WIN32 program hooks SetLastError, output error description to console

WIN32 program hooks SetLastError, output error description to console

Su Lingfu

One, the window mode application (GUI) to enable the console method is :

Steps	Method
1 Start/Close the console	AllocConsole () Freeconsole ()
2 redirect input/output	Freopen ("conin$", "R", stdin) Freopen ("conout$", "w", stdout) Freopen ("conout$", "W", stderr)
3 Console input/output	#include <conio.h> #include <stdio.h> printf (...) scanf (...) System ("Pause")

Two, the simple way to hook API functions is:

1. In debug mode, the function name value is the address of the instruction "jmp function body". The instruction format is "e9----" and the accompanying parameter is a four-byte transfer offset. Therefore "function name Value + * (dword*) ((DWORD) function name value + 1)" is the function body entry address. The function "Use go to Disassembly" calculates the function body entry stack instruction length, obtains the actual entry address as "function name Value + * (dword*) ((DWORD) function name value + 1) + Entry stack instruction length";

2. In release mode, the function name value is directly the entry address of the function body. Use the "Go To Disassembly" function to calculate the function body in addition to the exit instruction length, the function exit address is "function name + instruction Length", the API function is this mode;

3. Use ":: WriteProcessMemory (:: GetCurrentProcess (), API function exit address ...) " Method hooks The following call on the API function:

Serial number	Description	Instructions	Parameter values
1	Call hook function	e8----	hook function Body Actual entry address
2	Exit	c2--	function parameter total length, used to restore the state of the stack

Third, Hook API function SetLastError, and output error description to the console example

#include <stdio.h> #include <windows.h>void hook_setlasterror ()//For the stack operation when the hook function is simplified, the hook function has no parameters and return values.  {if (:: GetLastError ()) {lpvoid lpmsgbuf = 0; if (:: FormatMessage (Format_message_from_system |        Format_message_allocate_buffer | Format_message_ignore_inserts, 0,:: GetLastError (), Lang_user_default, (LPTSTR) &lpmsgbuf, 0, 0) {::p rintf   ("ERROR:%d%s",:: GetLastError (), (LPCSTR) lpmsgbuf);  :: LocalFree (LPMSGBUF); }}}int __stdcall WinMain (hinstance, HINSTANCE, LPSTR, int) {unsigned char setup_setlasterror[8] = {0xe8, 0, 0, 0, 0, 0xC 2, 4, 0}; #ifdef _DEBUG * (unsigned int*) (setup_setlasterror + 1) = (unsigned int) hook_setlasterror + * (unsigned int*) (uns igned char*) Hook_setlasterror + 1)-(unsigned int) SetLastError-18; #else * (unsigned int*) (setup_setlasterror + 1) = (UN Signed int) Hook_setlasterror-(unsigned int) SetLastError-23; #endif:: WriteProcessMemory (:: GetCurrentProcess (), (L PVOID) ((unsigned int):: SetLastError +), Setup_setlasterror,8, new size_t);  :: AllocConsole ();  :: Freopen ("conin$", "R", stdin);  :: Freopen ("conout$", "w", stdout); Add your own code here:: WriteProcessMemory (:: GetCurrentProcess (), (LPVOID) ((unsigned int):: SetLastError +), Setup_setlast  Error + 5, 3, new size_t);  :: System ("pause"); return 0;}

(End of full text)

http://blog.csdn.net/jiangxinyu/article/details/5386000

WIN32 program hooks SetLastError, output error description to console