Windows, Linux hijacking technology

Windows systems can take advantage of detours hijacking

Realse mode hijacking, debugging the program can not

The effect that function hijacking can achieve.

The principle of the hijacking of functions

How we achieve-detours

Detours is an information security product produced by Microsoft Research Asia and is mainly used for hijacking.

Detours changes the behavior of the function according to the function pointer,

Intercept any function even if the operating system functions.

1. Installing Detours

2. Build library file-nmake compile

3. Include header files and library files

#include <detours.h>

#pragma comment (lib, "Detours.lib")

4.

Define the old function pointer pointing to the original function

static int (WINAPI *OLD_MESSAGEBOXW) (HWND hwnd, LPCSTR Lptext, LPCSTR lpaptioin, UINT utype) = MessageBoxW;

Defining a new function

int WINAPI New_messgebox (HWND hwnd, LPCSTR Lptext, LPCSTR lpcaptioin, UINT utype)

{

Redefining the behavior of a function

Null to suppress function use

Plus if else can limit the invocation of a function

Add a dialog box to restrict the same or disagree

if (Idyes = = MessageBoxW (NULL, lpCommandLine, L "Intercept succeeded!", Mb_yesno))

return 1;

Else

return FALSE;

return ret;

}

5.

Start interception

void Hook ()

{

Detourrestoreafterwith ();//revert to its original state

Detourtransactionbegin ();//Intercept started

Detourupdatethread (GetCurrentThread ());//Refresh Current thread

You can call Detourattach several times in a row, indicating that the hook functions

Detourattach (void * *) &old_messagebox, new_messagebox);//Implement function interception

Detourtransactioncommit ();//interception takes effect

}

Cancel Intercept

void Unhook ()

{

Detourtransactionbegin ();//Intercept started

Detourupdatethread (GetCurrentThread ());//Refresh Current thread

You can call Detourdetach several times in a row, indicating that multiple function hooks are undone

Detourdetach (void * *) &old_messagebox, new_messagebox);//Implement function interception

Detourtransactioncommit ();//interception takes effect

}

6. Modify yourself, directly hook up the function can be

modifying external programs

Need to be injected as a module, need to export the declaration

__declspec (dllexport)

Hijack the system function

#include <stdio.h> #include <stdlib.h> #include <Windows.h> #include <string.h> #include " Detours.h "#pragma comment (lib," Detours.lib ")//Hijack yourself static int (*poldsystem) (const char * _command) =system;// Store function pointer address int  newsystem (const char * _command) {//tasklistprintf ("%s", _command);//forbid you to work return 0;} int  Newsystema (const char * _command) {//tasklist   filter char *p = STRSTR (_command, "tasklist"); if (p = = NULL) { Poldsystem (_command);} else{printf ("%s Forbidden", _command);//Find return 0;} return 0;} Start intercepting void Hook () {detourrestoreafterwith ();//revert to original state detourtransactionbegin ();//intercept starts Detourupdatethread ( GetCurrentThread ());//Refresh the current thread//The Detourattach can be called several times in a row, indicating that the hook functions detourattach (void * *) &poldsystem, Newsystema );//Implement function intercept Detourtransactioncommit ();//Intercept effective}void main () {System ("calc"); Hook (); System ("Calc"); System ("tasklist"); GetChar ();}

Written into DLL files, injected into other programs, enabling the hijacking of other applications, to achieve the effect of filtering. If you pay a protection fee, you can not hijack your program. Implement the wretched technology.

#include <stdio.h> #include <stdlib.h> #include <Windows.h> #include <string.h> #include " Detours.h "#pragma comment (lib," Detours.lib ") static int (*poldsystem) (const char * _command) = system;//store function pointer address int  Newsystem (const char * _command) {//tasklistprintf ("%s", _command);//forbid you to work return 0;} Start intercepting void Hook () {detourrestoreafterwith ();//revert to original state detourtransactionbegin ();//intercept starts Detourupdatethread ( GetCurrentThread ());//Refresh the current thread//The Detourattach can be called several times in a row, indicating that the hook functions Detourattach ((void *) &poldsystem, Newsystem) ;//Implement function intercept Detourtransactioncommit ();//intercept effective}//export function, can be loaded when calling _declspec (dllexport) void  Go () {messageboxa (0, "1", "2", 0); Hook ();}

The CREATEPROCESSW function is used to create a process.

#include <stdio.h> #include <stdlib.h> #include <windows.h>void main1 () {//system ("calc");// Shellexecutea (0, "open", "Calc", 0, 0, 1); Startupinfo si = {sizeof (SI)}; Start Information process_information pi;//Save the process information si.dwflags = Startf_useshowwindow; Represents the display window Si.wshowwindow = 1; 1 represents the window that displays the created process wchar_t cmdline[] = L "C://program files//internet explorer//iexplore.exe"; CREATEPROCESSW (NULL, cmdline, NULL, NULL, 0, create_new_console, NULL, NULL, &SI, &PI);//Create Process}

in the Windows platform can use hook technology, the system of mouse, keyboard and other events to intercept, to add the implementation of their own functions. Similarly, there are similar techniques in Linux systems that can be used to intercept hooks. The ability to intercept can be achieved. Interception technology is implemented through the environment variable Ld_preload set priority loader loaded dynamic Library (hereinafter referred to as Block dynamic library), here should be set ld_preload= "xxx.so"

Example:

/* File name: VERIFYPASSWD.C *//* This is a procedure for judging the user's password, which uses the standard C function strcmp*/#include <stdio.h> #include <string.h> int Main (int argc, char **argv) {char passwd[] = "Password", if (ARGC < 2) {printf ("Usage:%s <password>\n", argv[0]); return;} if (!strcmp (passwd, argv[1])) {printf ("Correct password!\n"); return;} printf ("Invalid password!\n");}

Compile the program:

$ gcc-o verifypasswd VERIFYPASSWD.C

Test the program: (Get the right result)

$./VERIFYPASSWD ASDF

Invalid password!

In the above procedure, we use the STRCMP function to determine whether the two strings are equal. Below, we use a dynamic function library to overload the STRCMP function:

#include <stdio.h>int strcmp (const char *S1, const char *s2) {        printf ("Hack function invoked. S1=<%s> s2=<%s>\n ", S1, S2);        /* Returns 0 forever, representing two strings equal */        return 0;}

Compile the program:

$ gcc-shared-o hack.so hack.c

Set the Ld_preload variable: (The hack.so of the strcmp function that we have rewritten becomes the precedence loading link library)

$ export ld_preload= "./hack.so"

Run the program again:

$./VERIFYPASSWD ASDF

Hack function invoked. S1=<password> s2=<asdf>

Correct password!

Windows, Linux hijacking technology