StealthHook | 一种无需修改内存保护即可挂钩函数的方法

StealthHook - x86matthewwww.x86matthew.comSearching for hooking points...Instruction 0x777B3440 referenced at KERNELBASE.dll!0x7785FA7C (sect: .data, virt_addr: 0x1DFA7C, stack delta: 0x30)Instruction 0x77783AB0 referenced at KERNELBASE.dll!0x7785F650 (sect: .data, virt_addr: 0x1DF650, stack delta: 0x100)Found 2 potential hooking points, testing...Overwriting reference: 0x7785FA7C...Calling target function...Hook caught successfully!Overwriting reference: 0x7785F650...Calling target function...Hook caught successfully!Finished - found 2 successful hooking points

#include <stdio.h>#include <windows.h>DWORD dwGlobal_OrigCreateFileReturnAddr = 0;DWORD dwGlobal_OrigReferenceAddr = 0;void __declspec(naked) ModifyReturnValue(){  // the original return address for the CreateFile call redirects to here  _asm  {    // CreateFile complete - overwrite return value    mov eax, 0x12345678    // continue original execution flow (ecx is safe to overwrite at this point)    mov ecx, dwGlobal_OrigCreateFileReturnAddr    jmp ecx  }}void __declspec(naked) HookStub(){  // the hooked global pointer nested within CreateFile redirects to here  _asm  {    // store original CreateFile return address    mov eax, dword ptr [esp + 0x100]    mov dwGlobal_OrigCreateFileReturnAddr, eax    // overwrite the CreateFile return address    lea eax, ModifyReturnValue    mov dword ptr [esp + 0x100], eax    // continue original execution flow    mov eax, dwGlobal_OrigReferenceAddr    jmp eax  }}DWORD InstallHook(){  BYTE *pModuleBase = NULL;  BYTE *pHookAddr = NULL;  // get base address of kernelbase.dll  pModuleBase = (BYTE*)GetModuleHandle("kernelbase.dll");  if(pModuleBase == NULL)  {    return 1;  }  // get ptr to function reference  pHookAddr = pModuleBase + 0x1DF650;  // store original value  dwGlobal_OrigReferenceAddr = *(DWORD*)pHookAddr;  // overwrite ptr to call HookStub  *(DWORD*)pHookAddr = (DWORD)HookStub;  return 0;}int main(){  HANDLE hFile = NULL;  // create temporary file (without hook)  printf("Creating file #1...n");  hFile = CreateFile("temp_file_1.txt", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);  printf("hFile: 0x%Xnn", hFile);  // install hook  printf("Installing hook...nn");  if(InstallHook() != 0)  {    return 1;  }  // create temporary file (with hook)  printf("Creating file #2...n");  hFile = CreateFile("temp_file_2.txt", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);  printf("hFile: 0x%Xnn", hFile);  return 0;}

Creating file #1...hFile: 0xDCInstalling hook...Creating file #2...hFile: 0x12345678