Reverse practical dry-sharing, hook technology first, the hook Windows API

Reverse practical dry-sharing, hook technology first, the hook Windows API

Ibinary
Source: http://www.cnblogs.com/iBinary/
All rights reserved, welcome to keep the original link to reprint:)

What is a hook and what is a hook capable of?

First, this small title mainly introduces the god horse is hook, if know, then do not see.

Here I sneak up ah lazy, put the hook meaning Https://baike.baidu.com/item/%E9%92%A9%E5%AD%90%E7%A8%8B%E5%BA%8F

Hook, the English word to become hooks, the meaning of the hook, in our programming is the meaning of the hook

We're going to hookapi this API to hook it up, let it execute our code, and then execute our code after executing the code in the API, and of course execution does not give us the final say.

Second, the principle of hook API, and ideas

Now we need to know how we hook the API

Assuming that our program is now calling a MessageBox function, then we hook the API into our API to execute, execute our code and then execute its function.

See our Sketches for details:

Actually the equivalent is we in this API, jump to our function execution, and then jump, after we have finished, you can choose whether to jump back, but here notice, jump back to the MSG return position can be.

EAX can give a value and let it return.

Using this technology, we can monitor the API, such as the application will call LoadLibrary, then we hook it, the DLL path to our, that load is our DLL, of course, Hook API a lot, because as long as the Windows API can hook

Because jmp takes up five bytes, and WindowsAPI also has five bytes in the head, it may be that Windows itself is left to hook.

Three, Hook of the steps (Hook yourself)

First step

/* idea:    We're going to get MessageBoxA's function address before we get to the next few steps 1. Call Getmodulehandlle to get the base address of the DLL module (user32.dll) 2. Through the base site, Call GetProcAddress to get MSG's function address 3. Modify the protection properties of the MSG function address and call VIRTUALPROTECT4. Reposition the jump address Dest-msgcode = offset-5     jmp Jump to this offset can be 5. Dest + offset + 5 = msgcode +5 position when jumping back * *

See above, very faint, step by step code implementation.

Note: Here is just a simple implementation, and the next idea, the code copied past you can not run, because for example, I write offset g_szuser32 ... Wait a minute,

It is all defined in. const, and the complete code is posted at the bottom, so it can be run.

The first step, get the address of MSG, first call GetModuleHandle

; 1. Obtain the address of MSG, first call Getmoudulhandle    Invoke Getmodulehandle,offset G_szuser32; Get module address
mov @hUserHand, eax; return value to local variable save
Where G_szuser32 is the user32.dll string in the constant area

Step two: Get the address of the MSG function through the module address

invoke GetProcAddress, @hUserHand, offset g_szmsgname mov @MsgProcAddrs, eax
; code ibid.

Step three: Modify the memory protection properties of the MSG function address for a second we'll write the binary in jmp and modify it.

Invoke VirtualProtect, @MsgProcAddrs, 1000h,page_execute_readwrite,addr @hOldProtect
The modified size is 1000 (4096) bytes
Permissions are readable writable    executables
Whether to save the old permission attribute: Yes, this must be saved, but the API will fail if you don't use it
There is, because to save the previous, so we have to give him the address, to add addr can

Fourth step: OD view msg location, looking for 5 byte position

This time we can write an int 3 in our code, the OD will break when opened, we break the breakpoint in the GetProcAddress position,

Look at what the address of the MSG gets to

We follow the location of the MSG in the Disassembly window.

Can see the location, just five bytes, mov edi,edi is useless instruction, but Windows still retains the

In other words, it may be left to monitor the API for yourself. So this time we can write in this position,

JMP instructions in jmp our API location

If we jump to the location of our API, execute the code in front of the three or this, because we have to jump to the current MSG + 5

, and (of course, you can jump to the return position of MSG)

Fifth step: Write jmp,jmp to the location of our function

First we know that jmp binary is E9

So we're going to E9 xxxxxx xxx to make the address of our function

But in jmp, this place is an offset.

So we're going to have to relocate the address in jmp to the offset of our function.

How to reposition, very simple, elementary math

Calculates the position of the next execution of the MSG

Code + offset = dest The next position of the current MSG is calculated with 7595FDAE + 5 = 7595fdb3 is also exactly where we jump back.

Calculate jump to our function address

Dest-code = Offset Destination Address We know, is our function address, start to jump address also know, so bring into the band

Our function address-Code (the current msg address) = offset offsets, then the JMP offset.

Define our functions.

The function is written as follows

The contents of the bottom label are in JMP 00000000 where this address is the one we want to reposition.

Sixth step: Implementing code, writing to JMP

From here, I write the implementation code directly.

movEAX, @MsgProcAddrs;Code    movEbx,newmsgbox;dest    SubEbx,eax;Dest-code = offset    SubEbx5                   ;the offset required-5, don't forget that jmp accounts for five bytes, so that you can jump to your address execution    mov[Eax],byte ptr 0e9h;writing to JMP    mov[Eax +1],ebx;write to the address of the jump

First get the MSG location, which is code

And then get the position of your own function, which is dest

Now we're asking for the middle offset, how much Dest-code = Offset

Then because JMP jumps to take up five bytes, so then-5 byte size

Now we're going to change the location of the MSG function to JMP, we're going to jmp our address and we'll look at the OD analysis

1. First find the MSG function location, look at the data window followed

2. Step away, then execute to the first address that changes the binary to e9h

Now let's go through the Disassembly window and look at the address of the MSG to see if it's changed to JMP.

Now it's the jmp, but the offsets are wrong, but our offsets have been calculated, so write to E9 behind

3. Modify the offset OD view.

, see MSG in the Disassembly window

And now the show doesn't know whether it's right then we're going to the disassembly window to see 00401000 is not our newmsg location

As you can see, the code is exactly what we wrote.

Also happens to be the location of jmp 000000000, then we can write in our code, hijack the execution of the real MsgBox function

We know, because it's from jmp, so ebp-c is the second parameter of MSG, and we've changed the contents.

Note that this is written inside the hijacking code.

Four, we also have to change the location of the jump back, this is the same

Look at the code:

  invoke virtualprotect,label1,1000h,page_execute_readwrite,addr @hOldProtect  mov  eax,offset label1 ;     code The address we want to modify is the address of the label, so he is the code  mov  ebx, @MsgProcAddrs ;     dest we want to jump to the address of MSG, so he is dest  sub  ebx,eax ;     dest-code = offset into the formula I get the EBX is offsets  mov  [eax +1 ],ebx ;  eax designator +1, that is, JMP 00 00 00 00 writes 00 00 00 00 As offset, I jump back to the location of MSG continue execution  invoke MessageBox A,null,offset G_SZMSGTITLE,NULL,MB_OK 

First, we want to modify the position of the jump position is the label 1, so he is code

Second, we're going to jump to where, so he's dest

Thirdly, according to the formula, Dest-code = Offset

Finally, we shifted the position of Dset +1, that is, JMP 00 00 00 00, and I jumped back.

Take a look at the OD analysis

Look at the OD, we can also see, we step away, step to MOV DWORD Ptr[eax +0x1] position, see if the offset of the label 1 modified

In memory we have seen that our offsets have been modified.

So our disassembly window looks at the current location of our API, which is jmp 00 00 00 00.

As you can see, it's really changed, so let's look at the address behind JMP

Just so that we call MsgBox position +5 below, that is, above jmp to our API executed, below I jump back through jmp, at this time because we have saved the bottom environment, so the operation is no error

Look under no debugging, normal operation

Through Hook technology, we put the original should be output Hello to see the snow, become our own desired string.

Because the code is RADASM Engineering, so here packaging sent to Baidu Cloud disk

Link: http://pan.baidu.com/s/1kVBWalp Password: luz8

Ibinary
Source: http://www.cnblogs.com/iBinary/
All rights reserved, welcome to keep the original link to reprint:)

If you feel good, please recommend, add attention, if you feel bad, please criticize correct. Thank you. If you do not understand, please comment on the point of motivation, in fact, the most important thing to write blog is their own finishing, every day adhere to. Give the best to everyone.

Reverse practical dry-sharing, hook technology first, the hook Windows API