#include <stdio.h>
#include <windows.h>
#include <Psapi.h>

#pragma comment(lib, "psapi.lib")

typedef struct _RemoteParam {
? DWORD dwCreateFile;
? DWORD dwMessageBox;
? DWORD dwGetCurrentProcess;
? DWORD dwWriteProcessMemory;
? unsigned char szOldCode[10];
? DWORD FunAddr;
} RemoteParam, * PRemoteParam;

typedef HANDLE (__stdcall * PFN_CREATEFILE)(LPCTSTR,DWORD,DWORD,LPSECURITY_ATTRIBUTES,DWORD,DWORD,HANDLE);
typedef int (__stdcall * PFN_MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, DWORD);
typedef BOOL (__stdcall * PFN_WRITEPROCESSMEMORY)(HANDLE,LPVOID,LPCVOID,SIZE_T,SIZE_T*);
typedef HANDLE (__stdcall * PFN_GETCURRENTPROCESS)(void);

#define PROCESSNUM 128
#define MYMESSAGEBOX "MessageBoxW"
#define MYCREATEFILE "CreateFileW"

void HookCreateFile(LPVOID lParam)
{

? RemoteParam* pRP = (RemoteParam*)lParam;


? DWORD NextIpAddr = 0;
? DWORD dwParamaAddr = 0;

? HANDLE RetFpHdl = INVALID_HANDLE_VALUE;
? LPCTSTR lpFileName;
? DWORD dwDesiredAccess;
? DWORD dwShareMode;
? LPSECURITY_ATTRIBUTES lpSecurityAttributes;
? DWORD dwCreationDisposition;
? DWORD dwFlagsAndAttributes;
? HANDLE hTemplateFile;
? PFN_CREATEFILE pfnCreatefile = (PFN_CREATEFILE)pRP->dwCreateFile;


? __asm
? {
? MOV EAX,[EBP+8]
? MOV [dwParamaAddr], EAX
? MOV EAX,[EBP+12] ? ? ?
? MOV [NextIpAddr], EAX
? MOV EAX,[EBP+16]
? MOV [lpFileName], EAX
? MOV EAX,[EBP+20]
? MOV [dwDesiredAccess],EAX
? MOV EAX,[EBP+24]
? MOV [dwShareMode],EAX
? MOV EAX,[EBP+28]
? MOV [lpSecurityAttributes],EAX
? MOV EAX,[EBP+32]
? MOV [dwCreationDisposition],EAX
? MOV EAX,[EBP+36]
? MOV [dwFlagsAndAttributes],EAX
? MOV EAX,[EBP+40]
? MOV [hTemplateFile],EAX ?
? }

? PFN_MESSAGEBOX pfnMessageBox = (PFN_MESSAGEBOX)pRP->dwMessageBox;
? int allowFlag = pfnMessageBox(NULL, lpFileName, NULL, MB_ICONINFORMATION | MB_YESNO);
?
? if(allowFlag == IDYES)
? {
? unsigned char szNewCode[10];
? int PramaAddr = (int)dwParamaAddr;
? szNewCode[4] = PramaAddr>>24;
? szNewCode[3] = (PramaAddr<<8)>>24;
? szNewCode[2] = (PramaAddr<<16)>>24;
? szNewCode[1] = (PramaAddr<<24)>>24;
? szNewCode[0] = 0x68;
?
? int funaddr = (int)pRP->FunAddr - (int)pfnCreatefile - 10 ;
? szNewCode[9] = funaddr>>24;
? szNewCode[8] = (funaddr<<8)>>24;
? szNewCode[7] = (funaddr<<16)>>24;
? szNewCode[6] = (funaddr<<24)>>24;
? szNewCode[5] = 0xE8;
?
?
? PFN_GETCURRENTPROCESS pfnGetCurrentProcess = (PFN_GETCURRENTPROCESS)pRP->dwGetCurrentProcess;
? PFN_WRITEPROCESSMEMORY pfnWriteProcessMemory = (PFN_WRITEPROCESSMEMORY)pRP->dwWriteProcessMemory;
? pfnWriteProcessMemory(pfnGetCurrentProcess(),
? ? ? ? ? ? ? ? (LPVOID)pfnCreatefile,
? ? ? ? ? ? ? ? (LPCVOID)pRP->szOldCode,
? ? ? ? ? ? ? ? 10,
? ? ? ? ? ? ? ? NULL);

? RetFpHdl = pfnCreatefile(lpFileName,
? ? ? ? ? ? ? ? ? dwDesiredAccess,
? ? ? ? ? ? ? ? ? dwShareMode,
? ? ? ? ? ? ? ? ? lpSecurityAttributes,
? ? ? ? ? ? ? ? ? dwCreationDisposition,
? ? ? ? ? ? ? ? ? dwFlagsAndAttributes,
? ? ? ? ? ? ? ? ? hTemplateFile);
? pfnWriteProcessMemory(pfnGetCurrentProcess(),
? ? ? ? ? ? ? ? (LPVOID)pfnCreatefile,
? ? ? ? ? ? ? ? (LPCVOID)szNewCode,
? ? ? ? ? ? ? ? 10,
? ? ? ? ? ? ? ? NULL);
? }


? __asm
? ? {POP EDI
? ? ? POP ESI
? ? ? POP EBX
? ? ? MOV EDX, [NextIpAddr]
? ? ? MOV EAX, [RetFpHdl]
? ? ? MOV ESP, EBP
? ? ? POP EBP
? ? ? ADD ESP, 28H
? ? ? PUSH EDX
? ? ? RET
? ? }

?
}



BOOL AdjustProcessPrivileges(LPCSTR szPrivilegesName)
{
? HANDLE hToken;
? TOKEN_PRIVILEGES tkp;

? if(!OpenProcessToken(GetCurrentProcess(),
? ? TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
? {
? ? return FALSE;
? }

? if(!LookupPrivilegeValue(NULL,szPrivilegesName,
? ? ? ? ? ? ? ? ? &tkp.Privileges[0].Luid))
? {
? ? CloseHandle(hToken);
? ? return FALSE;
? }
?
? tkp.PrivilegeCount = 1;
? tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
?
? if(!AdjustTokenPrivileges(hToken,FALSE,&tkp,sizeof(tkp),NULL,NULL))
? {
? ? CloseHandle(hToken);
? ? return FALSE;
? }
?
? CloseHandle(hToken);
? return TRUE;
}


void printProcessNameByPid( DWORD ProcessId )
{
? HANDLE pHd;
? HMODULE pHmod;
? char ProcessName[MAX_PATH] = "unknown";
? DWORD cbNeeded;
? pHd = OpenProcess( PROCESS_QUERY_INFORMATION |PROCESS_VM_READ, FALSE, ProcessId );
? if(pHd == NULL)
? ? return;
?
? if(!EnumProcessModules( pHd, &pHmod, sizeof(pHmod), &cbNeeded))
? ? return;
? if(!GetModuleFileNameEx( pHd, pHmod, ProcessName, MAX_PATH))
? ? return;
?
? printf( "%d\t%s\n", ProcessId, ProcessName);
? CloseHandle( pHd );
? return;
}


int main(void)
{

? if(!AdjustProcessPrivileges(SE_DEBUG_NAME))
? {
? ? ? printf("AdjustProcessPrivileges Error!\n");
? ? ? return -1;
? }

? DWORD Pids[PROCESSNUM];
? DWORD dwProcessNum = 0;
? if(!EnumProcesses(Pids, sizeof(Pids), &dwProcessNum))
? {
? ? ? printf("EnumProcess Error!\n");
? ? ? return -1;
? }
?
? for( DWORD num = 0; num < (dwProcessNum / sizeof(DWORD)); num++)
? ? ? printProcessNameByPid(Pids[num]);

? printf("\nAll %d processes running. \n", dwProcessNum / sizeof(DWORD));

? DWORD dwPid = 0;
? printf("\n請輸入要攔截的進程id:");
? scanf("%d", &dwPid);
?
? HANDLE hTargetProcess = OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_WRITE|PROCESS_VM_READ, FALSE, dwPid);
? if(hTargetProcess == NULL)
? {
? ? ? printf("OpenProcess Error!\n");
? ? ? return -1;
? }

? DWORD dwFunAddr = (DWORD)VirtualAllocEx(hTargetProcess, NULL, 8192,
? ? ? ? ? ? ? ? ? ? ? ? ? ? ? MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
?
? if((LPVOID)dwFunAddr == NULL)
? {
? ? ? printf("申請線程內存失敗!\n");
? ? ? CloseHandle(hTargetProcess);
? ? ? return -1;
? }

? DWORD dwPramaAddr = (DWORD)VirtualAllocEx(hTargetProcess, NULL, sizeof(RemoteParam),
? ? ? ? ? ? ? ? ? ? ? ? ? ? ? MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

? if((LPVOID)dwPramaAddr == NULL)
? {
? ? ? printf("申請參數內存失敗!\n");
? ? ? CloseHandle(hTargetProcess);
? ? ? return -1;
? }

? printf("\n線程內存地址:%.8x\n"
? ? ? ? "參數內存地址:%.8x\n",
? ? ? ? dwFunAddr, dwPramaAddr);
? ? RemoteParam RParam;
? ZeroMemory(&RParam, sizeof(RParam));
? HMODULE hKernel32 = LoadLibrary("kernel32.dll");
? HMODULE hUser32 = LoadLibrary("user32.dll");

? RParam.dwCreateFile = (DWORD)GetProcAddress(hKernel32, MYCREATEFILE);
? RParam.dwGetCurrentProcess = (DWORD)GetProcAddress(hKernel32, "GetCurrentProcess");
? RParam.dwWriteProcessMemory = (DWORD)GetProcAddress(hKernel32, "WriteProcessMemory");
? RParam.dwMessageBox = (DWORD)GetProcAddress(hUser32, MYMESSAGEBOX);
?
? unsigned char oldcode[10];
? unsigned char newcode[10];
? int praadd = (int)dwPramaAddr;
? int threadadd = (int)dwFunAddr;
? newcode[4] = praadd>>24;
? newcode[3] = (praadd<<8)>>24;
? newcode[2] = (praadd<<16)>>24;
? newcode[1] = (praadd<<24)>>24;
? newcode[0] = 0x68;
?
? int offsetaddr = threadadd - (int)RParam.dwCreateFile - 10 ;
? newcode[9] = offsetaddr>>24;
? newcode[8] = (offsetaddr<<8)>>24;
? newcode[7] = (offsetaddr<<16)>>24;
? newcode[6] = (offsetaddr<<24)>>24;
? newcode[5] = 0xE8;

? printf("NewCode:");
? for(int j = 0; j < 10; j++)
? ? ? printf("0x%.2x ",newcode[j]);
? printf("\n\n");



? if(!ReadProcessMemory(GetCurrentProcess(),
? ? ? ? ? ? ? ? ? (LPCVOID)RParam.dwCreateFile,
? ? ? ? ? ? ? ? ? oldcode,
? ? ? ? ? ? ? ? ? 10,
? ? ? ? ? ? ? ? ? &dwPid))
? {
? ? ? printf("read error");
? ? ? CloseHandle(hTargetProcess);
? ? ? FreeLibrary(hKernel32);
? ? ? return -1;
? }

? strcat((char*)RParam.szOldCode, (char*)oldcode);
? RParam.FunAddr = dwFunAddr;

? printf(
? ? ? ? "RParam.dwCreateFile:%.8x\n"
? ? ? ? "RParam.dwMessageBox:%.8x\n"
? ? ? ? "RParam.dwGetCurrentProcess:%.8x\n"
? ? ? ? "RParam.dwWriteProcessMemory:%.8x\n"
? ? ? ? "RParam.FunAddr:%.8x\n",
? ? ? ? RParam.dwCreateFile,
? ? ? ? RParam.dwMessageBox,
? ? ? ? RParam.dwGetCurrentProcess,
? ? ? ? RParam.dwWriteProcessMemory,
? ? ? ? RParam.FunAddr);
? printf("RParam.szOldCode:");
? for( int i = 0; i< 10; i++)
? ? ? printf("0x%.2x ", RParam.szOldCode[i]);
? printf("\n");
?
?
? if(!WriteProcessMemory(hTargetProcess, (LPVOID)dwFunAddr, (LPVOID)&HookCreateFile, 8192, &dwPid))
? {
? ? ? printf("WriteRemoteProcessesMemory Error!\n");
? ? ? CloseHandle(hTargetProcess);
? ? ? FreeLibrary(hKernel32);
? ? ? return -1;
? }

? if(!WriteProcessMemory(hTargetProcess, (LPVOID)dwPramaAddr, (LPVOID)&RParam, sizeof(RemoteParam), &dwPid))
? {
? ? ? printf("WriteRemoteProcessesMemory Error!\n");
? ? ? CloseHandle(hTargetProcess);
? ? ? FreeLibrary(hKernel32);
? ? ? return -1;
? }
?
? if(!WriteProcessMemory(hTargetProcess, (LPVOID)RParam.dwCreateFile, (LPVOID)newcode, 10, &dwPid))
? {
? ? ? printf("WriteRemoteProcessesMemory Error!\n");
? ? ? CloseHandle(hTargetProcess);
? ? ? FreeLibrary(hKernel32);
? ? ? return -1;
? }

? printf("\nThat's all, good luck :)\n");
? CloseHandle(hTargetProcess);
? FreeLibrary(hKernel32);
? return 0;
}