InlineHook \u662f\u4e00\u79cd\u8ba1\u7b97\u673a\u5b89\u5168\u7f16\u7a0b\u6280\u672f\uff0c\u5176\u539f\u7406\u662f\u5728\u8ba1\u7b97\u673a\u7a0b\u5e8f\u6267\u884c\u671f\u95f4\u8fdb\u884c\u62e6\u622a\u3001\u4fee\u6539\u3001\u589e\u5f3a\u73b0\u6709\u51fd\u6570\u529f\u80fd\u3002\u5b83\u4f7f\u7528\u94a9\u5b50\u51fd\u6570\uff08\u4e5f\u53ef\u4ee5\u79f0\u4e3a\u56de\u8c03\u51fd\u6570\uff09\u6765\u622a\u83b7\u7a0b\u5e8f\u6267\u884c\u7684\u5404\u79cd\u4e8b\u4ef6\uff0c\u5e76\u5728\u4e8b\u4ef6\u53d1\u751f\u524d\u6216\u540e\u8fdb\u884c\u81ea\u5b9a\u4e49\u5904\u7406\uff0c\u4ece\u800c\u63a7\u5236\u6216\u589e\u5f3a\u7a0b\u5e8f\u884c\u4e3a\u3002Hook\u6280\u672f\u5e38\u88ab\u7528\u4e8e\u7cfb\u7edf\u52a0\u901f\u3001\u529f\u80fd\u589e\u5f3a\u3001\u7b49\u9886\u57df\u3002\u672c\u7ae0\u5c06\u91cd\u70b9\u8bb2\u89e3Hook\u662f\u5982\u4f55\u5b9e\u73b0\u7684\uff0c\u5e76\u624b\u52a8\u5c01\u88c5\u5b9e\u73b0\u81ea\u5df1\u7684Hook\u6302\u94a9\u6a21\u677f\u3002<\/p> \n
\u9996\u5148\u6211\u4eec\u6765\u63a2\u7d22\u4e00\u4e0bHook\u6280\u672f\u662f\u5982\u4f55\u5b9e\u73b0\u7684\uff0c\u5982\u4e0b\u56fe\u6240\u793a\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u5f39\u7a97\u7a0b\u5e8f\uff0c\u5f53\u8bfb\u8005\u70b9\u51fb\u6d4b\u8bd5\u5f39\u7a97\u6309\u94ae\u65f6\u5219\u4f1a\u5f39\u51fa\u4e00\u4e2a <\/p> \n \u6211\u4eec\u5148\u6765\u770b\u770b\u5982\u4f55\u5b9e\u73b0Hook\u601d\u8def\uff1b<\/p> \n \u6211\u4eec\u8f7d\u5165\u5e26\u6709 <\/p> \n \u6b64\u5916\uff0c\u6211\u4eec\u8fd8\u9700\u8981\u8ba1\u7b97\u51fa\u7a0b\u5e8f\u7684\u8fd4\u56de\u5730\u5740\uff0c\u4f7f\u7528 \u7531\u4e8e\u5f00\u5934\u4f4d\u7f6e\u88ab\u66ff\u6362\u4e3a\u4e86\u6211\u4eec\u81ea\u5df1\u7684 \u901a\u8fc7\u5e94\u7528\u4e0a\u8ff0\u6848\u4f8b\u4e2d\u7684\u77e5\u8bc6\u70b9\u6211\u4eec\u80fd\u5f88\u5bb9\u6613\u7684\u5b9e\u73b0\u5bf9\u5f39\u7a97\u7684\u66ff\u6362\u529f\u80fd\uff0c\u4ee5\u4e0b\u4ee3\u7801\u4e2d\u5b9e\u73b0\u4e86\u5bf9 \u8bfb\u8005\u53ef\u901a\u8fc7\u6ce8\u5165\u8f6f\u4ef6\u5c06 <\/p> \n \u7ee7\u7eed\u8ddf\u8fdb\u5219\u8bfb\u8005\u80fd\u770b\u5230\uff0c\u5728\u8df3\u8f6c\u6307\u4ee4\u7684\u4e0b\u65b9\u5219\u662f\u6211\u4eec\u81ea\u5df1\u8865\u9f50\u7684\u6c47\u7f16\u6307\u4ee4\uff0c\u6b64\u5904\u7531\u4e8e\u6ca1\u6709\u505a\u4efb\u4f55\u4e8b\u5c31\u88ab\u8fd4\u56de\u4e86\uff0c\u8fd9\u5c31\u5bfc\u81f4\u5f53\u8bfb\u8005\u518d\u6b21\u70b9\u51fb\u5f39\u7a97\u65f6\uff0c\u5f39\u7a97\u5931\u6548\uff1b<\/p> \n <\/p> \n \u5f53\u6211\u4eec\u9700\u8981\u66ff\u6362\u7a0b\u5e8f\u6807\u9898\u65f6\u540c\u6837\u53ef\u662f\u4f7f\u7528\u8be5\u65b9\u5f0f\u5b9e\u73b0\uff0c\u4e00\u822c\u6765\u8bf4\u7a0b\u5e8f\u8bbe\u7f6e\u6807\u9898\u4f1a\u8c03\u7528MessageBox<\/code>\u63d0\u793a\u7a97\u53e3\uff0c\u672c\u6b21\u5b9e\u73b0\u76ee\u6807\u5f88\u7b80\u5355\uff0c\u901a\u8fc7\u5411\u76ee\u6807\u5185\u6ce8\u5165\u4e00\u4e2aDLL\u5e93\uff0c\u5b9e\u73b0Hook\u6302\u94a9\u4f4f
MessageBox<\/code>\u5f39\u7a97\uff0c\u4ece\u800c\u5b9e\u73b0\u53bb\u9664\u5f39\u7a97\u7684\u76ee\u7684\uff1b<\/p> \n
\n
GetModuleHandle<\/code>\u51fd\u6570\u6765\u83b7\u53d6\u5230
user32.dll<\/code>\u6a21\u5757\u7684\u57fa\u5740<\/li> \n
GetProcAddress<\/code>\u51fd\u6570\u83b7\u53d6\u5230
MessageBoxA<\/code>\u5f39\u7a97\u7684\u57fa\u5740<\/li> \n
VirtualProtect<\/code>\u6765\u4fee\u6539
MessageBoxA<\/code>\u524d5\u4e2a\u5b57\u8282\u5185\u5b58\u5c5e\u6027<\/li> \n
Dest - MsgBox - 5<\/code>\u91cd\u5b9a\u4f4d\u8df3\u8f6c\u5730\u5740\uff0c\u5e76\u5199\u5165
JMP<\/code>\u8df3\u8f6c\u6307\u4ee4<\/li> \n
Dest + Offset + 5 = MsgBox +5<\/code>\u5f97\u5230\u9700\u8981\u8df3\u8f6c\u56de
RET<\/code>\u7684\u4f4d\u7f6e<\/li> \n
VirtualProtect<\/code>\u6765\u5c06\u5185\u5b58\u5c5e\u6027\u4fee\u6539\u4e3a\u539f\u59cb\u72b6\u6001<\/li> \n <\/ul> \n
MessageBoxA<\/code>\u5f39\u7a97\u7684\u7a0b\u5e8f,\u7136\u540e\u5728
x64dbg<\/code>\u4e0a\u6309\u4e0b
Ctrl+G<\/code>\u8f93\u5165
MessageBoxA<\/code>\u627e\u5230\u6211\u4eec\u9700\u8981Hook\u7684\u4f4d\u7f6e\uff08\u6216\u8005\u8bf4\u66ff\u6362\uff09\uff0c\u5982\u4e0b\u56fe\u6240\u793a\u4e3a\u4e86\u5b8c\u6210\u5f39\u7a97\u8f6c\u5411\u529f\u80fd\uff0c\u53ea\u9700\u8981\u5728\u51fd\u6570\u5f00\u5934\u5199\u5165
jmp<\/code>\u65e0\u6761\u4ef6\u8df3\u8f6c\u6307\u4ee4\u5373\u53ef\uff0c\u572832\u4f4d\u7cfb\u7edf\u4e2d
JMP<\/code>\u6307\u4ee4\u9ed8\u8ba4\u5360\u75285\u4e2a\u5b57\u8282\uff0c\u524d\u4e09\u6761\u6307\u4ee4\u6070\u597d5\u4e2a\u5b57\u8282\uff0c\u4e3a\u4e86\u80fd\u591f\u4fdd\u6301\u5806\u6808\u5e73\u8861\uff0c\u6211\u4eec\u9700\u8981\u8bb0\u4e0b\u524d\u4e09\u6761\u6307\u4ee4\uff0c\u5e76\u5728\u81ea\u5df1\u7684\u4e2d\u8f6c\u51fd\u6570\u4e2d\u5bf9\u5176\u8fdb\u884c\u8865\u9f50\u3002<\/p> \n
0x76600BE5 - 0x76600BA0 = 0x45<\/code>\u4ece\u800c\u5f97\u51fa\u8fd4\u56de\u5730\u5740\u5c31\u662f\u57fa\u5740\u52a0\u4e0a
0x45<\/code>\uff0c\u8fd9\u91cc\u7684\u8fd4\u56de\u5730\u5740\u5176\u5b9e\u5c31\u662f\u8fd4\u56de\u5230\u539f
MessageBoxA<\/code>\u5f39\u7a97\u7684
RET 0x10<\/code>\u7684\u4f4d\u7f6e
76600BE6<\/code>\uff0c\u4ece\u8fd9\u91cc\u53ef\u4ee5\u770b\u51fa\u5c4f\u853d\u5f39\u7a97\u7684\u539f\u7406\u5c31\u662f\u901a\u8fc7\u4e2d\u8f6c\u51fd\u6570\u8df3\u8fc7\u4e86\u539f\u59cb\u5f39\u7a97\u51fd\u6570\u7684\u6267\u884c\u3002<\/p> \n
Transfer()<\/code>\u51fd\u6570\uff0c\u5f53\u7a0b\u5e8f\u4e2d\u5f39\u7a97\u88ab\u8c03\u7528\u65f6\u9ed8\u8ba4\u4f1a\u8def\u7531\u5230\u6211\u4eec\u81ea\u5df1\u7684\u51fd\u6570\u5185\uff0c\u9996\u5148\u6267\u884c\u8865\u9f50\u539f\u51fd\u6570\u7684\u66ff\u6362\u90e8\u5206\uff0c\u5e76\u6267\u884c\u81ea\u5b9a\u4e49\u529f\u80fd\u533a\u4e2d\u7684\u589e\u52a0\u5185\u5bb9\uff0c\u5f53\u6267\u884c\u7ed3\u675f\u540e\u5219\u901a\u8fc7
jmp ebx<\/code>\u7684\u65b9\u5f0f\u8df3\u8f6c\u56de\u539f\u51fd\u6570\u7684
ret 0x10<\/code>\u7684\u4f4d\u7f6e\u5904\uff0c\u4ece\u800c\u5b9e\u73b0\u589e\u52a0\u529f\u80fd\u7684\u76ee\u7684\u3002\u8fd9\u91cc\u8bfb\u8005\u9700\u8981\u6ce8\u610f
__declspec(naked)<\/code>\u7684\u610f\u601d\u662f\u4e0d\u6dfb\u52a0\u4efb\u4f55\u7684\u6c47\u7f16\u4fee\u9970\uff0c\u5f53\u4f7f\u7528\u4e86\u6b64\u4fee\u9970\u7b26\u65f6\u5219\u7f16\u8bd1\u5668\u4f1a\u53ea\u7f16\u8bd1\u6211\u4eec\u81ea\u5df1\u7684\u6c47\u7f16\u6307\u4ee4\uff0c\u5e76\u4e0d\u4f1a\u589e\u52a0\u9ed8\u8ba4\u7684\u51fd\u6570\u5f00\u573a\u6216\u79bb\u573a\u539f\u8bed\u3002<\/p> \n
__declspec(naked) void Transfer()\n{\n __asm{\n mov edi, edi\n push ebp\n mov ebp, esp\n \/\/ \u81ea\u5b9a\u4e49\u529f\u80fd\u533a\n mov ebx, jump \/\/ \u53d6\u51fa\u8df3\u8f6c\u5730\u5740\n jmp ebx \/\/ \u65e0\u6761\u4ef6\u8f6c\u5411\n }\n}\n<\/code><\/pre> \n
MessageBoxA<\/code>\u5f39\u7a97\u7684\u5c4f\u853d\u529f\u80fd\uff0c\u4e5f\u5c31\u662f\u901a\u8fc7\u8df3\u8fc7\u5f39\u7a97\u5b9e\u73b0\u6d41\u7a0b\u5b9e\u73b0\u7684\u4e00\u79cd\u52ab\u6301\u65b9\u6cd5\uff0c\u8bfb\u8005\u53ef\u81ea\u884c\u7f16\u8bd1\u8fd9\u6bb5DLL\u7a0b\u5e8f\uff0c\u4f46\u9700\u8981\u6ce8\u610f\u4e00\u70b9\uff0c\u8bfb\u8005\u5728\u7f16\u8bd1DLL\u65f6\u5e94\u8be5\u5173\u95edDLL\u7684
DEP<\/code>\u4ee5\u53ca
ASLR<\/code>\u6a21\u5f0f\uff0c\u5426\u5219\u4f1a\u51fa\u73b0\u65e0\u6cd5\u5b9a\u4f4d\u7684\u95ee\u9898\u3002<\/p> \n
#include <Windows.h>\n#include <stdio.h>\n\nDWORD jump = 0;\n\n\/\/ \u4e0d\u6dfb\u52a0\u4efb\u4f55\u7684\u6c47\u7f16\u4fee\u9970\n__declspec(naked) void Transfer()\n{\n __asm\n {\n mov edi, edi\n push ebp\n mov ebp, esp\n mov ebx, jump \/\/ \u53d6\u51fa\u8df3\u8f6c\u5730\u5740\n jmp ebx \/\/ \u65e0\u6761\u4ef6\u8f6c\u5411\n }\n}\n\n\/\/ DLL\u7a0b\u5e8f\u5165\u53e3\u5730\u5740\nbool APIENTRY DllMain(HANDLE handle, DWORD dword, LPVOID lpvoid)\n{\n \/\/ \u53d6\u8fdb\u7a0b\u5185\u6a21\u5757\u57fa\u5740\n HMODULE hwnd = GetModuleHandle(TEXT("user32.dll"));\n DWORD base = (DWORD)GetProcAddress(hwnd, "MessageBoxA");\n DWORD oldProtect = 0;\n\n \/\/ \u5c06\u5185\u5b58\u8bbe\u7f6e\u4e3a\u53ef\u8bfb\u53ef\u5199\u53ef\u6267\u884c\u72b6\u6001,\u5e76\u5c06\u539f\u5c5e\u6027\u4fdd\u5b58\u5728oldProtect\u65b9\u4fbf\u6062\u590d\n if (VirtualProtect((LPVOID)base, 5, PAGE_EXECUTE_READWRITE, &oldProtect))\n {\n DWORD value = (DWORD)Transfer - base - 5; \/\/ \u8ba1\u7b97\u51fa\u9700\u8981Hook\u7684\u5730\u5740\n jump = base + 0x45; \/\/ \u8ba1\u7b97\u51fa\u8fd4\u56de\u5730\u5740\n\n \/\/ \u66ff\u6362\u5934\u90e8\u6c47\u7f16\u4ee3\u7801\n __asm\n {\n mov eax, base\n mov byte ptr[eax], 0xe9 \/\/ e9 = jmp \u6307\u4ee4\u673a\u5668\u7801\n inc eax \/\/ \u9012\u589e\u6307\u9488\n mov ebx, value \/\/ \u9700\u8981\u8df3\u8f6c\u5230\u7684\u5730\u5740\n mov dword ptr[eax], ebx\n }\n\n \/\/ \u6062\u590d\u5185\u5b58\u7684\u539f\u59cb\u5c5e\u6027\n VirtualProtect((LPVOID)base, 5, oldProtect, &oldProtect);\n }\n return true;\n}\n<\/code><\/pre> \n
hook.dll<\/code>\u52a8\u6001\u94fe\u63a5\u5e93\u6ce8\u5165\u5230\u8fdb\u7a0b\u5185\uff0c\u6b64\u65f6\u6211\u4eec\u53ef\u4ee5\u518d\u6b21\u89c2\u5bdf
0x76600BA0<\/code>\u4f4d\u7f6e\u5904\u7684\u4ee3\u7801\u7247\u6bb5\uff0c\u8bfb\u8005\u5e94\u8be5\u80fd\u770b\u5230\u5df2\u7ecf\u88abJMP\u66ff\u6362\uff0c\u5982\u4e0b\u56fe\u6240\u793a\uff1b<\/p> \n
SetWindowTextA<\/code>\u51fd\u6570\uff0c\u6211\u4eec\u53ef\u4ee5\u62e6\u622a\u8fd9\u4e2a\u51fd\u6570\uff0c\u5e76\u4f20\u5165\u81ea\u5b9a\u4e49\u7684\u7a97\u53e3\u540d\u79f0\uff0c\u4ece\u800c\u5b9e\u73b0\u4fee\u6539\u6307\u5b9a\u7a97\u53e3\u7684\u6807\u9898\u7684\u76ee\u7684\uff0c\u4ee3\u7801\u53ea\u662f\u5728\u4e0a\u9762\u4ee3\u7801\u7684\u57fa\u7840\u4e0a\u7a0d\u5fae\u6539\u4e00\u4e0b\u5c31\u80fd\u5b9e\u73b0\u6548\u679c\uff0c\u53ea\u8981\u7a0b\u5e8f\u4f7f\u7528\u4e86\u8be5\u51fd\u6570\u8bbe\u7f6e\u6807\u9898\uff0c\u5219\u53ef\u4ee5\u5b9e\u73b0\u66ff\u6362\u7684\u76ee\u7684\uff1b<\/p> \n
#include <Windows.h>\n#include <stdio.h>\n\nDWORD jump = 0;\n\n\/\/ \u6c47\u7f16\u4e2d\u8f6c\u51fd\u6570\n__declspec(naked) bool _stdcall Transfer(HWND hwnd, LPCSTR lpString)\n{\n __asm\n {\n mov edi, edi\n push ebp\n mov ebp, esp\n mov ebx, jump\n jmp ebx\n }\n}\n\n\/\/ \u81ea\u5df1\u7684\u8bbe\u7f6e\u7a97\u4f53\u6807\u9898\u51fd\u6570\nbool __stdcall MySetWindowTextA(HWND hwnd, LPCSTR lpString)\n{\n char * lpText = "LyShark \u4fee\u6539\u7248";\n return Transfer(hwnd, lpText);\n}\n\n\/\/ DLL\u7a0b\u5e8f\u5165\u53e3\u5730\u5740\nbool APIENTRY DllMain(HANDLE handle, DWORD dword, LPVOID lpvoid)\n{\n HMODULE hwnd = GetModuleHandle(TEXT("user32.dll"));\n DWORD base = (DWORD)GetPr","orderid":"0","title":"4.1 \u5e94\u7528\u5c42Hook\u6302\u94a9\u539f\u7406\u5206\u6790(\u4e00)","smalltitle":"","mid":"0","fname":"c++\u7f16\u7a0b\u57fa\u7840","special_id":"0","bak_id":"0","info":"0","hits":"636","pages":"2","comments":"0","posttime":"2023-09-23 15:44:04","list":"1695455044","username":"admin","author":"","copyfrom":"","copyfromurl":"","titlecolor":"","fonttype":"0","titleicon":"0","picurl":"https:\/\/www.cppentry.com\/upload_files\/","ispic":"0","yz":"1","yzer":"","yztime":"0","levels":"0","levelstime":"0","keywords":"4.1<\/A> \u5e94\u7528\u5c42<\/A> Hook<\/A>","jumpurl":"","iframeurl":"","style":"","template":"a:3:{s:4:\"head\";s:0:\"\";s:4:\"foot\";s:0:\"\";s:8:\"bencandy\";s:0:\"\";}","target":"0","ip":"112.94.1.100","lastfid":"0","money":"0","buyuser":"","passwd":"","allowdown":"","allowview":"","editer":"","edittime":"0","begintime":"0","endtime":"0","description":"4.1 \u5e94\u7528\u5c42Hook\u6302\u94a9\u539f\u7406\u5206\u6790","lastview":"1714942105","digg_num":"622","digg_time":"1714870815","forbidcomment":"0","ifvote":"0","heart":"","htmlname":"","city_id":"0"},"page":"1"}