3

我正在尝试为 CreateFile 创建一个 Hook，所以当一个进程尝试创建一个文件时，我们创建的 hookdll 将通知用户：“这个进程 xx.exe 试图创建 xx.exe，你要继续吗？”

到目前为止我在这里，所以我需要在这段代码中修改：

library CreateFileHook;

uses
 Windows, Dialogs, SysUtils;

type
OldCode = packed record
 One: dword;
 two: word;
end;

far_jmp = packed record
 PuhsOp: byte;
 PushArg: pointer;
 RetOp: byte;
end;

var
  JmpCfw, JmpCfa: far_jmp;
  OldCfw, OldCfa: OldCode;
  CfwAdr, CfaAdr: pointer;

function NewCreateFileA(lpFileName: PChar;
                       dwDesiredAccess: DWORD;
                       dwShareMode: DWORD;
                       lpSecurityAttributes: PSecurityAttributes;
                       dwCreationDisposition: DWORD;
                       dwFlagsAndAttributes: DWORD;
                       hTemplateFile: THandle): THandle; stdcall;
var
  file_name: PWideChar;
  name_len: dword;
begin
  name_len := lstrlen(lpFileName) * SizeOf(WideChar) + 2;
  GetMem(file_name, name_len);
  StringToWideChar(lpFileName, file_name, name_len);

  CreateFileW(file_name, dwDesiredAccess, dwShareMode, lpSecurityAttributes,
              dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);

  FreeMem(file_name);
end;

function TrueCreateFileW(lpFileName: PWideChar;
                        dwDesiredAccess: DWORD;
                        dwShareMode: DWORD;
                        lpSecurityAttributes: PSecurityAttributes;
                        dwCreationDisposition: DWORD;
                        dwFlagsAndAttributes: DWORD;
                        hTemplateFile: THandle): THandle; stdcall;
var
Written: dword;
begin
 WriteProcessMemory(INVALID_HANDLE_VALUE, CfwAdr,
                    @OldCfw, SizeOf(OldCode), Written);

 CreateFileW(lpFileName,
             dwDesiredAccess,
             dwShareMode,
             lpSecurityAttributes,
             dwCreationDisposition,
             dwFlagsAndAttributes,
             hTemplateFile);

 WriteProcessMemory(INVALID_HANDLE_VALUE, CfwAdr,
                    @JmpCfw, SizeOf(far_jmp), Written);
end;

function NewCreateFileW(lpFileName: PWideChar;
                       dwDesiredAccess: DWORD;
                       dwShareMode: DWORD;
                       lpSecurityAttributes: PSecurityAttributes;
                       dwCreationDisposition: DWORD;
                       dwFlagsAndAttributes: DWORD;
                       hTemplateFile: THandle): THandle; stdcall;
begin
 TrueCreateFileW(lpFileName,
                 dwDesiredAccess,
                 dwShareMode,
                 lpSecurityAttributes,
                 dwCreationDisposition,
                 dwFlagsAndAttributes,
                 hTemplateFile);
end;

Procedure SetHook();
var
  kernel32: dword;
  Bytes: dword;
begin
  kernel32 := GetModuleHandle('Kernel32.dll');
  CfwAdr  := GetProcAddress(kernel32, 'CreateFileW');
  CfaAdr  := GetProcAddress(kernel32, 'CreateFileA');
  ReadProcessMemory(INVALID_HANDLE_VALUE, CfwAdr, @OldCfw, SizeOf(OldCode), Bytes);
  ReadProcessMemory(INVALID_HANDLE_VALUE, CfaAdr, @OldCfa, SizeOf(OldCode), Bytes);
  JmpCfw.PuhsOp  := $68;
  JmpCfw.PushArg := @NewCreateFileW;
  JmpCfw.RetOp   := $C3;
  JmpCfa.PuhsOp  := $68;
  JmpCfa.PushArg := @NewCreateFileA;
  JmpCfa.RetOp   := $C3;
  WriteProcessMemory(INVALID_HANDLE_VALUE, CfwAdr, @JmpCfw, SizeOf(far_jmp), Bytes);
  WriteProcessMemory(INVALID_HANDLE_VALUE, CfaAdr, @JmpCfa, SizeOf(far_jmp), Bytes);
end;

Procedure Unhook();
var
Bytes: dword;
begin
 WriteProcessMemory(INVALID_HANDLE_VALUE, CfaAdr, @OldCfa, SizeOf(OldCode), Bytes);
 WriteProcessMemory(INVALID_HANDLE_VALUE, CfwAdr, @OldCfw, SizeOf(OldCode), Bytes);
end;

Function MessageProc(code : integer; wParam : word;
                   lParam : longint) : longint; stdcall;
begin
  CallNextHookEx(0, Code, wParam, lparam);
  Result := 0;
end;

Procedure SetGlobalHookProc();
begin
  SetWindowsHookEx(WH_GETMESSAGE, @MessageProc, HInstance, 0);
  Sleep(INFINITE);
end;

Procedure SetGlobalHook();
var
  hMutex: dword;
  TrId: dword;
begin
  hMutex := CreateMutex(nil, false, 'CreateFileHook');
  if GetLastError = 0 then
  CreateThread(nil, 0, @SetGlobalHookProc, nil, 0, TrId) else
  CloseHandle(hMutex);
end;

procedure DLLEntryPoint(dwReason: DWord);
begin
 case dwReason of
   DLL_PROCESS_ATTACH: begin
                         SetGlobalHook();
                         Randomize();
                         SetHook()
                       end;
   DLL_PROCESS_DETACH: UnHook();
 end;
end;

begin
  DllProc := @DLLEntryPoint;
  DLLEntryPoint(DLL_PROCESS_ATTACH);
end.
4

1 回答 1

1

一眼看去，我发现这段代码有几个问题。你从哪里得到这个？我手边没有参考资料，但我很确定您可以在网络上找到您正在尝试做的事情的工作示例。

您不必使用 Read/WriteProcessMemory，因为您处于尝试修改的进程中 - Windows 将为您执行写时复制。

如果您确实想要/需要使用 Read/WriteProcessMemory，那么获取要使用的句柄的方法是 OpenProcess。

这个钩子代码不是可重入的——一个线程可能正在退出 ReadFile，在另一个线程尝试调用它之前恢复重定向代码，但在第二个线程认为它只是“修复”它之后。

一种更简洁的方法是在导入地址表中保存指向您希望挂钩的函数的指针，然后修改它以调用您的挂钩例程。现在您可以使用保存的指针从挂钩中调用原始例程。

一旦（如果）你得到这个工作，准备好看到很多对 CreateFile 的调用。CreateFile 用于创建/打开除了物理文件之外的许多东西，例如 COM 端口、管道、控制台缓冲区等。

于 2011-07-01T16:50:58.577 回答