[原创]winxp下简单实现注册表修改、进程创建监控

原本想写个监控所有进程的注册表添加的程序,但是在进行到快结束的时候,发现在我们平时的操作中注册表操作太多了,过多的报警,反而觉得不好. 该程序在用户层下Hook了ZwCreateProcessEx和ZwSetValueKey两个API,具体原理就不多说了,目标进程申请内存、代码释放、修改api入口、跳转实现hook.感兴趣的就看看吧.. 原先想实现的自动监控的功能没有实现,不过大模块已经完成了,原理很简单,写起代码起来却是很烦躁,动一发牵全身,实在有点痛苦,不愿意再去改这改那了,或许交给希望了解的人去测试,效果会好些^_^,最后请原谅代码中出现的一些写得非常糟糕的地方,我真的是不敢再去看自己的代码了 测试方法:在最后的主函数中,修改第一个SetHook函数的第一个参数为你想要监视的进程ID,这时该进程,以及该进程所创建的任何进程都将被监视,并且在其修改注册表的时候弹出对话框询问是否允许进行该次注册表修改操作,点';y';允许操作,否则拒绝操作. 编译环境:winxp sp2 + vc6

1. &#35;include <stdio.h>
2. &#35;include <windows.h>
3. /*
4. //一些编译选项
5. &#35;pragma comment(linker, "/ENTRY:main")
6. &#35;pragma comment(linker,"/ALIGN:0x400")
7. &#35;pragma comment(linker,"/SECTION:.text,ERW /ALIGN:0x1000")
8. &#35;pragma comment(linker,"/merge:.data=.text")
9. &#35;pragma comment(linker,"/merge:.rdata=.text")
10. &#35;pragma comment (linker, "/Filealign:0x200")
11. &#35;pragma comment (linker, "/OPT:REF")
12. &#35;pragma comment (linker, "/OPT:ICF")
13. &#35;pragma optimize("gsy", on)
14. &#35;pragma comment (linker,"/merge:.rsrc=.text")
15. &#35;pragma comment (linker, "/ALIGN:16")
16. &#35;pragma comment (linker, "/OPT:NOWIN98")
17. */
18. &#35;define STATUS_SUCCESS (0)
19. &#35;define ObjectNameInformation (1)
20. &#35;define BLOCKSIZE (0x1000)
21. &#35;define CurrentProcessHandle ((HANDLE)(0xFFFFFFFF))
22. &#35;define NT_PROCESS_LIST 5
23. &#35;define STATUS_INFO_LEN_MISMATCH 0xC0000004
25. typedef unsigned long NTSTATUS;
26. typedef unsigned long SYSTEM_INFORMATION_CLASS;
27. typedef unsigned long OBJECT_INFORMATION_CLASS;
28. typedef struct{
29. USHORT Length;
30. USHORT MaxLen;
31. USHORT *Buffer;
32. }UNICODE_STRING, * PUNICODE_STRING;
33. typedef struct _OBJECT_NAME_INFORMATION { // Information Class 1
34. UNICODE_STRING Name;
35. } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
36. typedef struct _RemoteParam{
37. LPVOID lpFunAddr;
38. DWORD dwParamSize;
39. LPVOID lpHeapAlloc;
40. LPVOID lpGetProcessHeap;
41. LPVOID lpHeapReAlloc;
42. LPVOID lpHeapFree;
43. LPVOID lpwsprintf;
44. LPVOID lpZwQueryObject;
45. LPVOID lpMessageBox;
46. LPVOID lpWriteProcessMemory;
47. wchar_t wProcessName[36];
48. unsigned char szOldCode[12];
49. unsigned char szNewCode[12];
50. LPVOID lpResumeThread;
51. LPVOID lpCreateEvent;
52. LPVOID lpOpenEvent;
53. LPVOID lpOpenFileMapping;
54. LPVOID lpMapViewOfFile;
55. LPVOID lpUnMapViewOfFile;
56. LPVOID lpOpenMutex;
57. LPVOID lpWaitForSingleObject;
58. LPVOID lpSetEvent;
59. LPVOID lpReleaseMutex;
60. LPVOID lpCloseHandle;
61. LPVOID lpGetProcessId;
62. LPVOID lpGetLastError;
63. }RemoteParam, * PRemoteParam;
64. typedef
65. BOOL
66. (__stdcall * PFN_WRITEPROCESSMEMORY)(
67. IN HANDLE hProcess,
68. IN LPVOID lpBaseAddress,
69. IN LPCVOID lpBuffer,
70. IN SIZE_T nSize,
71. OUT SIZE_T* lpNumberOfBytesWritten
72. );
73. typedef
74. int
75. (__stdcall * PFN_MESSAGEBOX)(
76. IN HWND hWnd,
77. IN LPCWSTR lpText,
78. IN LPCWSTR lpCaption,
79. IN UINT uType
80. );
81. typedef
82. int
83. (__cdecl * PFN_WSPRINTF)(
84. IN LPWSTR lpOut,
85. IN LPCWSTR lpFmt,
86. ...);
87. typedef
88. HANDLE
89. (__stdcall * PFN_GETPROCESSHEAP)(void);
90. typedef
91. LPVOID
92. (__stdcall * PFN_HEAPALLOC)(
93. IN HANDLE hHeap,
94. IN DWORD dwFlags,
95. IN SIZE_T dwBytes
96. );
97. typedef
98. LPVOID
99. (__stdcall * PFN_HEAPREALLOC)(
100. IN HANDLE hHeap,
101. IN DWORD dwFlags,
102. IN LPVOID lpMem,
103. IN DWORD dwBytes
104. );
105. typedef
106. BOOL
107. (__stdcall * PFN_HEAPFREE)(
108. IN HANDLE hHeap,
109. IN DWORD dwFlags,
110. IN LPVOID lpMem
111. );
112. typedef
113. NTSTATUS
114. (__stdcall * PFN_ZWSETVALUEKEY)(
115. IN HANDLE KeyHandle,
116. IN PUNICODE_STRING ValueName,
117. IN ULONG TitleIndex,
118. IN ULONG type1,
119. IN PVOID Data,
120. IN ULONG DataSize
121. );
122. typedef
123. NTSTATUS
124. (__stdcall * PFN_ZWQUERYOBJECT)(
125. IN HANDLE ObjectHandle,
126. IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
127. OUT PVOID ObjectInformation,
128. IN ULONG ObjectInformationLength,
129. OUT PULONG ReturnLength
130. );
132. typedef
133. NTSTATUS
134. (__stdcall * PFN_ZWCREATEPROCESSEX)(
135. OUT PHANDLE ProcessHandle,
136. IN ACCESS_MASK DesiredAccess,
137. IN LPVOID ObjectAttributes,
138. IN HANDLE InheritFromProcessHandle,
139. IN BOOLEAN InheritHandles,
140. IN HANDLE SectionHandle,
141. IN HANDLE DebugPort,
142. IN HANDLE ExceptionPort,
143. IN HANDLE reserv
144. );
145. typedef
146. BOOL
147. (__stdcall * PFN_CREATEPROCESSW)(
148. IN LPCTSTR pszApplicationName,
149. IN PTSTR pszCommandLine,
150. IN PSECURITY_ATTRIBUTES psaProcess,
151. IN PSECURITY_ATTRIBUTES psaThread,
152. IN BOOL bInheritHandles,
153. IN DWORD fdwCreate,
154. IN PVOID pvEnvironment,
155. IN LPCTSTR pszCurDir,
156. OUT LPSTARTUPINFO psiStartInfo,
157. OUT PPROCESS_INFORMATION ppiProcInfo
158. );
159. typedef
160. DWORD
161. (__stdcall * PFN_RESUMETHREAD)(
162. IN HANDLE hThread
163. );
164. typedef
165. HANDLE
166. (__stdcall * PFN_CREATEEVENT)(
167. IN LPSECURITY_ATTRIBUTES lpEventAttributes,
168. IN BOOL bManualReset,
169. IN BOOL bInitialState,
170. IN LPCTSTR lpName
171. );
172. typedef
173. HANDLE
174. (__stdcall * PFN_OPENEVENT)(
175. IN DWORD dwDesiredAccess,
176. IN BOOL bInheritHandle,
177. IN LPCTSTR lpName
178. );
179. typedef
180. HANDLE
181. (__stdcall * PFN_OPENFILEMAPPING)(
182. IN DWORD dwDesiredAccess,
183. IN BOOL bInheritHandle,
184. IN LPCTSTR lpName
185. );
186. typedef
187. LPVOID
188. (__stdcall * PFN_MAPVIEWOFFILE)(
189. IN HANDLE hFileMappingObject,
190. IN DWORD dwDesiredAccess,
191. IN DWORD dwFileOffsetHigh,
192. IN DWORD dwFileOffsetLow,
193. IN SIZE_T dwNumberOfBytesToMap
194. );
195. typedef
196. BOOL
197. (__stdcall * PFN_UNMAPVIEWOFFILE)(
198. IN LPCVOID lpBaseAddress
199. );
200. typedef
201. HANDLE
202. (__stdcall * PFN_OPENMUTEX)(
203. IN DWORD dwDesiredAccess,
204. IN BOOL bInheritHandle,
205. IN LPCTSTR lpName
206. );
207. typedef
208. DWORD
209. (__stdcall * PFN_WAITFORSINGLEOBJECT)(
210. IN HANDLE hHandle,
211. IN DWORD dwMilliseconds
212. );
213. typedef
214. BOOL
215. (__stdcall * PFN_SETEVENT)(
216. IN HANDLE hEvent
217. );
218. typedef
219. BOOL
220. (__stdcall * PFN_RELEASEMUTEX)(
221. IN HANDLE hMutex
222. );
223. typedef
224. BOOL
225. (__stdcall * PFN_CLOSEHANDLE)(
226. IN HANDLE hObject
227. );
228. typedef
229. DWORD
230. (__stdcall * PFN_GETPROCESSID)(
231. IN HANDLE Process
232. );
233. typedef
234. DWORD
235. (__stdcall * PFN_GETLASTERROR)(void);
237. //////////////////////////////////////////////////////////////////////////
238. //Hook CreateProcessW
239. //Returns True
240. //////////////////////////////////////////////////////////////////////////
241. void HookCreateProcessW(LPVOID lParam)
242. {
243. RemoteParam* Rpm = (RemoteParam*)lParam;
244. PFN_CREATEPROCESSW pfnCreateProcessW = (PFN_CREATEPROCESSW)Rpm->lpFunAddr;
245. PFN_WRITEPROCESSMEMORY pfnWriteProcessMemory = (PFN_WRITEPROCESSMEMORY)Rpm->lpWriteProcessMemory;
246. PFN_MESSAGEBOX pfnMessageBox = (PFN_MESSAGEBOX)Rpm->lpMessageBox;
247. PFN_RESUMETHREAD pfnResumeThread = (PFN_RESUMETHREAD)Rpm->lpResumeThread;
249. LPCTSTR pszApplicationName = NULL;
250. PTSTR pszCommandLine = NULL;
251. PSECURITY_ATTRIBUTES psaProcess = NULL;
252. PSECURITY_ATTRIBUTES psaThread = NULL;
253. BOOL bInheritHandles = TRUE;
254. DWORD fdwCreate = 0;
255. PVOID pvEnvironment = NULL;
256. LPCTSTR pszCurDir = NULL;
257. LPSTARTUPINFO psiStartInfo = NULL;
258. PPROCESS_INFORMATION ppiProcInfo = NULL;
260. BOOL Retvalue = TRUE; //定义要拦截的api的默认返回植
261. DWORD NextIpAddr = 0;
262. DWORD dwParamaAddr = 0;
263. long temp1 = 0;
265. __asm
266. {
267. MOV EAX, [EBP + 12]
268. MOV [NextIpAddr], EAX
269. MOV EAX, [EBP + 16]
270. MOV [pszApplicationName], EAX
271. MOV EAX, [EBP + 20]
272. MOV [pszCommandLine], EAX
273. MOV EAX, [EBP + 24]
274. MOV [psaProcess], EAX
275. MOV EAX, [EBP + 28]
276. MOV [psaThread], EAX
277. MOV EAX, [EBP + 32]
278. MOV [temp1], EAX
279. MOV EAX, [EBP + 36]
280. MOV [fdwCreate], EAX
281. MOV EAX, [EBP + 40]
282. MOV [pvEnvironment], EAX
283. MOV EAX, [EBP + 44]
284. MOV [pszCurDir], EAX
285. MOV EAX, [EBP + 48]
286. MOV [psiStartInfo], EAX
287. MOV EAX, [EBP + 52]
288. MOV [ppiProcInfo], EAX
289. }
290. bInheritHandles = (BOOL)temp1;
291. // fdwCreate = fdwCreate | CREATE_SUSPENDED;
292. //这里可以做你的事情了，比如我只想弹出一个对话框,其实也可以在让api完成之后再做些东西
294. pfnWriteProcessMemory(CurrentProcessHandle, Rpm->lpFunAddr, (LPCVOID)Rpm->szOldCode, 12, NULL);
295. //让api真正执行
296. Retvalue = pfnCreateProcessW(
297. pszApplicationName,
298. pszCommandLine,
299. psaProcess,
300. psaThread,
301. bInheritHandles,
302. fdwCreate,
303. pvEnvironment,
304. pszCurDir,
305. psiStartInfo,
306. ppiProcInfo);
308. //再次恢复对他的拦截
309. pfnWriteProcessMemory(CurrentProcessHandle, Rpm->lpFunAddr, (LPCVOID)Rpm->szNewCode, 12, NULL);
310. pfnMessageBox(NULL, Rpm->wProcessName, Rpm->wProcessName, 0);
311. // pfnResumeThread(ppiProcInfo->hThread);
313. DWORD dwStackSize = 12 + Rpm->dwParamSize;
315. //这里对拦截函数堆栈的恢复
316. __asm
317. {
318. POP EDI
319. POP ESI
320. POP EBX
321. MOV ECX, [dwStackSize]
322. MOV EDX, [NextIpAddr]
323. MOV EAX, [Retvalue]
324. MOV ESP, EBP
325. POP EBP
326. ADD ESP, ECX //恢复堆栈
327. PUSH EDX
328. RET
329. }
330. }
331. //////////////////////////////////////////////////////////////////////////
332. //Hook ZwCreateProcessEx
333. //Returns STATUS_SUCCESS or an error status, such as STATUS_ACCESS_DENIED or
334. //STATUS_INVALID_HANDLE.
335. //////////////////////////////////////////////////////////////////////////
336. void HookZwCreateProcessEx(LPVOID lParam)
337. {
338. RemoteParam* Rpm = (RemoteParam*)lParam;
339. PFN_ZWCREATEPROCESSEX pfnZwCreateprocessEx = (PFN_ZWCREATEPROCESSEX)Rpm->lpFunAddr;
340. PFN_WRITEPROCESSMEMORY pfnWriteProcessMemory = (PFN_WRITEPROCESSMEMORY)Rpm->lpWriteProcessMemory;
341. PFN_MESSAGEBOX pfnMessageBox = (PFN_MESSAGEBOX)Rpm->lpMessageBox;
342. PFN_WSPRINTF pfnwsprintf = (PFN_WSPRINTF)Rpm->lpwsprintf;
343. // wchar_t wOut[32] = {';\0';};
344. // wchar_t wFmr[3] = {';%';, ';x';, ';\0';};
345. PFN_CREATEEVENT pfnCreateEvent = (PFN_CREATEEVENT)Rpm->lpCreateEvent;
346. PFN_OPENEVENT pfnOpenEvent = (PFN_OPENEVENT)Rpm->lpOpenEvent;
347. PFN_OPENFILEMAPPING pfnOpenFileMapping = (PFN_OPENFILEMAPPING)Rpm->lpOpenFileMapping;
348. PFN_MAPVIEWOFFILE pfnMapViewOfFile = (PFN_MAPVIEWOFFILE)Rpm->lpMapViewOfFile;
349. PFN_UNMAPVIEWOFFILE pfnUnMapViewOfFile = (PFN_UNMAPVIEWOFFILE)Rpm->lpUnMapViewOfFile;
350. PFN_OPENMUTEX pfnOpenMutex = (PFN_OPENMUTEX)Rpm->lpOpenMutex;
351. PFN_WAITFORSINGLEOBJECT pfnWaitForSingleObject = (PFN_WAITFORSINGLEOBJECT)Rpm->lpWaitForSingleObject;
352. PFN_SETEVENT pfnSetEvent = (PFN_SETEVENT)Rpm->lpSetEvent;
353. PFN_RELEASEMUTEX pfnReleaseMutex = (PFN_RELEASEMUTEX)Rpm->lpReleaseMutex;
354. PFN_CLOSEHANDLE pfnCloseHandle = (PFN_CLOSEHANDLE)Rpm->lpCloseHandle;
355. PFN_GETPROCESSID pfnGetProcessId = (PFN_GETPROCESSID)Rpm->lpGetProcessId;
356. PFN_GETLASTERROR pfnGetLastError = (PFN_GETLASTERROR)Rpm->lpGetLastError;
357. HANDLE hHookMainAliveEvent = NULL;
358. HANDLE hMapFileOperateMutex = NULL;
359. HANDLE hMapFileModifiedEvent = NULL;
360. HANDLE hHookNewProcessDoneEvent = NULL;
361. HANDLE hMapFileToNewProcessId = NULL;
362. LPVOID lpMapFileToNewProcessId = NULL;
363. char szHookMainAliveEvent[20] = {';H';, ';o';, ';o';, ';k';, ';M';, ';a';, ';i';, ';n';, ';A';,
364. ';l';, ';i';, ';v';, ';e';, ';E';, ';v';, ';e';, ';n';, ';t';, ';\0';};
365. char szMapFileOperateMutex[21] = {';M';, ';a';, ';p';, ';F';, ';i';, ';l';, ';e';, ';O';, ';p';, ';e';,
366. ';r';, ';a';, ';t';, ';e';, ';M';, ';u';, ';t';, ';e';, ';x';, ';\0';};
367. char szMapFileModifiedEvent[22] = {';M';, ';a';, ';p';, ';F';, ';i';, ';l';, ';e';, ';M';, ';o';, ';d';,
368. ';i';, ';f';, ';i';, ';e';, ';d';, ';E';, ';v';, ';e';, ';n';, ';t';, ';\0';};
369. char szHookNewProcessDoneEvent[25] = {';H';, ';o';, ';o';, ';k';, ';N';, ';e';, ';w';, ';P';, ';r';, ';o';, ';c';,
370. ';e';, ';s';, ';s';, ';D';, ';o';, ';n';, ';e';, ';E';, ';v';, ';e';, ';n';, ';t';, ';\0';};
371. char szMapFileToNewProcessId[23] ={';M';, ';a';, ';p';, ';F';, ';i';, ';l';, ';e';, ';T';, ';o';, ';N';, ';e';,
372. ';w';, ';P';, ';r';, ';o';, ';c';, ';e';, ';s';, ';s';, ';I';, ';d';, ';\0';};
373. PHANDLE ProcessHandle = NULL;
374. ACCESS_MASK DesiredAccess = 0;
375. LPVOID ObjectAttributes = NULL;
376. HANDLE InheritFromProcessHandle = NULL;
377. BOOLEAN InheritHandles = TRUE;
378. HANDLE SectionHandle = NULL;
379. HANDLE DebugPort = NULL;
380. HANDLE ExceptionPort = NULL;
381. HANDLE reserv = NULL;
383. NTSTATUS Retvalue = STATUS_SUCCESS; //定义要拦截的api的默认返回植
384. DWORD NextIpAddr = 0;
385. DWORD dwParamaAddr = 0;
386. DWORD temp1 = 0;
388. __asm
389. {
390. MOV EAX, [EBP + 12]
391. MOV [NextIpAddr], EAX
392. MOV EAX, [EBP + 16]
393. MOV [ProcessHandle], EAX
394. MOV EAX, [EBP + 20]
395. MOV [DesiredAccess], EAX
396. MOV EAX, [EBP + 24]
397. MOV [ObjectAttributes], EAX
398. MOV EAX, [EBP + 28]
399. MOV [InheritFromProcessHandle], EAX
400. MOV EAX, [EBP + 32]
401. MOV [temp1], EAX
402. MOV EAX, [EBP + 36]
403. MOV [SectionHandle], EAX
404. MOV EAX, [EBP + 40]
405. MOV [DebugPort], EAX
406. MOV EAX, [EBP + 44]
407. MOV [ExceptionPort], EAX
408. MOV EAX, [EBP + 48]
409. MOV [reserv], EAX
410. }
411. InheritHandles = (BOOLEAN)temp1;
413. pfnWriteProcessMemory(CurrentProcessHandle, Rpm->lpFunAddr, (LPCVOID)Rpm->szOldCode, 12, NULL);
414. //让api真正执行
415. Retvalue = pfnZwCreateprocessEx(ProcessHandle,
416. DesiredAccess,
417. ObjectAttributes,
418. InheritFromProcessHandle,
419. InheritHandles,
420. SectionHandle,
421. DebugPort,
422. ExceptionPort,
423. reserv);
424. DWORD dwStackSize = 12 + Rpm->dwParamSize;
426. //新进程已经创建，此时进程空间中仅仅加载ntdll.dll和进程映象本身，主线程也尚未启动，
427. //这里把返回的进程句柄转换成进程id放到内存映射文件中去，交由主拦截进程对其进行拦截，
428. //此时该创建处于block状态，等待主拦截进程拦截完毕的对象消息，然后再恢复进程的创建。
429. hHookMainAliveEvent = pfnCreateEvent(NULL, TRUE, TRUE, szHookMainAliveEvent);
430. if(pfnGetLastError() == ERROR_ALREADY_EXISTS)
431. {
432. //再次恢复对他的拦截
433. pfnWriteProcessMemory(CurrentProcessHandle, Rpm->lpFunAddr, (LPCVOID)Rpm->szNewCode, 12, NULL);
435. hMapFileToNewProcessId = pfnOpenFileMapping(FILE_MAP_ALL_ACCESS, NULL, szMapFileToNewProcessId);
436. if(hMapFileToNewProcessId == NULL)
437. {
438. __asm
439. {
440. POP EDI
441. POP ESI
442. POP EBX
443. MOV ECX, [dwStackSize]
444. MOV EDX, [NextIpAddr]
445. MOV EAX, [Retvalue]
446. MOV ESP, EBP
447. POP EBP
448. ADD ESP, ECX //恢复堆栈
449. PUSH EDX
450. RET
451. }
452. }
453. lpMapFileToNewProcessId = pfnMapViewOfFile(hMapFileToNewProcessId, FILE_MAP_ALL_ACCESS, 0, 0, 0);
454. if(lpMapFileToNewProcessId == NULL)
455. {
456. pfnCloseHandle(hMapFileToNewProcessId);
457. __asm
458. {
459. POP EDI
460. POP ESI
461. POP EBX
462. MOV ECX, [dwStackSize]
463. MOV EDX, [NextIpAddr]
464. MOV EAX, [Retvalue]
465. MOV ESP, EBP
466. POP EBP
467. ADD ESP, ECX //恢复堆栈
468. PUSH EDX
469. RET
470. }
471. }
472. hMapFileOperateMutex = pfnOpenMutex(MUTEX_MODIFY_STATE, FALSE, szMapFileOperateMutex);
473. if(hMapFileOperateMutex == NULL)
474. {
475. pfnUnMapViewOfFile(lpMapFileToNewProcessId);
476. pfnCloseHandle(hMapFileToNewProcessId);
477. __asm
478. {
479. POP EDI
480. POP ESI
481. POP EBX
482. MOV ECX, [dwStackSize]
483. MOV EDX, [NextIpAddr]
484. MOV EAX, [Retvalue]
485. MOV ESP, EBP
486. POP EBP
487. ADD ESP, ECX //恢复堆栈
488. PUSH EDX
489. RET
490. }
491. }
492. DWORD dwPid = pfnGetProcessId(*ProcessHandle);
493. if(dwPid == 0)
494. {
495. pfnUnMapViewOfFile(lpMapFileToNewProcessId);
496. pfnCloseHandle(hMapFileToNewProcessId);
497. pfnCloseHandle(hMapFileOperateMutex);
498. __asm
499. {
500. POP EDI
501. POP ESI
502. POP EBX
503. MOV ECX, [dwStackSize]
504. MOV EDX, [NextIpAddr]
505. MOV EAX, [Retvalue]
506. MOV ESP, EBP
507. POP EBP
508. ADD ESP, ECX //恢复堆栈
509. PUSH EDX
510. RET
511. }
512. }
513. pfnWaitForSingleObject(hMapFileOperateMutex, INFINITE);
514. DWORD * temp2 = (DWORD*)lpMapFileToNewProcessId;
515. *temp2 = dwPid;
516. pfnUnMapViewOfFile(lpMapFileToNewProcessId);
517. pfnCloseHandle(hMapFileToNewProcessId);
519. hMapFileModifiedEvent = pfnOpenEvent(EVENT_MODIFY_STATE, NULL, szMapFileModifiedEvent);
520. if(hMapFileModifiedEvent == NULL)
521. {
522. pfnReleaseMutex(hMapFileOperateMutex);
523. pfnCloseHandle(hMapFileOperateMutex);
524. __asm
525. {
526. POP EDI
527. POP ESI
528. POP EBX
529. MOV ECX, [dwStackSize]
530. MOV EDX, [NextIpAddr]
531. MOV EAX, [Retvalue]
532. MOV ESP, EBP
533. POP EBP
534. ADD ESP, ECX //恢复堆栈
535. PUSH EDX
536. RET
537. }
538. }
539. pfnSetEvent(hMapFileModifiedEvent);
540. hHookNewProcessDoneEvent = pfnOpenEvent(EVENT_MODIFY_STATE, NULL, szHookNewProcessDoneEvent);
541. if(hHookNewProcessDoneEvent == NULL)
542. {
543. pfnReleaseMutex(hMapFileOperateMutex);
544. pfnCloseHandle(hMapFileOperateMutex);
545. pfnCloseHandle(hMapFileModifiedEvent);
546. __asm
547. {
548. POP EDI
549. POP ESI
550. POP EBX
551. MOV ECX, [dwStackSize]
552. MOV EDX, [NextIpAddr]
553. MOV EAX, [Retvalue]
554. MOV ESP, EBP
555. POP EBP
556. ADD ESP, ECX //恢复堆栈
557. PUSH EDX
558. RET
559. }
560. }
561. pfnWaitForSingleObject(hHookNewProcessDoneEvent, INFINITE);
562. pfnCloseHandle(hMapFileModifiedEvent);
563. pfnCloseHandle(hHookNewProcessDoneEvent);
564. pfnReleaseMutex(hMapFileOperateMutex);
565. pfnCloseHandle(hMapFileOperateMutex);
566. }
567. else
568. {
569. pfnCloseHandle(hHookMainAliveEvent);
570. }
571. //这里对拦截函数堆栈的恢复
572. __asm
573. {
574. POP EDI
575. POP ESI
576. POP EBX
577. MOV ECX, [dwStackSize]
578. MOV EDX, [NextIpAddr]
579. MOV EAX, [Retvalue]
580. MOV ESP, EBP
581. POP EBP
582. ADD ESP, ECX //恢复堆栈
583. PUSH EDX
584. RET
585. }
586. }
587. //////////////////////////////////////////////////////////////////////////
588. //Hook ZwSetValueKey
589. //Returns STATUS_SUCCESS or an error status, such as STATUS_ACCESS_DENIED,
590. //STATUS_INVALID_HANDLE, STATUS_KEY_DELETED, or STATUS_NO_LOG_SPACE.
591. //////////////////////////////////////////////////////////////////////////
592. void HookZwSetValueKey(LPVOID lParam)
593. {
594. RemoteParam* Rpm = (RemoteParam*)lParam;
595. PFN_ZWSETVALUEKEY pfnZwSetValueKey = (PFN_ZWSETVALUEKEY)Rpm->lpFunAddr;
596. PFN_WRITEPROCESSMEMORY pfnWriteProcessMemory = (PFN_WRITEPROCESSMEMORY)Rpm->lpWriteProcessMemory;
597. PFN_MESSAGEBOX pfnMessageBox = (PFN_MESSAGEBOX)Rpm->lpMessageBox;
598. PFN_ZWQUERYOBJECT pfnZwQueryObject = (PFN_ZWQUERYOBJECT)Rpm->lpZwQueryObject;
599. PFN_WSPRINTF pfnwsprintf = (PFN_WSPRINTF)Rpm->lpwsprintf;
600. PFN_GETPROCESSHEAP pfnGetProcessHeap = (PFN_GETPROCESSHEAP)Rpm->lpGetProcessHeap;
601. PFN_HEAPALLOC pfnHeapAlloc = (PFN_HEAPALLOC)Rpm->lpHeapAlloc;
602. PFN_HEAPREALLOC pfnHeapReAlloc = (PFN_HEAPREALLOC)Rpm->lpHeapReAlloc;
603. PFN_HEAPFREE pfnHeapFree = (PFN_HEAPFREE)Rpm->lpHeapFree;
604. PFN_CREATEEVENT pfnCreateEvent = (PFN_CREATEEVENT)Rpm->lpCreateEvent;
605. PFN_GETLASTERROR pfnGetLastError = (PFN_GETLASTERROR)Rpm->lpGetLastError;
606. PFN_CLOSEHANDLE pfnCloseHandle = (PFN_CLOSEHANDLE)Rpm->lpCloseHandle;
608. HANDLE KeyHandle = NULL;
609. PUNICODE_STRING ValueName = NULL;
610. ULONG TitleIndex = 0;
611. ULONG type1 = 0;
612. PVOID Data = NULL;
613. ULONG DataSize = 0;
615. NTSTATUS Retvalue = STATUS_SUCCESS; //定义要拦截的api的默认返回植
616. DWORD NextIpAddr = 0;
617. DWORD dwParamaAddr = 0;
618. DWORD dwStackSize = 12 + Rpm->dwParamSize;
619. __asm
620. {
621. MOV EAX, [EBP + 12]
622. MOV [NextIpAddr], EAX
623. MOV EAX, [EBP + 16]
624. MOV [KeyHandle], EAX
625. MOV EAX, [EBP + 20]
626. MOV [ValueName], EAX
627. MOV EAX, [EBP + 24]
628. MOV [TitleIndex], EAX
629. MOV EAX, [EBP + 28]
630. MOV [type1], EAX
631. MOV EAX, [EBP + 32]
632. MOV [Data], EAX
633. MOV EAX, [EBP + 36]
634. MOV [DataSize], EAX
635. }
636. HANDLE hHeap = pfnGetProcessHeap();
637. DWORD retSize = 0;
638. POBJECT_NAME_INFORMATION pName = (POBJECT_NAME_INFORMATION)pfnHeapAlloc(hHeap, HEAP_ZERO_MEMORY, BLOCKSIZE);
639. NTSTATUS ns = pfnZwQueryObject(KeyHandle, ObjectNameInformation, (PVOID)pName, BLOCKSIZE, &retSize);
640. DWORD i = 1;
641. while(ns == STATUS_INFO_LEN_MISMATCH)
642. {
643. pName = (POBJECT_NAME_INFORMATION)pfnHeapReAlloc(hHeap, HEAP_ZERO_MEMORY, (LPVOID)pName, BLOCKSIZE * i);
644. ns = pfnZwQueryObject(KeyHandle, ObjectNameInformation, (PVOID)pName, BLOCKSIZE, NULL);
645. i++;
646. }
647. char szHookMainAliveEvent[20] = {';H';, ';o';, ';o';, ';k';, ';M';, ';a';, ';i';, ';n';, ';A';,
648. ';l';, ';i';, ';v';, ';e';, ';E';, ';v';, ';e';, ';n';, ';t';, ';\0';};
649. wchar_t wObjectPath[260] = {';\0';};
650. wchar_t wFmr1[21] = {';%';, ';s';, ';\\';, ';%';, ';s';, '; ';, '; ';, ';v';, ';a';, ';l';, ';u';, ';e';, ';:';, ';%';,
651. ';s';, '; ';, ';Y';, ';/';, ';N';, ';?';, ';\0';};
652. wchar_t wFmr2[27] = {';%';, ';s';, ';\\';, ';%';, ';s';, '; ';, '; ';, ';v';, ';a';, ';l';, ';u';, ';e';, ';:';, ';%';,
653. ';d';, ';(';, ';0';, ';X';, ';%';, ';X';, ';)';, '; ';, ';Y';, ';/';, ';N';, ';?';, ';\0';};
654. wchar_t wFmr3[27] = {';%';, ';s';, ';\\';, ';%';, ';s';, '; ';, '; ';, ';t';, ';y';, ';p';, ';e';, ';:';, ';R';, ';E';,
655. ';G';, ';_';, ';B';, ';I';, ';N';, ';A';, ';Y';, '; ';, ';Y';, ';/';, ';N';, ';?';, ';\0';};
656. wchar_t wFmr4[35] = {';%';, ';s';, ';\\';, ';%';, ';s';, '; ';, '; ';, ';t';, ';y';, ';p';, ';e';, ';:';, ';R';, ';E';,
657. ';G';, ';_';, ';R';, ';E';, ';S';, ';O';, ';U';, ';R';, ';C';, ';E';, ';_';, ';L';, ';I';, ';S';,
658. ';T';, '; ';, ';Y';, ';/';, ';N';, ';?';, ';\0';};
659. if(type1 == 4 || type1 == 5 || type1 == 11)
660. pfnwsprintf(wObjectPath, wFmr2, pName->Name.Buffer, ValueName->Buffer, *(DWORD*)Data, *(DWORD*)Data);
661. else if(type1 == 3)
662. pfnwsprintf(wObjectPath, wFmr3, pName->Name.Buffer, ValueName->Buffer);
663. else if(type1 == 8)
664. pfnwsprintf(wObjectPath, wFmr4, pName->Name.Buffer, ValueName->Buffer);
665. else
666. pfnwsprintf(wObjectPath, wFmr1, pName->Name.Buffer, ValueName->Buffer, Data);
667. pfnHeapFree(hHeap, HEAP_ZERO_MEMORY, pName);
669. HANDLE hHookMainAliveEvent = pfnCreateEvent(NULL, TRUE, TRUE, szHookMainAliveEvent);
670. DWORD dwBeHooked = 0;
671. if(pfnGetLastError() == ERROR_ALREADY_EXISTS)
672. {
673. dwBeHooked = 1;
674. int allowFlag = pfnMessageBox(NULL, wObjectPath, Rpm->wProcessName, MB_ICONINFORMATION | MB_YESNO);
675. if(allowFlag != IDYES)
676. {
677. __asm
678. {
679. POP EDI
680. POP ESI
681. POP EBX
682. MOV ECX, [dwStackSize]
683. MOV EDX, [NextIpAddr]
684. MOV EAX, [Retvalue]
685. MOV ESP, EBP
686. POP EBP
687. ADD ESP, ECX //恢复堆栈
688. PUSH EDX
689. RET
690. }
691. }
692. }
693. pfnWriteProcessMemory(CurrentProcessHandle, Rpm->lpFunAddr, (LPCVOID)Rpm->szOldCode, 12, NULL);
695. //让api真正执行
696. Retvalue = pfnZwSetValueKey(
697. KeyHandle,
698. ValueName,
699. TitleIndex,
700. type1,
701. Data,
702. DataSize);
703. //如果主监视进程存活则再次恢复对他的拦截
704. if(dwBeHooked == 1)
705. pfnWriteProcessMemory(CurrentProcessHandle, Rpm->lpFunAddr, (LPCVOID)Rpm->szNewCode, 12, NULL);
706. pfnCloseHandle(hHookMainAliveEvent);
707. //这里对拦截函数堆栈的恢复
708. __asm
709. {
710. POP EDI
711. POP ESI
712. POP EBX
713. MOV ECX, [dwStackSize]
714. MOV EDX, [NextIpAddr]
715. MOV EAX, [Retvalue]
716. MOV ESP, EBP
717. POP EBP
718. ADD ESP, ECX //恢复堆栈
719. PUSH EDX
720. RET
721. }
722. }
724. //////////////////////////////////////////////////////////////////////////
725. //************************************************************************
726. //模块名字：AdjustProcessPrivileges(LPCSTR)
727. //模块功能：修改调用进程的权限
728. //返回数值：成功返回TRUE，失败返回FALSE
729. //参数选项：
730. // &#35;define SE_BACKUP_NAME TEXT("SeBackupPrivilege")
731. // &#35;define SE_RESTORE_NAME TEXT("SeRestorePrivilege")
732. // &#35;define SE_SHUTDOWN_NAME TEXT("SeShutdownPrivilege")
733. // &#35;define SE_DEBUG_NAME TEXT("SeDebugPrivilege")
734. //////////////////////////////////////////////////////////////////////////
735. BOOL AdjustProcessPrivileges(LPCSTR lpPrivilegesName)
736. {
737. HANDLE hToken;
738. TOKEN_PRIVILEGES tkp;
739. if(!OpenProcessToken(CurrentProcessHandle,
740. TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
741. {
742. return FALSE;
743. }
744. if(!LookupPrivilegeV&#97;lue(NULL, lpPrivilegesName, &tkp.Privileges[0].Luid))
745. {
746. CloseHandle(hToken);
747. return FALSE;
748. }
750. tkp.PrivilegeCount = 1;
751. tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
752. if(!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
753. {
754. CloseHandle(hToken);
755. return FALSE;
756. }
757. CloseHandle(hToken);
758. return TRUE;
759. }
761. int SetHook(DWORD dwPid, LPWSTR lpProcessName, LPCTSTR lpApiName, LPCTSTR lpExportDllName,DWORD dwParamNum, DWORD dwHookFunSize, LPVOID lpHookFunAddr)
762. {
763. if(!AdjustProcessPrivileges(SE_DEBUG_NAME))
764. {
765. printf("-----AdjustProcessPrivileges error..\n");
766. return -1;
767. }
768. printf("1:AdjustProcessPrivileges ok\n");
770. //获取要拦截的api的地址
771. HMODULE hExportDll = LoadLibrary(lpExportDllName);
772. if(hExportDll == NULL)
773. {
774. printf("-----LoadLibrary error..\n");
775. return -1;
776. }
778. LPVOID lpApiAddr = GetProcAddress(hExportDll, lpApiName);
779. if(lpApiAddr == NULL)
780. {
781. printf("-----GetProcAddress %s error..\n", lpApiName);
782. FreeLibrary(hExportDll);
783. return -1;
784. }
786. //打开进程句柄
787. HANDLE hTargetProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,
788. FALSE, dwPid);
789. if(hTargetProcess == NULL)
790. {
791. printf("-----OpenProcess %d error..\n", dwPid);
792. FreeLibrary(hExportDll);
793. return -1;
794. }
796. //申请拦截函数内存空间
797. LPVOID lpFunAddr = VirtualAllocEx(hTargetProcess, NULL, dwHookFunSize,
798. MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
799. if(lpFunAddr == NULL)
800. {
801. printf("-----VirtualAllocEx for remotefuction error..\n");
802. FreeLibrary(hExportDll);
803. CloseHandle(hTargetProcess);
804. return -1;
805. }
807. //申请远程参数空间
808. LPVOID lpParamaAddr = VirtualAllocEx(hTargetProcess, NULL, sizeof(RemoteParam),
809. MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
810. if(lpParamaAddr == NULL)
811. {
812. printf("-----VirtualAllocEx for remoteparam error..\n");
813. FreeLibrary(hExportDll);
814. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
815. CloseHandle(hTargetProcess);
816. return -1;
817. }
818. printf("2:Alloc remote memory for the hook fuction and param ok\n");
821. //设置远程参数，下一步要把参数写入要拦截的远程进程地址空间
822. RemoteParam RParam;
823. ZeroMemory(&RParam, sizeof(RParam));
824. wcscpy(RParam.wProcessName, lpProcessName);
826. unsigned char oldcode[12];
827. unsigned char newcode[12];
828. DWORD dwError = 0;
829. if(!ReadProcessMemory(CurrentProcessHandle,
830. lpApiAddr,
831. oldcode,
832. 12,
833. &dwError))
834. {
835. printf("-----ReadProcessMemory from lpApiName error..\n");
836. FreeLibrary(hExportDll);
837. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
838. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
839. CloseHandle(hTargetProcess);
840. return -1;
841. }
842. //生成跳转指令，这将覆盖要拦截的api的前十个字节
843. int praadd = (int)lpParamaAddr;
844. int threadadd = (int)lpFunAddr;
845. newcode[4] = praadd>>24;
846. newcode[3] = (praadd<<8)>>24;
847. newcode[2] = (praadd<<16)>>24;
848. newcode[1] = (praadd<<24)>>24;
849. newcode[0] = 0x68; //PUSH lpParamaAddr
850. int offsetaddr = threadadd - (int)lpApiAddr - 10 ;
851. newcode[9] = offsetaddr>>24;
852. newcode[8] = (offsetaddr<<8)>>24;
853. newcode[7] = (offsetaddr<<16)>>24;
854. newcode[6] = (offsetaddr<<24)>>24;
855. newcode[5] = 0xE8; //CALL lpFunAddr
856. newcode[10] = 0x90;
857. newcode[11] = 0x90;
859. for(int j = 0; j < 12; j++)
860. {
861. RParam.szOldCode[j] = oldcode[j];
862. RParam.szNewCode[j] = newcode[j];
863. }
864. RParam.lpFunAddr = lpApiAddr;
865. RParam.dwParamSize = dwParamNum * 4;
867. HMODULE hKernel32 = LoadLibrary("Kernel32.dll");
868. if(hKernel32 == NULL)
869. {
870. printf("-----LoadLibrary Kernel32.dll error..\n");
871. FreeLibrary(hExportDll);
872. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
873. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
874. CloseHandle(hTargetProcess);
875. return -1;
876. }
878. RParam.lpWriteProcessMemory = GetProcAddress(hKernel32, "WriteProcessMemory");
879. if(RParam.lpWriteProcessMemory == NULL)
880. {
881. printf("-----GetProcAddress WriteProcessMemory from Kernel32.dll error..\n");
882. FreeLibrary(hExportDll);
883. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
884. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
885. CloseHandle(hTargetProcess);
886. FreeLibrary(hKernel32);
887. return -1;
888. }
889. RParam.lpGetProcessHeap = GetProcAddress(hKernel32, "GetProcessHeap");
890. if(RParam.lpGetProcessHeap == NULL)
891. {
892. printf("-----GetProcAddress GetProcessHeap from Kernel32.dll error..\n");
893. FreeLibrary(hExportDll);
894. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
895. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
896. CloseHandle(hTargetProcess);
897. FreeLibrary(hKernel32);
898. return -1;
899. }
900. RParam.lpHeapAlloc = GetProcAddress(hKernel32, "HeapAlloc");
901. if(RParam.lpHeapAlloc == NULL)
902. {
903. printf("-----GetProcAddress HeapAlloc from Kernel32.dll error..\n");
904. FreeLibrary(hExportDll);
905. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
906. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
907. CloseHandle(hTargetProcess);
908. FreeLibrary(hKernel32);
909. return -1;
910. }
911. RParam.lpHeapReAlloc = GetProcAddress(hKernel32, "HeapReAlloc");
912. if(RParam.lpHeapReAlloc == NULL)
913. {
914. printf("-----GetProcAddress HeapReAlloc from Kernel32.dll error..\n");
915. FreeLibrary(hExportDll);
916. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
917. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
918. CloseHandle(hTargetProcess);
919. FreeLibrary(hKernel32);
920. return -1;
921. }
922. RParam.lpHeapFree = GetProcAddress(hKernel32, "HeapFree");
923. if(RParam.lpHeapFree == NULL)
924. {
925. printf("-----GetProcAddress HeapFree from Kernel32.dll error..\n");
926. FreeLibrary(hExportDll);
927. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
928. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
929. CloseHandle(hTargetProcess);
930. FreeLibrary(hKernel32);
931. return -1;
932. }
933. RParam.lpResumeThread = GetProcAddress(hKernel32, "ResumeThread");
934. if(RParam.lpHeapFree == NULL)
935. {
936. printf("-----GetProcAddress ResumeThread from Kernel32.dll error..\n");
937. FreeLibrary(hExportDll);
938. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
939. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
940. CloseHandle(hTargetProcess);
941. FreeLibrary(hKernel32);
942. return -1;
943. }
945. RParam.lpCreateEvent = GetProcAddress(hKernel32, "CreateEventA");
946. if(RParam.lpCreateEvent == NULL)
947. {
948. printf("-----GetProcAddress CreateEventA from Kernel32.dll error..\n");
949. FreeLibrary(hExportDll);
950. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
951. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
952. CloseHandle(hTargetProcess);
953. FreeLibrary(hKernel32);
954. return -1;
955. }
956. RParam.lpOpenEvent = GetProcAddress(hKernel32, "OpenEventA");
957. if(RParam.lpOpenEvent == NULL)
958. {
959. printf("-----GetProcAddress OpenEventA from Kernel32.dll error..\n");
960. FreeLibrary(hExportDll);
961. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
962. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
963. CloseHandle(hTargetProcess);
964. FreeLibrary(hKernel32);
965. return -1;
966. }
968. RParam.lpOpenFileMapping = GetProcAddress(hKernel32, "OpenFileMappingA");
969. if(RParam.lpOpenFileMapping == NULL)
970. {
971. printf("-----GetProcAddress OpenFileMappingA from Kernel32.dll error..\n");
972. FreeLibrary(hExportDll);
973. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
974. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
975. CloseHandle(hTargetProcess);
976. FreeLibrary(hKernel32);
977. return -1;
978. }
980. RParam.lpMapViewOfFile = GetProcAddress(hKernel32, "MapViewOfFile");
981. if(RParam.lpMapViewOfFile == NULL)
982. {
983. printf("-----GetProcAddress MapViewOfFile from Kernel32.dll error..\n");
984. FreeLibrary(hExportDll);
985. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
986. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
987. CloseHandle(hTargetProcess);
988. FreeLibrary(hKernel32);
989. return -1;
990. }
991. RParam.lpUnMapViewOfFile = GetProcAddress(hKernel32, "UnmapViewOfFile");
992. if(RParam.lpUnMapViewOfFile == NULL)
993. {
994. printf("-----GetProcAddress UnMapViewOfFile from Kernel32.dll error..\n");
995. FreeLibrary(hExportDll);
996. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
997. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
998. CloseHandle(hTargetProcess);
999. FreeLibrary(hKernel32);
1000. return -1;
1001. }
1003. RParam.lpOpenMutex = GetProcAddress(hKernel32, "OpenMutexA");
1004. if(RParam.lpOpenMutex == NULL)
1005. {
1006. printf("-----GetProcAddress OpenMutexA from Kernel32.dll error..\n");
1007. FreeLibrary(hExportDll);
1008. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1009. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1010. CloseHandle(hTargetProcess);
1011. FreeLibrary(hKernel32);
1012. return -1;
1013. }
1015. RParam.lpWaitForSingleObject = GetProcAddress(hKernel32, "WaitForSingleObject");
1016. if(RParam.lpWaitForSingleObject == NULL)
1017. {
1018. printf("-----GetProcAddress WaitForSingleObject from Kernel32.dll error..\n");
1019. FreeLibrary(hExportDll);
1020. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1021. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1022. CloseHandle(hTargetProcess);
1023. FreeLibrary(hKernel32);
1024. return -1;
1025. }
1027. RParam.lpSetEvent = GetProcAddress(hKernel32, "SetEvent");
1028. if(RParam.lpSetEvent == NULL)
1029. {
1030. printf("-----GetProcAddress SetEvent from Kernel32.dll error..\n");
1031. FreeLibrary(hExportDll);
1032. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1033. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1034. CloseHandle(hTargetProcess);
1035. FreeLibrary(hKernel32);
1036. return -1;
1037. }
1039. RParam.lpReleaseMutex = GetProcAddress(hKernel32, "ReleaseMutex");
1040. if(RParam.lpReleaseMutex == NULL)
1041. {
1042. printf("-----GetProcAddress ReleaseMutex from Kernel32.dll error..\n");
1043. FreeLibrary(hExportDll);
1044. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1045. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1046. CloseHandle(hTargetProcess);
1047. FreeLibrary(hKernel32);
1048. return -1;
1049. }
1051. RParam.lpCloseHandle = GetProcAddress(hKernel32, "CloseHandle");
1052. if(RParam.lpCloseHandle == NULL)
1053. {
1054. printf("-----GetProcAddress CloseHandle from Kernel32.dll error..\n");
1055. FreeLibrary(hExportDll);
1056. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1057. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1058. CloseHandle(hTargetProcess);
1059. FreeLibrary(hKernel32);
1060. return -1;
1061. }
1062. RParam.lpGetProcessId = GetProcAddress(hKernel32, "GetProcessId");
1063. if(RParam.lpGetProcessId == NULL)
1064. {
1065. printf("-----GetProcAddress GetProcessId from Kernel32.dll error..\n");
1066. FreeLibrary(hExportDll);
1067. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1068. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1069. CloseHandle(hTargetProcess);
1070. FreeLibrary(hKernel32);
1071. return -1;
1072. }
1073. RParam.lpGetLastError = GetProcAddress(hKernel32, "GetLastError");
1074. if(RParam.lpGetLastError == NULL)
1075. {
1076. printf("-----GetProcAddress GetLastError from Kernel32.dll error..\n");
1077. FreeLibrary(hExportDll);
1078. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1079. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1080. CloseHandle(hTargetProcess);
1081. FreeLibrary(hKernel32);
1082. return -1;
1083. }
1084. FreeLibrary(hKernel32);
1086. //以上皆为必须，下面可以为自己的拦截函数中所需要用的一些变量以及系统api放到参数中去
1087. HMODULE hUser32 = LoadLibrary("User32.dll");
1088. if(hUser32 == NULL)
1089. {
1090. printf("-----LoadLibrary User32.dll error..\n");
1091. FreeLibrary(hExportDll);
1092. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1093. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1094. CloseHandle(hTargetProcess);
1095. return -1;
1096. }
1098. RParam.lpMessageBox = GetProcAddress(hUser32, "MessageBoxW");
1099. if(RParam.lpMessageBox == NULL)
1100. {
1101. printf("-----GetProcAddress MessageBoxA from User32.dll error..\n");
1102. FreeLibrary(hExportDll);
1103. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1104. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1105. CloseHandle(hTargetProcess);
1106. FreeLibrary(hUser32);
1107. return -1;
1108. }
1109. RParam.lpwsprintf = GetProcAddress(hUser32, "wsprintfW");
1110. if(RParam.lpwsprintf == NULL)
1111. {
1112. printf("-----GetProcAddress wsprintf from User32.dll error..\n");
1113. FreeLibrary(hExportDll);
1114. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1115. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1116. CloseHandle(hTargetProcess);
1117. FreeLibrary(hUser32);
1118. return -1;
1119. }
1120. FreeLibrary(hUser32);
1121. HMODULE hNtdll = LoadLibrary("ntdll.dll");
1122. if(hNtdll == NULL)
1123. {
1124. printf("-----LoadLibrary ntdll.dll error..\n");
1125. FreeLibrary(hExportDll);
1126. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1127. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1128. CloseHandle(hTargetProcess);
1129. return -1;
1130. }
1131. RParam.lpZwQueryObject = GetProcAddress(hNtdll, "ZwQueryObject");
1132. if(RParam.lpwsprintf == NULL)
1133. {
1134. printf("-----GetProcAddress ZwQueryObject from ntdll.dll error..\n");
1135. FreeLibrary(hExportDll);
1136. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1137. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1138. CloseHandle(hTargetProcess);
1139. FreeLibrary(hNtdll);
1140. return -1;
1141. }
1142. FreeLibrary(hNtdll);
1144. printf("3:Generate remoteparam ok\n");
1146. //下面为必须部分
1147. //把参数写入要拦截的远程进程地址空间
1148. if(!WriteProcessMemory(hTargetProcess, lpParamaAddr, (LPVOID)&RParam, sizeof(RParam), &dwError))
1149. {
1150. printf("-----WriteProcessMemory for remoteparam error..\n");
1151. FreeLibrary(hExportDll);
1152. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1153. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1154. CloseHandle(hTargetProcess);
1155. return -1;
1156. }
1157. printf("4:WriteProcessMemory for remoteparam ok\n");
1158. //把拦截函数体写入目标进程地址空间
1159. if(!WriteProcessMemory(hTargetProcess, lpFunAddr, lpHookFunAddr, dwHookFunSize, &dwError))
1160. {
1161. printf("-----WriteProcessMemory for remotefuction error..\n");
1162. FreeLibrary(hExportDll);
1163. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1164. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1165. CloseHandle(hTargetProcess);
1166. return -1;
1167. }
1168. printf("5:WriteProcessMemory for remotefuction ok\n");
1169. //把新的跳转指令写入要拦截的目标进程的要拦截的api的函数的前十字节
1170. if(!WriteProcessMemory(hTargetProcess, lpApiAddr , (LPVOID)newcode, 12, &dwError))
1171. {
1172. printf("-----Modify remote api error..\n");
1173. FreeLibrary(hExportDll);
1174. VirtualFreeEx(hTargetProcess, lpFunAddr, 0, MEM_RELEASE);
1175. VirtualFreeEx(hTargetProcess, lpParamaAddr, 0, MEM_RELEASE);
1176. CloseHandle(hTargetProcess);
1177. return -1;
1178. }
1179. printf("6:Modify remote api %s ok\n", lpApiName);
1180. //show..
1181. printf("---------------------------------------------------------------------------\n"
1182. "You hava hooked pid: %d ,and the infomation of this hooking are as follows:\n"
1183. "API name: %s\n"
1184. "API addr: 0x%.8x\n"
1185. "API Parm: %d\n"
1186. "Module name: %s\n"
1187. "Module addr: 0x%.8x\n"
1188. "Remote parama addr: 0x%.8x\n"
1189. "Remote thread addr: 0x%.8x\n"
1190. "RemoteParam.lpFunAddr: 0x%.8x\n"
1191. "RemoteParam.lpWriteProcessMemory: 0x%.8x\n"
1192. "RemoteParam.lpMessageBox: 0x%.8x\n"
1193. "RemoteParam.lpGetProcessHeap: 0x%.8x\n"
1194. "RemoteParam.lpHeapAlloc: 0x%.8x\n"
1195. "RemoteParam.lpHeapReAlloc: 0x%.8x\n"
1196. "RemoteParam.lpHeapFree: 0x%.8x\n"
1197. "RemoteParam.lpwsprintf: 0x%.8x\n"
1198. "RemoteParam.lpZwQueryObject: 0x%.8x\n"
1199. "RemoteParam.lpResumeThread: 0x%.8x\n"
1200. "RemoteParam.lpCreateEvent: 0x%.8x\n"
1201. "RemoteParam.lpOpenEvent: 0x%.8x\n"
1202. "RemoteParam.lpOpenFileMapping: 0x%.8x\n"
1203. "RemoteParam.lpMapViewOf文件: 0x%.8x\n"
1204. "RemoteParam.lpUnMapViewOf文件: 0x%.8x\n"
1205. "RemoteParam.lpOpenMutex: 0x%.8x\n"
1206. "RemoteParam.lpWaitForSingleObject: 0x%.8x\n"
1207. "RemoteParam.lpSetEvent: 0x%.8x\n"
1208. "RemoteParam.lpReleaseMutex: 0x%.8x\n"
1209. "RemoteParam.lpCloseHandle: 0x%.8x\n"
1210. "RemoteParam.lpGetProcessId: 0x%.8x\n"
1211. "RemoteParam.lpGetLastError: 0x%.8x\n",
1212. dwPid,
1213. lpApiName,
1214. lpApiAddr,
1215. RParam.dwParamSize,
1216. lpExportDllName,
1217. hExportDll,
1218. lpParamaAddr,
1219. lpFunAddr,
1220. RParam.lpFunAddr,
1221. RParam.lpWriteProcessMemory,
1222. RParam.lpMessageBox,
1223. RParam.lpGetProcessHeap,
1224. RParam.lpHeapAlloc,
1225. RParam.lpHeapReAlloc,
1226. RParam.lpHeapFree,
1227. RParam.lpwsprintf,
1228. RParam.lpZwQueryObject,
1229. RParam.lpResumeThread,
1230. RParam.lpCreateEvent,
1231. RParam.lpOpenEvent,
1232. RParam.lpOpenFileMapping,
1233. RParam.lpMapViewOfFile,
1234. RParam.lpUnMapViewOfFile,
1235. RParam.lpOpenMutex,
1236. RParam.lpWaitForSingleObject,
1237. RParam.lpSetEvent,
1238. RParam.lpReleaseMutex,
1239. RParam.lpCloseHandle,
1240. RParam.lpGetProcessId,
1241. RParam.lpGetLastError);
1242. wprintf(L"RemoteParam.wProcessName: %s\n", RParam.wProcessName);
1244. printf("OldCode:");
1245. for(int i = 0; i < 12; i++)
1246. {
1247. printf("0x%.2x ", RParam.szOldCode[i]);
1248. }
1249. printf("\nNewCode:");
1250. for(i = 0; i < 12; i++)
1251. {
1252. printf("0x%.2x ", RParam.szNewCode[i]);
1253. }
1254. printf("\n");
1255. printf("---------------------------------------------------------------------------\n\n\n");
1256. //收工，清理资源
1257. FreeLibrary(hExportDll);
1258. CloseHandle(hTargetProcess);
1259. return 0;
1260. }
1261. DWORD dwRunning = 1;
1262. DWORD WINAPI getExit(PHANDLE hExitEvent)
1263. {
1264. char exitCode = ';\0';;
1265. DWORD dwCount = 0;
1266. while(TRUE)
1267. {
1268. printf("Input q to exit the program...\n");
1269. scanf("%c", &exitCode);
1270. if(exitCode == ';q';)
1271. {
1272. dwRunning = 0;
1273. SetEvent(*hExitEvent);
1274. break;
1275. }
1276. }
1277. return 0;
1278. }
1279. int main(void)
1280. {
1281. HANDLE hHookMainAliveEvent = CreateEvent(NULL, TRUE, TRUE, "HookMainAliveEvent");
1282. if(hHookMainAliveEvent == NULL)
1283. {
1284. printf("CreateEvent hHookMainAliveEvent error..\n");
1285. return -1;
1286. }
1287. HANDLE hMapFileOperateMutex = CreateMutex(NULL, FALSE, "MapFileOperateMutex");
1288. if(hMapFileOperateMutex == NULL)
1289. {
1290. printf("CreateMutex hMapFileOperateMutex error..\n");
1291. CloseHandle(hHookMainAliveEvent);
1292. return -1;
1293. }
1294. HANDLE hMapFileModifiedEvent = CreateEvent(NULL, FALSE, FALSE, "MapFileModifiedEvent");
1295. if(hMapFileModifiedEvent == NULL)
1296. {
1297. printf("CreateEvent hMapFileModifiedEvent error..\n");
1298. CloseHandle(hHookMainAliveEvent);
1299. CloseHandle(hMapFileOperateMutex);
1300. return -1;
1301. }
1302. HANDLE hHookNewProcessDoneEvent = CreateEvent(NULL, FALSE, FALSE, "HookNewProcessDoneEvent");
1303. if(hHookNewProcessDoneEvent == NULL)
1304. {
1305. printf("CreateEvent hHookNewProcessDoneEvent error..\n");
1306. CloseHandle(hHookMainAliveEvent);
1307. CloseHandle(hMapFileOperateMutex);
1308. CloseHandle(hMapFileModifiedEvent);
1309. return -1;
1310. }
1311. HANDLE hMapFileToNewProcessId = CreateFileMapping(
1312. (HANDLE)0xFFFFFFFF,
1313. NULL,
1314. PAGE_READWRITE,
1315. 0,
1316. 4,
1317. "MapFileToNewProcessId");
1318. if(hMapFileToNewProcessId == NULL)
1319. {
1320. printf("CreateFileMapping NewCreatedProcessId error..\n");
1321. CloseHandle(hHookMainAliveEvent);
1322. CloseHandle(hMapFileOperateMutex);
1323. CloseHandle(hMapFileModifiedEvent);
1324. CloseHandle(hHookNewProcessDoneEvent);
1325. return -1;
1326. }
1327. LPVOID lpMapFileToNewProcessId = MapViewOfFile(hMapFileToNewProcessId, FILE_MAP_READ, 0, 0, 0);
1328. if(lpMapFileToNewProcessId == NULL)
1329. {
1330. printf("MapViewOfFile NewCreatedProcessId error..\n");
1331. CloseHandle(hMapFileToNewProcessId);
1332. CloseHandle(hHookMainAliveEvent);
1333. CloseHandle(hMapFileOperateMutex);
1334. CloseHandle(hMapFileModifiedEvent);
1335. CloseHandle(hHookNewProcessDoneEvent);
1336. return -1;
1337. }
1339. DWORD * Ppid = (PDWORD)lpMapFileToNewProcessId;
1340. //在这里填入想要监控的进程id，稍作修改，可以监控所有进程，程序没有作好，请原谅.
1341. //这里还是觉得就这样，大家如果有兴趣可以在自己的机器上测试，因为做到现在，忽然发现似乎功能的
1342. //真正实现不是那么重要了。
1343. SetHook(2560, L"explorer.exe\0", "ZwCreateProcessEx", "ntdll.dll", 9, 4096 * 10, &HookZwCreateProcessEx);
1344. DWORD dwExitThread = 0;
1345. HANDLE hExitThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&getExit, &hMapFileModifiedEvent, 0, &dwExitThread);
1347. while(dwRunning == 1)
1348. {
1349. WaitForSingleObject(hMapFileModifiedEvent, INFINITE);
1350. if(dwRunning == 0)
1351. break;
1352. DWORD dwPid = * Ppid;
1353. //这里的传递的进程名字只是用来测试用，可以编程实现获取进程名，并传递，注意这里为宽字符，
1354. //抱歉本人没有完成这里的自动获取进程名字功能，写这个代码已经太烦躁了，请原谅.
1355. SetHook(dwPid, L"explorer.exe\0", "ZwCreateProcessEx", "ntdll.dll", 9, 4096 * 10, &HookZwCreateProcessEx);
1356. SetHook(dwPid, L"regedit.exe\0", "ZwSetValueKey", "ntdll.dll", 6, 4096 * 5, &HookZwSetValueKey);
1357. SetEvent(hHookNewProcessDoneEvent);
1358. }
1360. UnmapViewOfFile(lpMapFileToNewProcessId);
1361. CloseHandle(hMapFileToNewProcessId);
1362. CloseHandle(hHookMainAliveEvent);
1363. CloseHandle(hMapFileOperateMutex);
1364. CloseHandle(hMapFileModifiedEvent);
1365. CloseHandle(hHookNewProcessDoneEvent);
1366. CloseHandle(hExitThread);
1367. return 0;
1368. }

复制代码

支持原创！

如果能做到内核层效果会更好,不是吗?

能力有限,眼看着但是不能入门,如果能修改SSDT那是更好,当然也许有更好的方法.
ring 3 太耗资源了.而且不彻底.
楼上可否留下联系方式,或者加群:16189699,期待您的指点啊