您好,登錄后才能下訂單哦!
/*********************************實(shí)現(xiàn)hook OpenProcess實(shí)現(xiàn)ring3保護(hù)進(jìn)程、、C++完整代碼、、************************************************/
#include <windows.h>
PIMAGE_IMPORT_BY_NAME pImportByName = NULL;
PIMAGE_THUNK_DATA pOriginalThunk = NULL;
PIMAGE_THUNK_DATA pFirstThunk = NULL;
//IAT HOOK的核心函數(shù)、
int IatHook(const char* DllName, const char* FunName,DWORD RealAddr);
//自己的OpenProcess函數(shù)、
HANDLE WINAPI MyOpenProcess (DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId);
DWORD MyOpenProcessAddr = (DWORD)MyOpenProcess;
//真正的 OpenProcess函數(shù)指針、、
typedef HANDLE (WINAPI * RealOpenProcess)(DWORD,BOOL,DWORD);
RealOpenProcess pRealOpenProcess = (RealOpenProcess)OpenProcess;
//DLL MAIN 函數(shù)、
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
{
if(fdwReason==DLL_PROCESS_ATTACH)
{
IatHook("Kernel32.dll","OpenProcess",MyOpenProcessAddr);
}
return TRUE;
}
/****************************************************** MyOpenProcess 函數(shù)的實(shí)現(xiàn)部分****************************************************/
HANDLE WINAPI MyOpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId)
{
//獲取 要保護(hù)進(jìn)程的標(biāo)題 的窗口句柄 系統(tǒng)API函數(shù)前使用::為了和類擴(kuò)展函數(shù)區(qū)別
// 為了代碼的健壯性 使用TEXT宏、 HWND 窗口句柄、
HWND HProtect = ::FindWindow(NULL,TEXT("Windows 當(dāng)前所有進(jìn)程"));
if(!HProtect)
{
return ( pRealOpenProcess(dwDesiredAccess,bInheritHandle,dwProcessId) );
} //若不存在則調(diào)用返回
//獲取創(chuàng)建此窗口的進(jìn)程的ID、保存在 &ProtectId 地址中、
DWORD ProtectId; //下邊找出某個窗口的創(chuàng)建者(線程或進(jìn)程)
GetWindowThreadProcessId(HProtect,&ProtectId);
if(ProtectId == dwProcessId) //dwProcessId是任務(wù)管理器要結(jié)束的進(jìn)程ID
{
return 0; //如果結(jié)束的是我們的進(jìn)程則 返回錯誤碼0、
}
return ( pRealOpenProcess(dwDesiredAccess,bInheritHandle,dwProcessId) );
}
/ ****************************************************** IAT HOOK 函數(shù)的實(shí)現(xiàn)部分****************************************************/
int IatHook(const char* DllName, const char* FunName,DWORD RealAddr)
{
/************************** 找相同的DLL ****************************/
HANDLE pBegin = GetModuleHandle(NULL);
PBYTE pBegin2 = (PBYTE)pBegin;
PIMAGE_DOS_HEADER DOS = PIMAGE_DOS_HEADER(pBegin2);
PIMAGE_NT_HEADERS NT = PIMAGE_NT_HEADERS(pBegin2+DOS->e_lfanew);
PIMAGE_OPTIONAL_HEADER OPTION = &(NT->OptionalHeader);
PIMAGE_IMPORT_DESCRIPTOR IMPORT = PIMAGE_IMPORT_DESCRIPTOR(OPTION->DataDirectory[1].VirtualAddress + pBegin2);
while (IMPORT->Name)
{
char* OurDllName = (char*)(IMPORT->Name + pBegin2);
if (0 == strcmpi(DllName , OurDllName))
{
break;
}
IMPORT++;
}
/************************* 找相同的API函數(shù) ****************************/
PIMAGE_IMPORT_BY_NAME pImportByName = NULL;
PIMAGE_THUNK_DATA pOriginalThunk = NULL;
PIMAGE_THUNK_DATA pFirstThunk = NULL;
pOriginalThunk = (PIMAGE_THUNK_DATA)(IMPORT->OriginalFirstThunk + pBegin2);
pFirstThunk = (PIMAGE_THUNK_DATA)(IMPORT->FirstThunk + pBegin2);
while (pOriginalThunk->u1.Function) //記住是Function
{
DWORD u1 = pOriginalThunk->u1.Ordinal; //記住是Ordinal
if ((u1 & IMAGE_ORDINAL_FLAG) != IMAGE_ORDINAL_FLAG) //說明MSB不是1 不是以序號導(dǎo)入
{
pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pOriginalThunk->u1.AddressOfData + pBegin2);
char* OurFunName = (char*)(pImportByName->Name); //下邊的計算也可以
//char* OurFunName2 = (char*)((DWORD)pOriginalThunk->u1.AddressOfData + pBegin2 + 2);
if (0 == strcmpi(FunName,OurFunName))
{
//獲取以pFirstThunk開始的內(nèi)存的信息并將其保存到MEMORY_BASIC_INFORMATION結(jié)構(gòu)中
MEMORY_BASIC_INFORMATION mbi_thunk;
VirtualQuery (pFirstThunk, &mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
//VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE, &mbi_thunk.Protect);
//修改以pFirstThunk開始的內(nèi)存的的保護(hù)屬性為PAGE_READWRITE并將原保護(hù)屬性保存到&dwOLD中
DWORD dwOLD;
VirtualProtect(pFirstThunk,sizeof(DWORD),PAGE_READWRITE,&dwOLD);
//更改真正OpenProcess的地址為自己寫的MyOpenProcess函數(shù)的地址、、
pFirstThunk->u1.Function = (PDWORD)RealAddr; //關(guān)鍵地方
//恢復(fù)之前更改的內(nèi)存的保護(hù)屬性為人家自己的、、
VirtualProtect(pFirstThunk,sizeof(DWORD),dwOLD,0);
break;
}
}
pOriginalThunk++;
pFirstThunk++;
}
return 0;
}
/***********************完***************************/
免責(zé)聲明:本站發(fā)布的內(nèi)容(圖片、視頻和文字)以原創(chuàng)、轉(zhuǎn)載和分享為主,文章觀點(diǎn)不代表本網(wǎng)站立場,如果涉及侵權(quán)請聯(lián)系站長郵箱:is@yisu.com進(jìn)行舉報,并提供相關(guān)證據(jù),一經(jīng)查實(shí),將立刻刪除涉嫌侵權(quán)內(nèi)容。