}

以上代码是通过VEH HOOK的方法 HOOK了MessageBoxA..

其中：
if ( Context->Eip == (DWORD)g_lpOldMessageBoxA ) {

printf( "Catch it!\n" );
Context->Eip = (DWORD) HookMessageBoxA;
return EXCEPTION_CONTINUE_EXECUTION;
}

当EIP为g_lpOldMessageBoxA的时候则将EIP设为(DWORD) HookMessageBoxA;

我想请问下 假如我已经用这段代码VEH HOOK了 那么我该用什么方法来HOOK 达到他设置好(DWORD) HookMessageBoxA;之后得到的(DWORD) HookMessageBoxA;的地址呢？

[surf515]

不懂 帮顶~~·

[花熊]

///帮顶