Skip to content

Commit b292840

Browse files
l-ibertyl-iberty
committed
first commit
0 parents  commit b292840

File tree

426 files changed

+23039
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

426 files changed

+23039
-0
lines changed

‎APIHookDemo/v1.0/APIHookDemo/.vs/APIHookDemo/v14/.suo

32 KB
Binary file not shown.

‎APIHookDemo/v1.0/APIHookDemo/APIHookDemo.sln

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 14
4+
VisualStudioVersion = 14.0.23107.0
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "APIHookDemo", "APIHookDemo\APIHookDemo.vcxproj", "{F971A6B0-A734-402F-9E09-DF980A11273A}"
7+
EndProject
8+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "spy", "spy\spy.vcxproj", "{9126C561-B734-4D0B-98CA-F400A63D44D7}"
9+
EndProject
10+
Global
11+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
12+
Debug|x64 = Debug|x64
13+
Debug|x86 = Debug|x86
14+
Release|x64 = Release|x64
15+
Release|x86 = Release|x86
16+
EndGlobalSection
17+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
18+
{F971A6B0-A734-402F-9E09-DF980A11273A}.Debug|x64.ActiveCfg = Debug|x64
19+
{F971A6B0-A734-402F-9E09-DF980A11273A}.Debug|x64.Build.0 = Debug|x64
20+
{F971A6B0-A734-402F-9E09-DF980A11273A}.Debug|x86.ActiveCfg = Debug|Win32
21+
{F971A6B0-A734-402F-9E09-DF980A11273A}.Debug|x86.Build.0 = Debug|Win32
22+
{F971A6B0-A734-402F-9E09-DF980A11273A}.Release|x64.ActiveCfg = Release|x64
23+
{F971A6B0-A734-402F-9E09-DF980A11273A}.Release|x64.Build.0 = Release|x64
24+
{F971A6B0-A734-402F-9E09-DF980A11273A}.Release|x86.ActiveCfg = Release|Win32
25+
{F971A6B0-A734-402F-9E09-DF980A11273A}.Release|x86.Build.0 = Release|Win32
26+
{9126C561-B734-4D0B-98CA-F400A63D44D7}.Debug|x64.ActiveCfg = Debug|x64
27+
{9126C561-B734-4D0B-98CA-F400A63D44D7}.Debug|x64.Build.0 = Debug|x64
28+
{9126C561-B734-4D0B-98CA-F400A63D44D7}.Debug|x86.ActiveCfg = Debug|Win32
29+
{9126C561-B734-4D0B-98CA-F400A63D44D7}.Debug|x86.Build.0 = Debug|Win32
30+
{9126C561-B734-4D0B-98CA-F400A63D44D7}.Release|x64.ActiveCfg = Release|x64
31+
{9126C561-B734-4D0B-98CA-F400A63D44D7}.Release|x64.Build.0 = Release|x64
32+
{9126C561-B734-4D0B-98CA-F400A63D44D7}.Release|x86.ActiveCfg = Release|Win32
33+
{9126C561-B734-4D0B-98CA-F400A63D44D7}.Release|x86.Build.0 = Release|Win32
34+
EndGlobalSection
35+
GlobalSection(SolutionProperties) = preSolution
36+
HideSolutionNode = FALSE
37+
EndGlobalSection
38+
EndGlobal

‎APIHookDemo/v1.0/APIHookDemo/APIHookDemo/APIHookDemo.cpp

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
#define _CRT_SECURE_NO_WARNINS
2+
3+
#include <Windows.h>
4+
#include <stdio.h>
5+
#include <ImageHlp.h>
6+
#pragma comment(lib,"ImageHlp")
7+
8+
void ReplaceIATEntryInOneMod(PCSTR pszCalleeModName, PROC pfnOrig, PROC pfnNew, HMODULE hModCaller) {
9+
ULONG ulSize;
10+
PIMAGE_IMPORT_DESCRIPTOR pImportDesc = NULL;
11+
12+
pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(
13+
hModCaller, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize);
14+
15+
if (pImportDesc == NULL)
16+
return; // This module has no import section or is no longer loaded
17+
18+
// Find the import descriptor containing references to callee's functions
19+
for (; pImportDesc->Name; pImportDesc++) {
20+
PSTR pszModName = (PSTR)((PBYTE)hModCaller + pImportDesc->Name);
21+
if (lstrcmpiA(pszModName, pszCalleeModName) == 0) {
22+
23+
// Get caller's import address table (IAT) for the callee's functions
24+
PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)
25+
((PBYTE)hModCaller + pImportDesc->FirstThunk);
26+
27+
// Replace original function address with new function address
28+
for (; pThunk->u1.Function; pThunk++) {
29+
30+
// Is this the function we're looking for?
31+
BOOL bFound = ((PROC)pThunk->u1.Function == pfnOrig);
32+
if (bFound) {
33+
// Get the address of the function address
34+
PROC* ppfn = (PROC*)&pThunk->u1.Function;
35+
36+
DWORD dwOldProtect;
37+
if (VirtualProtect(ppfn, sizeof(pfnNew), PAGE_EXECUTE_READWRITE, &dwOldProtect)) {
38+
WriteProcessMemory(GetCurrentProcess(), ppfn, &pfnNew, sizeof(pfnNew), NULL);
39+
}
40+
return; // We did it, get out
41+
}
42+
}
43+
} // Each import section is parsed until the right entry is found and patched
44+
}
45+
}
46+
47+
int main() {
48+
PROC pfnOrig, pfnNew;
49+
HMODULE hModCaller, hInstLib;
50+
51+
pfnOrig = GetProcAddress(GetModuleHandle(TEXT("user32.dll")), "MessageBoxW");
52+
53+
hModCaller = GetModuleHandle(TEXT("APIHookDemo.exe")); // self-hook
54+
55+
hInstLib = LoadLibrary(TEXT("spy.dll"));
56+
if (hInstLib == NULL) {
57+
printf("LoadLibraryA Error: %d\n", GetLastError());
58+
return EXIT_FAILURE;
59+
}
60+
61+
pfnNew = (PROC)GetProcAddress(hInstLib, "SpyApiCalling");
62+
if (pfnNew == NULL) {
63+
printf("GetProcAddress Error: %d\n", GetLastError());
64+
return EXIT_FAILURE;
65+
}
66+
67+
ReplaceIATEntryInOneMod("user32.dll", pfnOrig, pfnNew, hModCaller);
68+
69+
MessageBoxW(0, TEXT("hello"), TEXT("test"), MB_OK);
70+
71+
return EXIT_SUCCESS;
72+
}

‎APIHookDemo/v1.0/APIHookDemo/APIHookDemo/APIHookDemo.vcxproj

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<ProjectGuid>{F971A6B0-A734-402F-9E09-DF980A11273A}</ProjectGuid>
23+
<Keyword>Win32Proj</Keyword>
24+
<RootNamespace>APIHookDemo</RootNamespace>
25+
<WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
26+
</PropertyGroup>
27+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
28+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
29+
<ConfigurationType>Application</ConfigurationType>
30+
<UseDebugLibraries>true</UseDebugLibraries>
31+
<PlatformToolset>v140</PlatformToolset>
32+
<CharacterSet>Unicode</CharacterSet>
33+
</PropertyGroup>
34+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
35+
<ConfigurationType>Application</ConfigurationType>
36+
<UseDebugLibraries>false</UseDebugLibraries>
37+
<PlatformToolset>v140</PlatformToolset>
38+
<WholeProgramOptimization>true</WholeProgramOptimization>
39+
<CharacterSet>Unicode</CharacterSet>
40+
</PropertyGroup>
41+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
42+
<ConfigurationType>Application</ConfigurationType>
43+
<UseDebugLibraries>true</UseDebugLibraries>
44+
<PlatformToolset>v140</PlatformToolset>
45+
<CharacterSet>Unicode</CharacterSet>
46+
</PropertyGroup>
47+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
48+
<ConfigurationType>Application</ConfigurationType>
49+
<UseDebugLibraries>false</UseDebugLibraries>
50+
<PlatformToolset>v140</PlatformToolset>
51+
<WholeProgramOptimization>true</WholeProgramOptimization>
52+
<CharacterSet>Unicode</CharacterSet>
53+
</PropertyGroup>
54+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
55+
<ImportGroup Label="ExtensionSettings">
56+
</ImportGroup>
57+
<ImportGroup Label="Shared">
58+
</ImportGroup>
59+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
60+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
61+
</ImportGroup>
62+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
63+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
64+
</ImportGroup>
65+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
66+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
67+
</ImportGroup>
68+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
69+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
70+
</ImportGroup>
71+
<PropertyGroup Label="UserMacros" />
72+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
73+
<LinkIncremental>true</LinkIncremental>
74+
</PropertyGroup>
75+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
76+
<LinkIncremental>true</LinkIncremental>
77+
</PropertyGroup>
78+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
79+
<LinkIncremental>false</LinkIncremental>
80+
</PropertyGroup>
81+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
82+
<LinkIncremental>false</LinkIncremental>
83+
</PropertyGroup>
84+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
85+
<ClCompile>
86+
<PrecompiledHeader>
87+
</PrecompiledHeader>
88+
<WarningLevel>Level3</WarningLevel>
89+
<Optimization>Disabled</Optimization>
90+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
91+
<SDLCheck>true</SDLCheck>
92+
</ClCompile>
93+
<Link>
94+
<SubSystem>Console</SubSystem>
95+
<GenerateDebugInformation>true</GenerateDebugInformation>
96+
</Link>
97+
</ItemDefinitionGroup>
98+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
99+
<ClCompile>
100+
<PrecompiledHeader>
101+
</PrecompiledHeader>
102+
<WarningLevel>Level3</WarningLevel>
103+
<Optimization>Disabled</Optimization>
104+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
105+
<SDLCheck>true</SDLCheck>
106+
</ClCompile>
107+
<Link>
108+
<SubSystem>Console</SubSystem>
109+
<GenerateDebugInformation>true</GenerateDebugInformation>
110+
</Link>
111+
</ItemDefinitionGroup>
112+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
113+
<ClCompile>
114+
<WarningLevel>Level3</WarningLevel>
115+
<PrecompiledHeader>
116+
</PrecompiledHeader>
117+
<Optimization>MaxSpeed</Optimization>
118+
<FunctionLevelLinking>true</FunctionLevelLinking>
119+
<IntrinsicFunctions>true</IntrinsicFunctions>
120+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
121+
<SDLCheck>true</SDLCheck>
122+
</ClCompile>
123+
<Link>
124+
<SubSystem>Console</SubSystem>
125+
<GenerateDebugInformation>true</GenerateDebugInformation>
126+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
127+
<OptimizeReferences>true</OptimizeReferences>
128+
</Link>
129+
</ItemDefinitionGroup>
130+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
131+
<ClCompile>
132+
<WarningLevel>Level3</WarningLevel>
133+
<PrecompiledHeader>
134+
</PrecompiledHeader>
135+
<Optimization>MaxSpeed</Optimization>
136+
<FunctionLevelLinking>true</FunctionLevelLinking>
137+
<IntrinsicFunctions>true</IntrinsicFunctions>
138+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
139+
<SDLCheck>true</SDLCheck>
140+
</ClCompile>
141+
<Link>
142+
<SubSystem>Console</SubSystem>
143+
<GenerateDebugInformation>true</GenerateDebugInformation>
144+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
145+
<OptimizeReferences>true</OptimizeReferences>
146+
</Link>
147+
</ItemDefinitionGroup>
148+
<ItemGroup>
149+
<ClCompile Include="APIHookDemo.cpp" />
150+
</ItemGroup>
151+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
152+
<ImportGroup Label="ExtensionTargets">
153+
</ImportGroup>
154+
</Project>

‎APIHookDemo/v1.0/APIHookDemo/APIHookDemo/APIHookDemo.vcxproj.filters

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="源文件">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="头文件">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="资源文件">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ClCompile Include="APIHookDemo.cpp">
19+
<Filter>源文件</Filter>
20+
</ClCompile>
21+
</ItemGroup>
22+
</Project>

‎APIHookDemo/v1.0/APIHookDemo/Debug/APIHookDemo.exe

37 KB
Binary file not shown.

‎APIHookDemo/v1.0/APIHookDemo/Debug/spy.dll

34.5 KB
Binary file not shown.

‎APIHookDemo/v1.0/APIHookDemo/spy/Source.def

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
LIBRARY
2+
3+
EXPORTS
4+
SpyApiCalling

‎APIHookDemo/v1.0/APIHookDemo/spy/spy.cpp

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#include <Windows.h>
2+
3+
int WINAPI SpyApiCalling(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType) {
4+
DWORD dwProcessId;
5+
CHAR szMessage[128];
6+
7+
dwProcessId = GetCurrentProcessId();
8+
wsprintfA(szMessage, "Process %d is calling MessageBoxW.", dwProcessId);
9+
MessageBoxA(0, szMessage, "API Hook", MB_OK);
10+
11+
return 0;
12+
}

0 commit comments

Comments
 (0)