{"rsdb":{"rid":"397324","subhead":"","postdate":"0","aid":"273520","fid":"49","uid":"1","topic":"1","content":"<div id=\"cnblogs_post_body\" class=\"blogpost-body cnblogs-markdown\"> \n <p>InlineHook \u662f\u4e00\u79cd\u8ba1\u7b97\u673a\u5b89\u5168\u7f16\u7a0b\u6280\u672f\uff0c\u5176\u539f\u7406\u662f\u5728\u8ba1\u7b97\u673a\u7a0b\u5e8f\u6267\u884c\u671f\u95f4\u8fdb\u884c\u62e6\u622a\u3001\u4fee\u6539\u3001\u589e\u5f3a\u73b0\u6709\u51fd\u6570\u529f\u80fd\u3002\u5b83\u4f7f\u7528\u94a9\u5b50\u51fd\u6570\uff08\u4e5f\u53ef\u4ee5\u79f0\u4e3a\u56de\u8c03\u51fd\u6570\uff09\u6765\u622a\u83b7\u7a0b\u5e8f\u6267\u884c\u7684\u5404\u79cd\u4e8b\u4ef6\uff0c\u5e76\u5728\u4e8b\u4ef6\u53d1\u751f\u524d\u6216\u540e\u8fdb\u884c\u81ea\u5b9a\u4e49\u5904\u7406\uff0c\u4ece\u800c\u63a7\u5236\u6216\u589e\u5f3a\u7a0b\u5e8f\u884c\u4e3a\u3002Hook\u6280\u672f\u5e38\u88ab\u7528\u4e8e\u7cfb\u7edf\u52a0\u901f\u3001\u529f\u80fd\u589e\u5f3a\u3001\u7b49\u9886\u57df\u3002\u672c\u7ae0\u5c06\u91cd\u70b9\u8bb2\u89e3Hook\u662f\u5982\u4f55\u5b9e\u73b0\u7684\uff0c\u5e76\u624b\u52a8\u5c01\u88c5\u5b9e\u73b0\u81ea\u5df1\u7684Hook\u6302\u94a9\u6a21\u677f\u3002<\/p> \n <p>\u9996\u5148\u6211\u4eec\u6765\u63a2\u7d22\u4e00\u4e0bHook\u6280\u672f\u662f\u5982\u4f55\u5b9e\u73b0\u7684\uff0c\u5982\u4e0b\u56fe\u6240\u793a\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u5f39\u7a97\u7a0b\u5e8f\uff0c\u5f53\u8bfb\u8005\u70b9\u51fb\u6d4b\u8bd5\u5f39\u7a97\u6309\u94ae\u65f6\u5219\u4f1a\u5f39\u51fa\u4e00\u4e2a<code>MessageBox<\/code>\u63d0\u793a\u7a97\u53e3\uff0c\u672c\u6b21\u5b9e\u73b0\u76ee\u6807\u5f88\u7b80\u5355\uff0c\u901a\u8fc7\u5411\u76ee\u6807\u5185\u6ce8\u5165\u4e00\u4e2aDLL\u5e93\uff0c\u5b9e\u73b0Hook\u6302\u94a9\u4f4f<code>MessageBox<\/code>\u5f39\u7a97\uff0c\u4ece\u800c\u5b9e\u73b0\u53bb\u9664\u5f39\u7a97\u7684\u76ee\u7684\uff1b<\/p> \n <p><img src=\"https:\/\/img2023.cnblogs.com\/blog\/1379525\/202304\/1379525-20230421103731247-1854620445.png\" alt=\"\" loading=\"lazy\" \/><\/p> \n <p>\u6211\u4eec\u5148\u6765\u770b\u770b\u5982\u4f55\u5b9e\u73b0Hook\u601d\u8def\uff1b<\/p> \n <ul> \n  <li>1.\u8c03\u7528<code>GetModuleHandle<\/code>\u51fd\u6570\u6765\u83b7\u53d6\u5230<code>user32.dll<\/code>\u6a21\u5757\u7684\u57fa\u5740<\/li> \n  <li>2.\u8c03\u7528<code>GetProcAddress<\/code>\u51fd\u6570\u83b7\u53d6\u5230<code>MessageBoxA<\/code>\u5f39\u7a97\u7684\u57fa\u5740<\/li> \n  <li>3.\u8c03\u7528<code>VirtualProtect<\/code>\u6765\u4fee\u6539<code>MessageBoxA<\/code>\u524d5\u4e2a\u5b57\u8282\u5185\u5b58\u5c5e\u6027<\/li> \n  <li>4.\u8ba1\u7b97<code>Dest - MsgBox - 5<\/code>\u91cd\u5b9a\u4f4d\u8df3\u8f6c\u5730\u5740\uff0c\u5e76\u5199\u5165<code>JMP<\/code>\u8df3\u8f6c\u6307\u4ee4<\/li> \n  <li>5.\u8ba1\u7b97<code>Dest + Offset + 5 = MsgBox +5<\/code>\u5f97\u5230\u9700\u8981\u8df3\u8f6c\u56de<code>RET<\/code>\u7684\u4f4d\u7f6e<\/li> \n  <li>6.\u6700\u540e\u8c03\u7528<code>VirtualProtect<\/code>\u6765\u5c06\u5185\u5b58\u5c5e\u6027\u4fee\u6539\u4e3a\u539f\u59cb\u72b6\u6001<\/li> \n <\/ul> \n <p>\u6211\u4eec\u8f7d\u5165\u5e26\u6709<code>MessageBoxA<\/code>\u5f39\u7a97\u7684\u7a0b\u5e8f,\u7136\u540e\u5728<code>x64dbg<\/code>\u4e0a\u6309\u4e0b<code>Ctrl+G<\/code>\u8f93\u5165<code>MessageBoxA<\/code>\u627e\u5230\u6211\u4eec\u9700\u8981Hook\u7684\u4f4d\u7f6e\uff08\u6216\u8005\u8bf4\u66ff\u6362\uff09\uff0c\u5982\u4e0b\u56fe\u6240\u793a\u4e3a\u4e86\u5b8c\u6210\u5f39\u7a97\u8f6c\u5411\u529f\u80fd\uff0c\u53ea\u9700\u8981\u5728\u51fd\u6570\u5f00\u5934\u5199\u5165<code>jmp<\/code>\u65e0\u6761\u4ef6\u8df3\u8f6c\u6307\u4ee4\u5373\u53ef\uff0c\u572832\u4f4d\u7cfb\u7edf\u4e2d<code>JMP<\/code>\u6307\u4ee4\u9ed8\u8ba4\u5360\u75285\u4e2a\u5b57\u8282\uff0c\u524d\u4e09\u6761\u6307\u4ee4\u6070\u597d5\u4e2a\u5b57\u8282\uff0c\u4e3a\u4e86\u80fd\u591f\u4fdd\u6301\u5806\u6808\u5e73\u8861\uff0c\u6211\u4eec\u9700\u8981\u8bb0\u4e0b\u524d\u4e09\u6761\u6307\u4ee4\uff0c\u5e76\u5728\u81ea\u5df1\u7684\u4e2d\u8f6c\u51fd\u6570\u4e2d\u5bf9\u5176\u8fdb\u884c\u8865\u9f50\u3002<\/p> \n <p><img src=\"https:\/\/img2023.cnblogs.com\/blog\/1379525\/202304\/1379525-20230421102559007-841985042.png\" alt=\"\" loading=\"lazy\" \/><\/p> \n <p>\u6b64\u5916\uff0c\u6211\u4eec\u8fd8\u9700\u8981\u8ba1\u7b97\u51fa\u7a0b\u5e8f\u7684\u8fd4\u56de\u5730\u5740\uff0c\u4f7f\u7528<code>0x76600BE5 - 0x76600BA0 = 0x45<\/code>\u4ece\u800c\u5f97\u51fa\u8fd4\u56de\u5730\u5740\u5c31\u662f\u57fa\u5740\u52a0\u4e0a<code>0x45<\/code>\uff0c\u8fd9\u91cc\u7684\u8fd4\u56de\u5730\u5740\u5176\u5b9e\u5c31\u662f\u8fd4\u56de\u5230\u539f<code>MessageBoxA<\/code>\u5f39\u7a97\u7684<code>RET 0x10<\/code>\u7684\u4f4d\u7f6e<code>76600BE6<\/code>\uff0c\u4ece\u8fd9\u91cc\u53ef\u4ee5\u770b\u51fa\u5c4f\u853d\u5f39\u7a97\u7684\u539f\u7406\u5c31\u662f\u901a\u8fc7\u4e2d\u8f6c\u51fd\u6570\u8df3\u8fc7\u4e86\u539f\u59cb\u5f39\u7a97\u51fd\u6570\u7684\u6267\u884c\u3002<\/p> \n <p>\u7531\u4e8e\u5f00\u5934\u4f4d\u7f6e\u88ab\u66ff\u6362\u4e3a\u4e86\u6211\u4eec\u81ea\u5df1\u7684<code>Transfer()<\/code>\u51fd\u6570\uff0c\u5f53\u7a0b\u5e8f\u4e2d\u5f39\u7a97\u88ab\u8c03\u7528\u65f6\u9ed8\u8ba4\u4f1a\u8def\u7531\u5230\u6211\u4eec\u81ea\u5df1\u7684\u51fd\u6570\u5185\uff0c\u9996\u5148\u6267\u884c\u8865\u9f50\u539f\u51fd\u6570\u7684\u66ff\u6362\u90e8\u5206\uff0c\u5e76\u6267\u884c\u81ea\u5b9a\u4e49\u529f\u80fd\u533a\u4e2d\u7684\u589e\u52a0\u5185\u5bb9\uff0c\u5f53\u6267\u884c\u7ed3\u675f\u540e\u5219\u901a\u8fc7<code>jmp ebx<\/code>\u7684\u65b9\u5f0f\u8df3\u8f6c\u56de\u539f\u51fd\u6570\u7684<code>ret 0x10<\/code>\u7684\u4f4d\u7f6e\u5904\uff0c\u4ece\u800c\u5b9e\u73b0\u589e\u52a0\u529f\u80fd\u7684\u76ee\u7684\u3002\u8fd9\u91cc\u8bfb\u8005\u9700\u8981\u6ce8\u610f<code>__declspec(naked)<\/code>\u7684\u610f\u601d\u662f\u4e0d\u6dfb\u52a0\u4efb\u4f55\u7684\u6c47\u7f16\u4fee\u9970\uff0c\u5f53\u4f7f\u7528\u4e86\u6b64\u4fee\u9970\u7b26\u65f6\u5219\u7f16\u8bd1\u5668\u4f1a\u53ea\u7f16\u8bd1\u6211\u4eec\u81ea\u5df1\u7684\u6c47\u7f16\u6307\u4ee4\uff0c\u5e76\u4e0d\u4f1a\u589e\u52a0\u9ed8\u8ba4\u7684\u51fd\u6570\u5f00\u573a\u6216\u79bb\u573a\u539f\u8bed\u3002<\/p> \n <pre><code class=\"language-c\">__declspec(naked) void Transfer()\n{\n  __asm{\n    mov edi, edi\n    push ebp\n    mov ebp, esp\n    \/\/ \u81ea\u5b9a\u4e49\u529f\u80fd\u533a\n    mov ebx, jump     \/\/ \u53d6\u51fa\u8df3\u8f6c\u5730\u5740\n    jmp ebx           \/\/ \u65e0\u6761\u4ef6\u8f6c\u5411\n  }\n}\n<\/code><\/pre> \n <p>\u901a\u8fc7\u5e94\u7528\u4e0a\u8ff0\u6848\u4f8b\u4e2d\u7684\u77e5\u8bc6\u70b9\u6211\u4eec\u80fd\u5f88\u5bb9\u6613\u7684\u5b9e\u73b0\u5bf9\u5f39\u7a97\u7684\u66ff\u6362\u529f\u80fd\uff0c\u4ee5\u4e0b\u4ee3\u7801\u4e2d\u5b9e\u73b0\u4e86\u5bf9<code>MessageBoxA<\/code>\u5f39\u7a97\u7684\u5c4f\u853d\u529f\u80fd\uff0c\u4e5f\u5c31\u662f\u901a\u8fc7\u8df3\u8fc7\u5f39\u7a97\u5b9e\u73b0\u6d41\u7a0b\u5b9e\u73b0\u7684\u4e00\u79cd\u52ab\u6301\u65b9\u6cd5\uff0c\u8bfb\u8005\u53ef\u81ea\u884c\u7f16\u8bd1\u8fd9\u6bb5DLL\u7a0b\u5e8f\uff0c\u4f46\u9700\u8981\u6ce8\u610f\u4e00\u70b9\uff0c\u8bfb\u8005\u5728\u7f16\u8bd1DLL\u65f6\u5e94\u8be5\u5173\u95edDLL\u7684<code>DEP<\/code>\u4ee5\u53ca<code>ASLR<\/code>\u6a21\u5f0f\uff0c\u5426\u5219\u4f1a\u51fa\u73b0\u65e0\u6cd5\u5b9a\u4f4d\u7684\u95ee\u9898\u3002<\/p> \n <pre><code class=\"language-c\">#include &lt;Windows.h&gt;\n#include &lt;stdio.h&gt;\n\nDWORD jump = 0;\n\n\/\/ \u4e0d\u6dfb\u52a0\u4efb\u4f55\u7684\u6c47\u7f16\u4fee\u9970\n__declspec(naked) void Transfer()\n{\n    __asm\n    {\n        mov edi, edi\n        push ebp\n        mov ebp, esp\n        mov ebx, jump     \/\/ \u53d6\u51fa\u8df3\u8f6c\u5730\u5740\n        jmp ebx           \/\/ \u65e0\u6761\u4ef6\u8f6c\u5411\n    }\n}\n\n\/\/ DLL\u7a0b\u5e8f\u5165\u53e3\u5730\u5740\nbool APIENTRY DllMain(HANDLE handle, DWORD dword, LPVOID lpvoid)\n{\n    \/\/ \u53d6\u8fdb\u7a0b\u5185\u6a21\u5757\u57fa\u5740\n    HMODULE hwnd = GetModuleHandle(TEXT(&quot;user32.dll&quot;));\n    DWORD base = (DWORD)GetProcAddress(hwnd, &quot;MessageBoxA&quot;);\n    DWORD oldProtect = 0;\n\n    \/\/ \u5c06\u5185\u5b58\u8bbe\u7f6e\u4e3a\u53ef\u8bfb\u53ef\u5199\u53ef\u6267\u884c\u72b6\u6001,\u5e76\u5c06\u539f\u5c5e\u6027\u4fdd\u5b58\u5728oldProtect\u65b9\u4fbf\u6062\u590d\n    if (VirtualProtect((LPVOID)base, 5, PAGE_EXECUTE_READWRITE, &amp;oldProtect))\n    {\n        DWORD value = (DWORD)Transfer - base - 5;    \/\/ \u8ba1\u7b97\u51fa\u9700\u8981Hook\u7684\u5730\u5740\n        jump = base + 0x45;                          \/\/ \u8ba1\u7b97\u51fa\u8fd4\u56de\u5730\u5740\n\n        \/\/ \u66ff\u6362\u5934\u90e8\u6c47\u7f16\u4ee3\u7801\n        __asm\n        {\n            mov eax, base\n            mov byte ptr[eax], 0xe9        \/\/ e9 = jmp \u6307\u4ee4\u673a\u5668\u7801\n            inc eax                        \/\/ \u9012\u589e\u6307\u9488\n            mov ebx, value                 \/\/ \u9700\u8981\u8df3\u8f6c\u5230\u7684\u5730\u5740\n            mov dword ptr[eax], ebx\n        }\n\n        \/\/ \u6062\u590d\u5185\u5b58\u7684\u539f\u59cb\u5c5e\u6027\n        VirtualProtect((LPVOID)base, 5, oldProtect, &amp;oldProtect);\n    }\n    return true;\n}\n<\/code><\/pre> \n <p>\u8bfb\u8005\u53ef\u901a\u8fc7\u6ce8\u5165\u8f6f\u4ef6\u5c06<code>hook.dll<\/code>\u52a8\u6001\u94fe\u63a5\u5e93\u6ce8\u5165\u5230\u8fdb\u7a0b\u5185\uff0c\u6b64\u65f6\u6211\u4eec\u53ef\u4ee5\u518d\u6b21\u89c2\u5bdf<code>0x76600BA0<\/code>\u4f4d\u7f6e\u5904\u7684\u4ee3\u7801\u7247\u6bb5\uff0c\u8bfb\u8005\u5e94\u8be5\u80fd\u770b\u5230\u5df2\u7ecf\u88abJMP\u66ff\u6362\uff0c\u5982\u4e0b\u56fe\u6240\u793a\uff1b<\/p> \n <p><img src=\"https:\/\/img2023.cnblogs.com\/blog\/1379525\/202304\/1379525-20230421105043739-1031003952.png\" alt=\"\" loading=\"lazy\" \/><\/p> \n <p>\u7ee7\u7eed\u8ddf\u8fdb\u5219\u8bfb\u8005\u80fd\u770b\u5230\uff0c\u5728\u8df3\u8f6c\u6307\u4ee4\u7684\u4e0b\u65b9\u5219\u662f\u6211\u4eec\u81ea\u5df1\u8865\u9f50\u7684\u6c47\u7f16\u6307\u4ee4\uff0c\u6b64\u5904\u7531\u4e8e\u6ca1\u6709\u505a\u4efb\u4f55\u4e8b\u5c31\u88ab\u8fd4\u56de\u4e86\uff0c\u8fd9\u5c31\u5bfc\u81f4\u5f53\u8bfb\u8005\u518d\u6b21\u70b9\u51fb\u5f39\u7a97\u65f6\uff0c\u5f39\u7a97\u5931\u6548\uff1b<\/p> \n <p><img src=\"https:\/\/img2023.cnblogs.com\/blog\/1379525\/202304\/1379525-20230421105140661-67272170.png\" alt=\"\" loading=\"lazy\" \/><\/p> \n <p>\u5f53\u6211\u4eec\u9700\u8981\u66ff\u6362\u7a0b\u5e8f\u6807\u9898\u65f6\u540c\u6837\u53ef\u662f\u4f7f\u7528\u8be5\u65b9\u5f0f\u5b9e\u73b0\uff0c\u4e00\u822c\u6765\u8bf4\u7a0b\u5e8f\u8bbe\u7f6e\u6807\u9898\u4f1a\u8c03\u7528<code>SetWindowTextA<\/code>\u51fd\u6570\uff0c\u6211\u4eec\u53ef\u4ee5\u62e6\u622a\u8fd9\u4e2a\u51fd\u6570\uff0c\u5e76\u4f20\u5165\u81ea\u5b9a\u4e49\u7684\u7a97\u53e3\u540d\u79f0\uff0c\u4ece\u800c\u5b9e\u73b0\u4fee\u6539\u6307\u5b9a\u7a97\u53e3\u7684\u6807\u9898\u7684\u76ee\u7684\uff0c\u4ee3\u7801\u53ea\u662f\u5728\u4e0a\u9762\u4ee3\u7801\u7684\u57fa\u7840\u4e0a\u7a0d\u5fae\u6539\u4e00\u4e0b\u5c31\u80fd\u5b9e\u73b0\u6548\u679c\uff0c\u53ea\u8981\u7a0b\u5e8f\u4f7f\u7528\u4e86\u8be5\u51fd\u6570\u8bbe\u7f6e\u6807\u9898\uff0c\u5219\u53ef\u4ee5\u5b9e\u73b0\u66ff\u6362\u7684\u76ee\u7684\uff1b<\/p> \n <pre><code class=\"language-c\">#include &lt;Windows.h&gt;\n#include &lt;stdio.h&gt;\n\nDWORD jump = 0;\n\n\/\/ \u6c47\u7f16\u4e2d\u8f6c\u51fd\u6570\n__declspec(naked) bool _stdcall Transfer(HWND hwnd, LPCSTR lpString)\n{\n    __asm\n    {\n        mov edi, edi\n        push ebp\n        mov ebp, esp\n        mov ebx, jump\n        jmp ebx\n    }\n}\n\n\/\/ \u81ea\u5df1\u7684\u8bbe\u7f6e\u7a97\u4f53\u6807\u9898\u51fd\u6570\nbool __stdcall MySetWindowTextA(HWND hwnd, LPCSTR lpString)\n{\n    char * lpText = &quot;LyShark \u4fee\u6539\u7248&quot;;\n    return Transfer(hwnd, lpText);\n}\n\n\/\/ DLL\u7a0b\u5e8f\u5165\u53e3\u5730\u5740\nbool APIENTRY DllMain(HANDLE handle, DWORD dword, LPVOID lpvoid)\n{\n    HMODULE hwnd = GetModuleHandle(TEXT(&quot;user32.dll&quot;));\n    DWORD base = (DWORD)GetPr","orderid":"0","title":"4.1 \u5e94\u7528\u5c42Hook\u6302\u94a9\u539f\u7406\u5206\u6790(\u4e00)","smalltitle":"","mid":"0","fname":"c++\u7f16\u7a0b\u57fa\u7840","special_id":"0","bak_id":"0","info":"0","hits":"590","pages":"2","comments":"0","posttime":"2023-09-23 15:44:04","list":"1695455044","username":"admin","author":"","copyfrom":"","copyfromurl":"","titlecolor":"","fonttype":"0","titleicon":"0","picurl":"https:\/\/www.cppentry.com\/upload_files\/","ispic":"0","yz":"1","yzer":"","yztime":"0","levels":"0","levelstime":"0","keywords":"<A HREF='https:\/\/www.cppentry.com\/do\/search.php?type=keyword&keyword=4.1' target=_blank>4.1<\/A> <A HREF='https:\/\/www.cppentry.com\/do\/search.php?type=keyword&keyword=%D3%A6%D3%C3%B2%E3' target=_blank>\u5e94\u7528\u5c42<\/A> <A HREF='https:\/\/www.cppentry.com\/do\/search.php?type=keyword&keyword=Hook' target=_blank>Hook<\/A>","jumpurl":"","iframeurl":"","style":"","template":"a:3:{s:4:\"head\";s:0:\"\";s:4:\"foot\";s:0:\"\";s:8:\"bencandy\";s:0:\"\";}","target":"0","ip":"112.94.1.100","lastfid":"0","money":"0","buyuser":"","passwd":"","allowdown":"","allowview":"","editer":"","edittime":"0","begintime":"0","endtime":"0","description":"4.1 \u5e94\u7528\u5c42Hook\u6302\u94a9\u539f\u7406\u5206\u6790","lastview":"1714216187","digg_num":"618","digg_time":"1714133119","forbidcomment":"0","ifvote":"0","heart":"","htmlname":"","city_id":"0"},"page":"1"}