1

目前使用 EasyHook 并启用 Application Verifier 时会出现下一个问题。如果 appverifier 禁用应用程序工作，但应用程序验证器启用目标应用程序崩溃。让应用程序验证器工作是相当关键的。那么有什么想法可以让钩子和appverifier运行吗？

我设法创建的最简单的 x64 程序在使用钩子时也会崩溃。我创建了一个带有一个导出函数的本机 dll

original.dll：main.cpp

#include <iostream>

extern "C" __declspec(dllexport) void __stdcall OriginalFunction() {
    std::cout << "Hello world" << std::endl;
}

接下来是主程序：

#include <iostream>
#include <tchar.h>
#include <Windows.h>
#include <release-2.7/Public/easyhook.h>

typedef void (__stdcall *OriginalFunctionFunc)();

OriginalFunctionFunc OriginalFunction;

void __stdcall OriginalFunctionHook() {
    std::cout << "No hello world available" << std::endl;
}

int main() {

    HMODULE hModule = LoadLibrary(_T("original.dll"));
    OriginalFunction = (OriginalFunctionFunc)GetProcAddress(hModule, "OriginalFunction");
    OriginalFunction();

    HOOK_TRACE_INFO handle;
    memset(&handle, 0, sizeof(handle));
    NTSTATUS status = LhInstallHook(OriginalFunction, OriginalFunctionHook, (void*)0, &handle);

    if (NT_ERROR(status)) {
        std::cout << "Can't install hook" << std::endl;
    }
    ULONG p[] = {0};
    LhSetExclusiveACL(p, 0, &handle);

    OriginalFunction();

    return 0;
}

应用程序验证器使用 Basics 测试的默认选项进行了调整。WinDbg 输出为：

(19d0.1298): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
ntdll!RtlCaptureContext+0x86:
00000000`772a08c5 0fae8100010000  fxsave  [rcx+100h]    ds:00000000`001aed68=e9
0:000> kb
RetAddr           : Args to Child                                                           : Call Site
00000000`7725b219 : 000007ff`fffde000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlCaptureContext+0x86
00000000`7725b559 : 00000000`001af208 00000000`00000025 00000000`001afea0 00000000`00000005 : ntdll!RtlpWalkFrameChain+0x49
00000000`7725b4ea : 00000000`001ab000 000007fe`f79e6740 00000000`001afea0 00000000`001afba0 : ntdll!RtlWalkFrameChain+0x2d
00000000`773170e4 : 00000000`001b0000 00000000`099b0000 00000000`00000c00 00000000`0000027f : ntdll!RtlCaptureStackBackTrace+0x4a
00000000`773171ab : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlStdLogStackTrace+0x24
000007fe`f79e6d84 : 00000000`00001000 00000000`099b1000 00000000`00000000 00000000`00000000 : ntdll!RtlLogStackTrace+0x1b
000007fe`f79e8513 : 00000000`00001000 00000000`099b1000 00000000`099b1000 00000000`00000c00 : verifier!AVrfpDphPlaceOnBusyList+0x38
00000000`77327041 : 00000000`00000000 00000000`01001002 00000000`01001002 00000000`03d48548 : verifier!AVrfDebugPageHeapAllocate+0x26f
00000000`772eb5aa : 00000000`099b0000 00000000`001af4e8 00000000`099b0000 00000000`77392dd0 : ntdll!RtlDebugAllocateHeap+0x31
00000000`772a34d8 : 00000000`099b0000 00000000`01001002 00000000`00000c00 00000000`00000000 : ntdll! ?? ::FNODOBFM::`string'+0x18b42
000007fe`f7a659fa : 00000000`00000004 00000000`00000000 00000000`00000000 000007fe`f1ae9487 : ntdll!RtlAllocateHeap+0x16c
000007fe`f80efd34 : 000007fe`f811d440 000007fe`f811c440 00000000`00000000 000007fe`f811d440 : vfbasics!AVrfpRtlAllocateHeap+0xee
000007fe`faeb030c : 000007fe`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : EasyHook64!LhBarrierIntro+0x154 [d:\projects\easy_hook\release-2.7\drivershared\localhook\barrier.c @ 787]
000007fe`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`faeb030c
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`00000000

操作系统：Windows 7 x64 内置 VS 2010 AppVerifier 4.1.1078

我在这里发布了类似的问题https://easyhook.codeplex.com/discussions/542316但不幸的是没有任何结果。

谢谢你的帮助。

4

0 回答 0