实现hook OpenProcess实现ring3保护进程、代码

原创

天晴V587 2014-02-20 10:46:29 博主文章分类：PE外壳 ©著作权

文章标签 hook ring3 openprocess 文章分类 网络安全

©著作权归作者所有：来自51CTO博客作者天晴V587的原创作品，请联系作者获取转载授权，否则将追究法律责任

/*********************************实现hook OpenProcess实现ring3保护进程、、C++完整代码、、************************************************/
#include <windows.h>

PIMAGE_IMPORT_BY_NAME pImportByName = NULL;
PIMAGE_THUNK_DATA pOriginalThunk = NULL;
PIMAGE_THUNK_DATA pFirstThunk = NULL;

//IAT HOOK的核心函数、
int IatHook(const char* DllName, const char* FunName,DWORD RealAddr);

//自己的OpenProcess函数、
HANDLE WINAPI MyOpenProcess (DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId);

DWORD MyOpenProcessAddr = (DWORD)MyOpenProcess;

//真正的 OpenProcess函数指针、、
typedef HANDLE (WINAPI * RealOpenProcess)(DWORD,BOOL,DWORD);
RealOpenProcess pRealOpenProcess = (RealOpenProcess)OpenProcess;

//DLL MAIN 函数、
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
{
if(fdwReason==DLL_PROCESS_ATTACH)
{
IatHook("Kernel32.dll","OpenProcess",MyOpenProcessAddr);
}
return TRUE;
}

/****************************************************** MyOpenProcess 函数的实现部分****************************************************/

HANDLE WINAPI MyOpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId)
{

//获取要保护进程的标题的窗口句柄系统API函数前使用::为了和类扩展函数区别
// 为了代码的健壮性使用TEXT宏、 HWND 窗口句柄、
HWND HProtect = ::FindWindow(NULL,TEXT("Windows 当前所有进程"));
if(!HProtect)
{
return ( pRealOpenProcess(dwDesiredAccess,bInheritHandle,dwProcessId) );
} //若不存在则调用返回
//获取创建此窗口的进程的ID、保存在 &ProtectId 地址中、
DWORD ProtectId; //下边找出某个窗口的创建者(线程或进程)
GetWindowThreadProcessId(HProtect,&ProtectId);
if(ProtectId == dwProcessId) //dwProcessId是任务管理器要结束的进程ID
{
return 0; //如果结束的是我们的进程则返回错误码0、
}
return ( pRealOpenProcess(dwDesiredAccess,bInheritHandle,dwProcessId) );
}

/ ****************************************************** IAT HOOK 函数的实现部分****************************************************/

int IatHook(const char* DllName, const char* FunName,DWORD RealAddr)

{

/************************** 找相同的DLL ****************************/
HANDLE pBegin = GetModuleHandle(NULL);
PBYTE pBegin2 = (PBYTE)pBegin;
PIMAGE_DOS_HEADER DOS = PIMAGE_DOS_HEADER(pBegin2);
PIMAGE_NT_HEADERS NT = PIMAGE_NT_HEADERS(pBegin2+DOS->e_lfanew);
PIMAGE_OPTIONAL_HEADER OPTION = &(NT->OptionalHeader);
PIMAGE_IMPORT_DESCRIPTOR IMPORT = PIMAGE_IMPORT_DESCRIPTOR(OPTION->DataDirectory[1].VirtualAddress + pBegin2);

while (IMPORT->Name)
{
char* OurDllName = (char*)(IMPORT->Name + pBegin2);
if (0 == strcmpi(DllName , OurDllName))
{
break;
}
IMPORT++;
}

/************************* 找相同的API函数 ****************************/
PIMAGE_IMPORT_BY_NAME pImportByName = NULL;
PIMAGE_THUNK_DATA pOriginalThunk = NULL;
PIMAGE_THUNK_DATA pFirstThunk = NULL;
pOriginalThunk = (PIMAGE_THUNK_DATA)(IMPORT->OriginalFirstThunk + pBegin2);
pFirstThunk = (PIMAGE_THUNK_DATA)(IMPORT->FirstThunk + pBegin2);
while (pOriginalThunk->u1.Function) //记住是Function
{
DWORD u1 = pOriginalThunk->u1.Ordinal; //记住是Ordinal
if ((u1 & IMAGE_ORDINAL_FLAG) != IMAGE_ORDINAL_FLAG) //说明MSB不是1 不是以序号导入
{
pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pOriginalThunk->u1.AddressOfData + pBegin2);
char* OurFunName = (char*)(pImportByName->Name); //下边的计算也可以
//char* OurFunName2 = (char*)((DWORD)pOriginalThunk->u1.AddressOfData + pBegin2 + 2);
if (0 == strcmpi(FunName,OurFunName))
{
//获取以pFirstThunk开始的内存的信息并将其保存到MEMORY_BASIC_INFORMATION结构中
MEMORY_BASIC_INFORMATION mbi_thunk;
VirtualQuery (pFirstThunk, &mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
//VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE, &mbi_thunk.Protect);
//修改以pFirstThunk开始的内存的的保护属性为PAGE_READWRITE并将原保护属性保存到&dwOLD中
DWORD dwOLD;
VirtualProtect(pFirstThunk,sizeof(DWORD),PAGE_READWRITE,&dwOLD);
//更改真正OpenProcess的地址为自己写的MyOpenProcess函数的地址、、
pFirstThunk->u1.Function = (PDWORD)RealAddr; //关键地方
//恢复之前更改的内存的保护属性为人家自己的、、
VirtualProtect(pFirstThunk,sizeof(DWORD),dwOLD,0);
break;
}
}
pOriginalThunk++;
pFirstThunk++;
}
return 0;
}