[原创]通用拦截api源代码

[原创]:通用拦截api源代码 [来源]:黑色海岸线安全技术论坛 http://www.thysea.com/lb/cgi-bin/leobbs.cgi [作者]:默数悲伤 [时间]:2006.5.27 经常在看到网上好多人好多帖子寻找拦截某某api的源代码,但是要想做到真正的通用拦截api的代码几乎是不可能的.因为不同的api其最关键的参数不同,地址也不相同,而且编译选项不同,拦截代码也会有一些不同.所以,这里所谓的通用只是尽量把与要拦截的api的个别因素不考虑,而只把公共部分做了出来,当然大家可以参考程序注释轻松写出自己的拦截某个api的程序出来. 该通用代码做成一个头文件的形式,使用的时候把他添加到工程即可.在需要修改的地方,代码中都会有提示.如有错误,欢迎给我留言:) 可以编译成debug或者release程序,只是需要在程序做些简单的修改.这里模拟的是拦截的connect函数,效果是每当被拦截的进程使用connect函数的时候,立即弹出一个对话框提示已经被Hook. 可能需要被修改的地方: 1:函数参数大小 2:被拦截的api的函数指针的定义 3:拦截函数中的自定义功能的函数和变量的定义 4:在拦截函数的参数中由于3的原因而需要做的响应的修改

1. &#35;include <windows.h>
2. &#35;include <tchar.h>
3. &#35;define HOOKFUCTIONSIZE 4096 //定义拦截函数体的大小，以字节为单位，且以4kb为基本单位
4. &#35;define HOOKEDAPIPARAMNUMINBYTE 12 //定义被拦截的api的函数的参数的大小，以字节为单位
5. //定义拦截函数的参数
6. typedef struct _RemoteParam {
7. LPVOID FunAddr;
8. LPVOID lpGetCurrentProcess;
9. LPVOID lpWriteProcessMemory;
10. unsigned char szOldCode[10];
11. unsigned char szNewCode[10];
12. char szCaption[8];
13. char szMessage[12];
14. LPVOID lpMessageBox;
15. } RemoteParam, * PRemoteParam;
16. typedef BOOL (__stdcall * PFN_WRITEPROCESSMEMORY)(HANDLE,LPVOID,LPCVOID,SIZE_T,SIZE_T*);
17. typedef HANDLE (__stdcall * PFN_GETCURRENTPROCESS)(void);
18. //这里为演示而添加的一个函数指针的声明，可以根据拦截功能的需要添加自己要使用的函数指针的定义
19. typedef int (__stdcall * PFN_MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, DWORD);
20. //这里为要拦截的api的函数指针的定义
21. typedef int (__stdcall * PFN_CONNECT)(SOCKET,struct sockaddr *,int);
22. //实施拦截的函数体，这里以拦截connect为目标，参数个数为3，其总大小为12字节
23. VOID HooKApi(LPVOID lParam)
24. {
25. RemoteParam* Rpm = (RemoteParam*)lParam;
26. PFN_GETCURRENTPROCESS pfnGetCurrentProcess = (PFN_GETCURRENTPROCESS)Rpm->lpGetCurrentProcess;
27. PFN_WRITEPROCESSMEMORY pfnWriteProcessMemory = (PFN_WRITEPROCESSMEMORY)Rpm->lpWriteProcessMemory;
28. int RetValue = 0; //定义要拦截的api的默认返回植
29. DWORD NextIpAddr = 0;
30. DWORD dwParamaAddr = 0;
31. //保存原api的参数
32. SOCKET s;
33. struct sockaddr * name;
34. int namelen;
35. __asm
36. {
37. MOV EAX,[EBP+12]
38. MOV [NextIpAddr], EAX
39. MOV EAX,[EBP+16]
40. MOV [s], EAX
41. MOV EAX,[EBP+20]
42. MOV [name],EAX
43. MOV EAX,[EBP+24]
44. MOV [namelen],EAX
45. }
46. //这里可以做你的事情了，比如我只想弹出一个对话框,其实也可以在让api完成之后再做些东西
47. PFN_MESSAGEBOX pfnMessageBox = (PFN_MESSAGEBOX)Rpm->lpMessageBox;
48. pfnMessageBox(NULL, Rpm->szMessage, Rpm->szCaption, 0);
49. //现在你要做的已经完成了，让api恢复吧，完成他本来的任务
50. PFN_CONNECT pfnConnect = (PFN_CONNECT)Rpm->FunAddr;
51. pfnWriteProcessMemory(pfnGetCurrentProcess(),
52. Rpm->FunAddr,
53. (LPCVOID)Rpm->szOldCode,
54. 10,
55. NULL);
56. //让api真正执行,这里换成你要拦截的api
57. RetValue = pfnConnect(s, name, namelen);
58. //再次恢复对他的拦截
59. pfnWriteProcessMemory(pfnGetCurrentProcess(),
60. Rpm->FunAddr,
61. (LPCVOID)Rpm->szNewCode,
62. 10,
63. NULL);
65. DWORD dwStackSize = 12 + HOOKEDAPIPARAMNUMINBYTE;
66. //这里对拦截函数堆栈的恢复，必须放在最后
67. __asm
68. {
69. //POP EDI //注意如果你编译生成的debug版本的程序则需要把这
70. //POP ESI //三个注释去掉
71. //POP EBX
72. MOV ECX, [dwStackSize]
73. MOV EDX, [NextIpAddr]
74. MOV EAX, [RetValue]
75. MOV ESP, EBP
76. POP EBP
77. ADD ESP, ECX //12 + HOOKEDAPIPARAMNUMINBYTE //恢复堆栈
78. PUSH EDX
79. RET
80. }
81. }
82. VOID GetErrorToInfo(void)
83. {
84. LPVOID lpMsgBuf;
85. FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM, 0, GetLastError(),
86. MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
87. (LPTSTR)&lpMsgBuf, 0, NULL );
88. MessageBox(0, (LPCTSTR)lpMsgBuf, TEXT("HOOK ERROR"), MB_OK|MB_ICONINFORMATION );
89. LocalFree(lpMsgBuf);
90. return;
91. }
93. //////////////////////////////////////////////////////////////////////////
94. //************************************************************************
95. //模块名字：AdjustProcessPrivileges(LPCSTR)
96. //模块功能：修改调用进程的权限
97. //返回数值：成功返回TRUE，失败返回FALSE
98. //参数可以为下列值：
99. // &#35;define SE_BACKUP_NAME TEXT("SeBackupPrivilege")
100. // &#35;define SE_RESTORE_NAME TEXT("SeRestorePrivilege")
101. // &#35;define SE_SHUTDOWN_NAME TEXT("SeShutdownPrivilege")
102. // &#35;define SE_DEBUG_NAME TEXT("SeDebugPrivilege")
103. //////////////////////////////////////////////////////////////////////////
104. BOOL AdjustProcessPrivileges(LPCSTR lpPrivilegesName)
105. {
106. HANDLE hToken;
107. TOKEN_PRIVILEGES tkp;
108. if(!OpenProcessToken(GetCurrentProcess(),
109. TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
110. {
111. GetErrorToInfo();
112. return FALSE;
113. }
114. if(!LookupPrivilegeV&#97;lue(NULL,lpPrivilegesName,
115. &tkp.Privileges[0].Luid))
116. {
117. GetErrorToInfo();
118. CloseHandle(hToken);
119. return FALSE;
120. }
121. tkp.PrivilegeCount = 1;
122. tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
123. if(!AdjustTokenPrivileges(hToken,FALSE,&tkp,sizeof(tkp),NULL,NULL))
124. {
125. GetErrorToInfo();
126. CloseHandle(hToken);
127. return FALSE;
128. }
129. CloseHandle(hToken);
130. return TRUE;
131. }
133. int SetHook(DWORD dwPid, LPCTSTR lpApiName, LPCTSTR lpExportDllName, LPVOID lpHookFunAddr)
134. {
135. //获取要拦截的api的地址
136. HMODULE hExportDll = LoadLibrary(lpExportDllName);
137. if(hExportDll == NULL)
138. {
139. GetErrorToInfo();
140. return -1;
141. }
142. LPVOID lpApiAddr = GetProcAddress(hExportDll, lpApiName);
143. if(lpApiAddr == NULL)
144. {
145. GetErrorToInfo();
146. FreeLibrary(hExportDll);
147. return -1;
148. }
149. //打开进程句柄
150. HANDLE hTargetProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,
151. FALSE, dwPid);
152. if(hTargetProcess == NULL)
153. {
154. GetErrorToInfo();
155. FreeLibrary(hExportDll);
156. return -1;
157. }
158. //申请拦截函数内存空间
159. LPVOID lpFunAddr = VirtualAllocEx(hTargetProcess, NULL, HOOKFUCTIONSIZE,
160. MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
162. if(lpFunAddr == NULL)
163. {
164. GetErrorToInfo();
165. FreeLibrary(hExportDll);
166. CloseHandle(hTargetProcess);
167. return -1;
168. }
169. //申请远程参数空间
170. LPVOID lpParamaAddr = VirtualAllocEx(hTargetProcess, NULL, sizeof(RemoteParam),
171. MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
173. if(lpParamaAddr == NULL)
174. {
175. GetErrorToInfo();
176. FreeLibrary(hExportDll);
177. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
178. CloseHandle(hTargetProcess);
179. return -1;
180. }
181. //把拦截函数体写入目标进程地址空间
182. DWORD dwError = 0;
183. if(!WriteProcessMemory(hTargetProcess, lpFunAddr, lpHookFunAddr, HOOKFUCTIONSIZE, &dwError))
184. {
185. MessageBox(NULL, "a", "a", 0);
186. GetErrorToInfo();
187. FreeLibrary(hExportDll);
188. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
189. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
190. CloseHandle(hTargetProcess);
191. return -1;
192. }
194. //设置远程参数，下一步要把参数写入眼要拦截的远程进程地址空间
195. RemoteParam RParam;
196. ZeroMemory(&RParam, sizeof(RParam));
197. unsigned char oldcode[10];
198. unsigned char newcode[10];
200. if(!ReadProcessMemory(GetCurrentProcess(),
201. lpApiAddr,
202. oldcode,
203. 10,
204. &dwError))
205. {
206. GetErrorToInfo();
207. FreeLibrary(hExportDll);
208. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
209. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
210. CloseHandle(hTargetProcess);
211. return -1;
212. }
214. //生成跳转指令，这将覆盖要拦截的api的前十个字节
215. int praadd = (int)lpParamaAddr;
216. int threadadd = (int)lpFunAddr;
217. newcode[4] = praadd>>24;
218. newcode[3] = (praadd<<8)>>24;
219. newcode[2] = (praadd<<16)>>24;
220. newcode[1] = (praadd<<24)>>24;
221. newcode[0] = 0x68; //PUSH lpParamaAddr
222. int offsetaddr = threadadd - (int)lpApiAddr - 10 ;
223. newcode[9] = offsetaddr>>24;
224. newcode[8] = (offsetaddr<<8)>>24;
225. newcode[7] = (offsetaddr<<16)>>24;
226. newcode[6] = (offsetaddr<<24)>>24;
227. newcode[5] = 0xE8; //CALL lpFunAddr
228. strcat((char*)RParam.szOldCode, (char*)oldcode);
229. strcat((char*)RParam.szNewCode, (char*)newcode);
230. RParam.FunAddr = lpApiAddr;
231. HMODULE hKernel32 = LoadLibrary("Kernel32.dll");
232. if(hKernel32 == NULL)
233. {
234. GetErrorToInfo();
235. FreeLibrary(hExportDll);
236. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
237. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
238. CloseHandle(hTargetProcess);
239. return -1;
240. }
241. RParam.lpGetCurrentProcess = GetProcAddress(hKernel32, "GetCurrentProcess");
242. RParam.lpWriteProcessMemory = GetProcAddress(hKernel32, "WriteProcessMemory");
243. if(RParam.lpGetCurrentProcess == NULL || RParam.lpWriteProcessMemory == NULL)
244. {
245. GetErrorToInfo();
246. FreeLibrary(hExportDll);
247. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
248. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
249. CloseHandle(hTargetProcess);
250. FreeLibrary(hKernel32);
251. return -1;
252. }
254. //以上皆为必须，下面可以为自己的拦截函数中所需要用的一些变量以及系统api放到参数中去
255. //比如我在拦截函数中只是弹出一个对话框，标题为"HOOK"，内容为"Now,hook:)"，这样定义
256. HMODULE hUser32 = LoadLibrary("User32.dll");
257. if(hUser32 == NULL)
258. {
259. GetErrorToInfo();
260. FreeLibrary(hExportDll);
261. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
262. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
263. CloseHandle(hTargetProcess);
264. FreeLibrary(hKernel32);
265. return -1;
266. }
267. RParam.lpMessageBox = GetProcAddress(hUser32, "MessageBoxA");
268. if(RParam.lpMessageBox == NULL)
269. {
270. GetErrorToInfo();
271. FreeLibrary(hExportDll);
272. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
273. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
274. CloseHandle(hTargetProcess);
275. FreeLibrary(hKernel32);
276. FreeLibrary(hUser32);
277. return -1;
278. }
279. strcat((char*)RParam.szCaption, "HOOK\0");
280. strcat((char*)RParam.szMessage, "Now,hook:)\0");
281. FreeLibrary(hUser32);
282. //下面为必须部分
283. //把参数写入要拦截的远程进程地址空间
284. if(!WriteProcessMemory(hTargetProcess, lpParamaAddr, (LPVOID)&RParam, sizeof(RParam), &dwError))
285. {
286. GetErrorToInfo();
287. FreeLibrary(hExportDll);
288. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
289. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
290. CloseHandle(hTargetProcess);
291. FreeLibrary(hKernel32);
292. return -1;
293. }
294. //把新的跳转指令写入要拦截的目标进程的要拦截的api的函数的前十字节
295. if(!WriteProcessMemory(hTargetProcess, lpApiAddr , (LPVOID)newcode, 10, &dwError))
296. {
297. GetErrorToInfo();
298. FreeLibrary(hExportDll);
299. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
300. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
301. CloseHandle(hTargetProcess);
302. FreeLibrary(hKernel32);
303. return -1;
304. }
305. //完成，收工，清理资源
306. FreeLibrary(hExportDll);
307. CloseHandle(hTargetProcess);
308. FreeLibrary(hKernel32);
309. return 0;
310. }

复制代码

调用代码:

1. &#35;include "CommonHook.h"
2. int main(void)
3. {
4. if(!AdjustProcessPrivileges(SE_DEBUG_NAME))
5. return -1;
6. SetHook(832, "connect", "Ws2_32.dll", &HooKApi);
7. return 0;
8. }

复制代码