色综合久久久久无码专区,久久久无码精品亚洲日韩京东传媒,久久久久久久精品妇女99

Hook导入�?—�?实现挂钩FreeLibaray和HOOK延迟加蝲模块的API

��虎无忧 — Fri, 14 Aug 2009 05:36:00 GMT

摘要: Windows上Ring3的HOOK导入表所用的�c�d��同小异，本文改进了一个HOOK导入表的�c�，实现了HOOK延迟加蝲模块的API和FreeLibaray的HOOK的实现。欢�q�大家批评指正！阅读全文

��虎无忧 2009-08-14 13:36 发表评论

��虎无忧 — Sat, 13 Jun 2009 05:37:00 GMT

　　前一阶段重温了Windows中的HOOK�Q�由此参考了《Windows via C/C++》中的示例程序——DIPS�Q�但是我发现了一个有��的问题�?br>　　默认情况下，链接器�ƈ不会��支持XP或Vista的manifest链接到程序上�Q�因此，生成的应用程序运行时的控仉��格是�l�典Windows样式�Q�此�Ӟ��DIPS��工兯��行正常�?br>　　但是�Q�当加上如下�q�段代码�Q�适用于x86 CPU�Q�，问题��׃�生了�?br>

#pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"")

　　�q�意味着链接器将会把新的XP或Vista的manifest链接到程序上�Q��应用�E�序��h��XP或Vista的控件样式。这�Ӟ��问题产生了�?br>　　�q�里我脓出程序的��d��C��码：

int WINAPI _tWinMain(HINSTANCE hInstExe, HINSTANCE, PTSTR pszCmdLine, int) {

   // Convert command-line character to uppercase.
   CharUpperBuff(pszCmdLine, 1);
   TCHAR cWhatToDo = pszCmdLine[0];

   if ((cWhatToDo != TEXT('S')) && (cWhatToDo != TEXT('R'))) {

      // An invalid command-line argument; prompt the user.
      cWhatToDo = 0;
   }

   if (cWhatToDo == 0) {
      // No command-line argument was used to tell us what to
      // do; show usage dialog box and prompt the user.
      switch (DialogBox(hInstExe, MAKEINTRESOURCE(IDD_DIPS), NULL, Dlg_Proc)) {
         case IDC_SAVE:
            cWhatToDo = TEXT('S');
            break;

         case IDC_RESTORE:
            cWhatToDo = TEXT('R');
            break;
      }
   }

   if (cWhatToDo == 0) {
      // The user doesn't want to do anything.
      return(0);
   }

   // The Desktop ListView window is the grandchild of the ProgMan window.
   HWND hWndLV = GetFirstChild(GetFirstChild(
      FindWindow(TEXT("ProgMan"), NULL)));
   chASSERT(IsWindow(hWndLV));

   // Set hook that injects our DLL into the Explorer's address space. After
   // setting the hook, the DIPS hidden modeless dialog box is created. We
   // send messages to this window to tell it what we want it to do.
   chVERIFY(SetDIPSHook(GetWindowThreadProcessId(hWndLV, NULL)));

   // Wait for the DIPS server window to be created.
   MSG msg;
   GetMessage(&msg, NULL, 0, 0);      // ��h��意这�?/span>

   // Find the handle of the hidden dialog box window.
   HWND hWndDIPS = FindWindow(NULL, TEXT("Wintellect DIPS"));

   // Make sure that the window was created.
   chASSERT(IsWindow(hWndDIPS));

   // Tell the DIPS window which ListView window to manipulate
   // and whether the items should be saved or restored.
   BOOL bSave = (cWhatToDo == TEXT('S'));
   SendMessage(hWndDIPS, WM_APP, (WPARAM) hWndLV, bSave);

   // Tell the DIPS window to destroy itself. Use SendMessage
   // instead of PostMessage so that we know the window is
   // destroyed before the hook is removed.
   SendMessage(hWndDIPS, WM_CLOSE, 0, 0);

   // Make sure that the window was destroyed.
   chASSERT(!IsWindow(hWndDIPS));

   // Unhook the DLL, removing the DIPS dialog box procedure
   // from the Explorer's address space.
   SetDIPSHook(0);

   return(0);
}

　　看到上面代码中的GetMessage函数�Q�加�U�色注释那行�Q�，该函数是在接收一个来自explorer.exe�q�程的消息，�q�个消息是在挂钩DLL注入之后�Q�由挂钩�q��o函数发送的。挂钩过滤函��C��码如下：

LRESULT WINAPI GetMsgProc(int nCode, WPARAM wParam, LPARAM lParam) {

   static BOOL bFirstTime = TRUE;

   if (bFirstTime) {
      // The DLL just got injected.
      bFirstTime = FALSE;

      // Uncomment the line below to invoke the debugger
      // on the process that just got the injected DLL.
      // ForceDebugBreak();

      // Create the DIPS Server window to handle the client request.
      CreateDialog(g_hInstDll, MAKEINTRESOURCE(IDD_DIPS), NULL, Dlg_Proc);

      // Tell the DIPS application that the server is up
      // and ready to handle requests.
      PostThreadMessage(g_dwThreadIdDIPS, WM_NULL, 0, 0);
   }

   return(CallNextHookEx(g_hHook, nCode, wParam, lParam));
}

　　明显圎ͼ��q�里发送了一个WM_NULL消息�l�DIPS�q�程�Q�当使用�l�典样式的控件时一切安好，�l�调试得到的MSG�l�构中的各个字段为正��的倹{��但是加上了上面那行链接命��o后，调试得到的MSG�l�构的字�D�压根就不是WM_NULL�?�?�Q�而是一个数��gؓ49211的消息，�q�样��D��了DIPS�ȝ��E�唤醒，随后的FindWindow可能会返回一个NULL�Q�因��消息�q�不是挂钩过滤函数的发送的消息。当�Ӟ��如果在这里Sleep一下，可以得到正确的窗口句柄，我在GetMessage函数上加了一个do-while循环�Q�结果也的确是这��P��几次循环之后可以收到消息为WM_NULL的消息，且参数均�?�?br>　　但是我不明白��Z��么加上了一条链接命令会�q�样�Q�不妨大安��试试看，我用的IDE是VS2005�?br>　　哪位高手可以来指导我一下呢�Q?

��虎无忧 2009-06-13 13:37 发表评论

��虎无忧 — Fri, 22 May 2009 14:22:00 GMT

　　前一阶段闲着无聊�Q�用�q�程�U�程注入的方法把DLL注入到Explorer.exe�q�程实现音乐循环播放�?

　　在DLL中的代码是这��L��Q?/p>

BOOL WINAPI DllMain(HINSTANCE hInstDll, DWORD fdwReason, PVOID fImpLoad)
{
    static HANDLE hThread;
    static DWORD dwThreadId;
    switch (fdwReason)
    {
    case DLL_PROCESS_ATTACH:
        g_hInstDll = hInstDll;
        hThread = BEGINTHREADEX(NULL, 0, ThreadProc, (PVOID)hInstDll, 0, &dwThreadId);
        if (hThread == NULL)
        {
            return FALSE;
        }
        break;

    case DLL_PROCESS_DETACH:
        SendMessage(g_hWnd, WM_CLOSE, 0, 0);
        WaitForSingleObject(hThread, INFINITE);    // �q�里存在��d�@�?/span>

        CloseHandle(hThread);    // 执行不到�q�里
        break;

    case DLL_THREAD_ATTACH:
        break;

    case DLL_THREAD_DETACH:
        break;

    default:
        break;
    }
    return TRUE;
}

　　在DLL_PROCESS_ATTACH的时候创��Z��一个线�E�，�q�个�U�程中创��Z��一个隐藏的�H�口�Q��ƈ利用MCI实现播放音乐�Q�具体就不脓��Z��。然后在DLL_PROCESS_DETACH中停止和关闭讑֤��?/p>

　　但是在应用程序中�Q�发现注入时无异常，在需要撤销DLL映射时出��C��问题�Q�程序出��C��d�@环，在等待远�E�线�E�执行FreeLibaray完毕时不�q�回了�?/p>

　　注意上面代码中DLL_PROCESS_DETACH的代码，SendMessage用来关闭�H�口�Q�窗口会在WM_DESTROY通知下调用PostQuitMessage(0)使得�U�程的消息��@环退出，从而线�E�退出。但是WaitForSingleObject函数无法�q�回�?/p>

　　后来发现�q�里存在��d�@环，因�ؓ执行DllMain的线�E�是序列化的�Q�必��ȝ��待一个线�E�执行完毕之后另一个线�E�才能执行。在SendMessage后，��D��创徏的线�E�即��退出，�q�时该线�E�会调用DllMain�Q��ƈ以DLL_THREAD_DETACH作�ؓ通知。可是调用SendMessage的线�E�调用DllMain时却�q�在�{�待卛_��退出的�U�程�l�束�Q�DllMain�q�没有返回，因此存在了死循环�?/p>

　　因此�Q�在DllMain中不适合调用WaitForSingleObject�{�函数来�{�待�U�程完毕�?/p>

��虎无忧 2009-05-22 22:22 发表评论