Skip to content

Commit f97cad8

Browse files
michaelchen1996michaelchen1996
committed
HookDll realized, add MyZwSetInformationFile only now for test
1 parent 426f7c9 commit f97cad8

File tree

8 files changed

+223
-19
lines changed

8 files changed

+223
-19
lines changed

‎APIHOOK/HookDll/FileAPI.cpp‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,37 @@
11
#include "stdafx.h"
2-
#include "FileAPI.h"
2+
#include "FileAPI.h"
3+
4+
5+
NTSTATUS MyZwSetInformationFile(
6+
_In_ HANDLE FileHandle,
7+
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
8+
_In_ PVOID FileInformation,
9+
_In_ ULONG Length,
10+
_In_ FILE_INFORMATION_CLASS FileInformationClass
11+
)
12+
{
13+
NTSTATUS status = -1;
14+
if (NULL == realZwSetInformationFile)
15+
{
16+
OutputDebugString(TEXT("realZwSetInformationFile NOT FOUND\n"));
17+
return status;
18+
}
19+
else
20+
{
21+
if (10 == FileInformationClass)
22+
{
23+
SendLog(TEXT("MyZwSetInformationFile\r\n"));
24+
}
25+
26+
status = realZwSetInformationFile(
27+
FileHandle,
28+
IoStatusBlock,
29+
FileInformation,
30+
Length,
31+
FileInformationClass
32+
);
33+
34+
}
35+
36+
return status;
37+
}

‎APIHOOK/HookDll/FileAPI.h‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,30 @@
11
#pragma once
22

3-
#include "SendLog.h"
3+
#include "SendLog.h"
4+
5+
#ifndef __FILE_API__
6+
#define __FILE_API__
7+
8+
9+
NTSTATUS MyZwSetInformationFile(
10+
_In_ HANDLE FileHandle,
11+
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
12+
_In_ PVOID FileInformation,
13+
_In_ ULONG Length,
14+
_In_ FILE_INFORMATION_CLASS FileInformationClass
15+
);
16+
17+
typedef NTSTATUS(*ptrZwSetInformationFile)(
18+
_In_ HANDLE FileHandle,
19+
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
20+
_In_ PVOID FileInformation,
21+
_In_ ULONG Length,
22+
_In_ FILE_INFORMATION_CLASS FileInformationClass
23+
);
24+
25+
extern ptrZwSetInformationFile realZwSetInformationFile;
26+
27+
28+
#endif // !__FILE_API__
29+
30+

‎APIHOOK/HookDll/HookDll.cpp‎

Lines changed: 88 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,99 @@
55
#include "HookDll.h"
66

77

8-
void DoHook()
8+
TRACED_HOOK_HANDLE hHookZwSetInformationFile = new HOOK_TRACE_INFO();
9+
ULONG HookZwSetInformationFile_ACLEntries[1] = { 0 };
10+
ptrZwSetInformationFile realZwSetInformationFile = NULL;
11+
12+
13+
void Prepare()
914
{
15+
hWriteMailslot = CreateFile(TEXT("\\\\*\\mailslot\\APIHOOK\\Monitor\\Log"),
16+
GENERIC_WRITE,
17+
FILE_SHARE_READ,
18+
NULL,
19+
OPEN_EXISTING,
20+
FILE_ATTRIBUTE_NORMAL,
21+
NULL);
22+
if (INVALID_HANDLE_VALUE == hWriteMailslot)
23+
{
24+
OutputDebugString(TEXT("Create Mailslot ERROR\n"));
25+
return;
26+
}
27+
28+
realZwSetInformationFile = (ptrZwSetInformationFile)GetRealApiEntry(L"ntdll.dll", "ZwSetInformationFile");
29+
}
1030

31+
32+
void DoHook()
33+
{
34+
NTSTATUS status = 0;
35+
//hook MyZwSetInformationFile
36+
status = LhInstallHook(
37+
realZwSetInformationFile,
38+
MyZwSetInformationFile,
39+
NULL,
40+
hHookZwSetInformationFile);
41+
if (!SUCCEEDED(status))
42+
{
43+
OutputDebugString(L"LhInstallHook ERROR\n");
44+
}
45+
status = LhSetExclusiveACL(
46+
HookZwSetInformationFile_ACLEntries,
47+
1,
48+
hHookZwSetInformationFile);
49+
if (!SUCCEEDED(status))
50+
{
51+
OutputDebugString(L"LhSetExclusiveACL ERROR\n");
52+
}
1153
}
1254

1355

1456
void DoUnHook()
1557
{
58+
//LhUninstallAllHooks();
59+
//OutputDebugString(L"LhUninstallAllHooks\n");
60+
61+
NTSTATUS status = 0;
62+
status = LhUninstallHook(hHookZwSetInformationFile);
63+
if (!SUCCEEDED(status))
64+
{
65+
OutputDebugString(L"LhUninstallHook ERROR\n");
66+
}
67+
delete hHookZwSetInformationFile;
68+
hHookZwSetInformationFile = NULL;
69+
status = LhWaitForPendingRemovals();
70+
if (!SUCCEEDED(status))
71+
{
72+
OutputDebugString(L"LhWaitForPendingRemovals ERROR\n");
73+
}
74+
}
1675

17-
}
76+
77+
void Finish()
78+
{
79+
CloseHandle(hWriteMailslot);
80+
hWriteMailslot = NULL;
81+
82+
}
83+
84+
85+
FARPROC GetRealApiEntry(LPCWSTR lpModuleName, LPCSTR lpProcName)
86+
{
87+
HMODULE hModule = NULL;
88+
FARPROC realProc = NULL;
89+
OutputDebugString(L"PrepareRealApiEntry()\n");
90+
91+
hModule = GetModuleHandleW(lpModuleName);
92+
if (NULL == hModule)
93+
{
94+
OutputDebugString(L"GetModuleHandleW ERROR\n");
95+
}
96+
realProc = GetProcAddress(hModule, lpProcName);
97+
if (NULL == realProc)
98+
{
99+
OutputDebugString(L"GetProcAddress ERROR\n");
100+
}
101+
return realProc;
102+
//CloseHandle(hModule);
103+
}

‎APIHOOK/HookDll/HookDll.h‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,15 @@
22

33
#include "FileAPI.h"
44

5+
#ifndef __HOOK_DLL__
6+
#define __HOOK_DLL__
7+
8+
9+
void Prepare();
510
void DoHook();
6-
void DoUnHook();
11+
void DoUnHook();
12+
void Finish();
13+
FARPROC GetRealApiEntry(LPCWSTR lpModuleName, LPCSTR lpProcName);
14+
15+
16+
#endif // !__HOOK_DLL__

‎APIHOOK/HookDll/SendLog.cpp‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,25 @@
11
#include "stdafx.h"
22
#include "SendLog.h"
33

4-
void SendLog()
4+
5+
HANDLE hWriteMailslot = NULL;
6+
7+
8+
void SendLog(LPCTSTR szLogMessage)
59
{
10+
OutputDebugString(szLogMessage);
11+
12+
SIZE_T dwLogLength;
13+
DWORD dwMailslotWritten;
614

15+
StringCbLength(szLogMessage, MAX_LOG_SIZE, &dwLogLength);
16+
if (dwLogLength > MAX_LOG_SIZE)
17+
{
18+
dwLogLength = MAX_LOG_SIZE;
19+
}
20+
WriteFile(hWriteMailslot, szLogMessage, dwLogLength, &dwMailslotWritten, NULL);
21+
if (dwLogLength != dwMailslotWritten)
22+
{
23+
OutputDebugString(TEXT("Write Log Mailslot ERROR\n"));
24+
}
725
}

‎APIHOOK/HookDll/SendLog.h‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
11
#pragma once
22

3-
void SendLog()
3+
#ifndef __SEND_LOG__
4+
#define __SEND_LOG__
5+
6+
#define MAX_LOG_SIZE 260
7+
8+
extern HANDLE hWriteMailslot;
9+
10+
void SendLog(LPCTSTR szLogMessage);
11+
12+
13+
#endif // !__SEND_LOG__
14+

‎APIHOOK/HookDll/dllmain.cpp‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,25 +12,37 @@ BOOL APIENTRY DllMain( HMODULE hModule,
1212
{
1313
case DLL_PROCESS_ATTACH:
1414
{
15-
OutputDebugString(L"DllMain: DLL_PROCESS_ATTACH\n");
16-
printf("%s", "DllMain: DLL_PROCESS_ATTACH\n");
15+
OutputDebugString(L"HookDll DllMain: DLL_PROCESS_ATTACH\n");
16+
17+
Prepare();
18+
DoHook();
19+
20+
break;
1721
}
18-
case DLL_THREAD_ATTACH:
22+
23+
case DLL_THREAD_ATTACH:
1924
{
20-
OutputDebugString(L"DllMain: DLL_THREAD_ATTACH\n");
21-
printf("%s", "DllMain: DLL_THREAD_ATTACH\n");
25+
OutputDebugString(L"HookDll DllMain: DLL_THREAD_ATTACH\n");
26+
27+
break;
2228
}
23-
case DLL_THREAD_DETACH:
29+
30+
case DLL_THREAD_DETACH:
2431
{
25-
OutputDebugString(L"DllMain: DLL_THREAD_DETACH\n");
26-
printf("%s", "DllMain: DLL_THREAD_DETACH\n");
32+
OutputDebugString(L"HookDll DllMain: DLL_THREAD_DETACH\n");
33+
34+
break;
2735
}
28-
case DLL_PROCESS_DETACH:
36+
37+
case DLL_PROCESS_DETACH:
2938
{
30-
OutputDebugString(L"DllMain: DLL_PROCESS_DETACH\n");
31-
printf("%s", "DllMain: DLL_PROCESS_DETACH\n");
39+
OutputDebugString(L"HookDll DllMain: DLL_PROCESS_DETACH\n");
40+
41+
DoUnHook();
42+
Finish();
43+
44+
break;
3245
}
33-
break;
3446
}
3547
return TRUE;
3648
}

‎APIHOOK/HookDll/stdafx.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,17 @@
55

66
#pragma once
77

8+
#pragma comment(lib, "EasyHook64.lib")
9+
810
#include "targetver.h"
911

1012
#define WIN32_LEAN_AND_MEAN // 从 Windows 头中排除极少使用的资料
1113
// Windows 头文件:
1214
#include <windows.h>
1315
#include <stdio.h>
16+
#include <strsafe.h>
17+
18+
#include "easyhook.h"
1419

1520

1621

0 commit comments

Comments
 (0)