IAT Hook

  • IAT Hook 工作原理

    IAT Hook是通过修改IAT中保存的API地址来钩取某个API函数。

     

    在进程中调用某个API函数，是在目标进程中的导入表中查找函数地址来进行调用，不同于GetProcAddress函数。此函数是在模块的导出表中进行查找函数地址的。

     

    所以我们可以注入动态库到目标进程，来实现对目标API的钩取。关于动态库的注入可以参考其他博文。

  • 代码实现 
      1 // include
  2 #include "stdio.h"
  3 #include "wchar.h"
  4 #include "windows.h"
  5 
  6 
  7 // typedef
  8 typedef BOOL (WINAPI *PFSETWINDOWTEXTW)(HWND hWnd, LPWSTR lpString);
  9 
 10 
 11 
 12 FARPROC OldFunction = NULL;
 13 
 14 
 15 // 修改后再显示
 16 BOOL WINAPI MySetWindowTextW(HWND hWnd, LPWSTR lpString)
 17 {
 18     wchar_t* pNum = L"康老捞伙荤坷腊磨迫备"; 
 19     wchar_t temp[2] = {0,};
 20     int i = 0, nLen = 0, nIndex = 0;
 21 
 22     nLen = wcslen(lpString);
 23     for(i = 0; i < nLen; i++)
 24     {
 25         
 26         if( L'0' <= lpString[i] && lpString[i] <= L'9' )
 27         {
 28             temp[0] = lpString[i];
 29             nIndex = _wtoi(temp);
 30             lpString[i] = pNum[nIndex];
 31         }
 32     }
 33 
 34    
 35     return ((PFSETWINDOWTEXTW)OldFunction)(hWnd, lpString);
 36 }
 37 
 38 
 39 // hook_iat
 40 //   泅犁 橇肺技胶狼 IAT 甫 八祸秦辑
 41 //   pfnOrg 蔼阑 pfnNew 蔼栏肺 函版矫糯
 42 BOOL HOOKIAT(LPCSTR szDllName, PROC OldFunction, PROC NewFunction)
 43 {
 44     HMODULE ModuleHandle;
 45     LPCSTR szLibName;
 46     PIMAGE_IMPORT_DESCRIPTOR pImportDesc; 
 47     PIMAGE_THUNK_DATA pThunk;
 48     DWORD dwOldProtect, dwRVA;
 49     PBYTE AddressOfImage;
 50 
 51     // DOSHeader
 52     ModuleHandle = GetModuleHandle(NULL);
 53     AddressOfImage = (PBYTE)ModuleHandle;
 54 
 55     // AddressOfImage = VA to PE signature (IMAGE_NT_HEADERS)
 56     AddressOfImage += *((DWORD*)&AddressOfImage[0x3C]);
 57 
 58     // dwRVA = RVA to IMAGE_IMPORT_DESCRIPTOR Table
 59     dwRVA = *((DWORD*)&AddressOfImage[0x80]);
 60 
 61     // pImportDesc = VA to IMAGE_IMPORT_DESCRIPTOR Table
 62     pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)ModuleHandle +dwRVA);
 63 
 64     for( ; pImportDesc->Name; pImportDesc++ )
 65     {
 66         // szLibName = VA to IMAGE_IMPORT_DESCRIPTOR.Name
 67         szLibName = (LPCSTR)((DWORD)ModuleHandle + pImportDesc->Name);
 68         if( !_stricmp(szLibName, szDllName) )
 69         {
 70             // pThunk = IMAGE_IMPORT_DESCRIPTOR.FirstThunk
 71             //        = VA to IAT(Import Address Table)
 72             pThunk = (PIMAGE_THUNK_DATA)((DWORD)ModuleHandle +
 73                                          pImportDesc->FirstThunk);
 74 
 75             // pThunk->u1.Function API函数的虚拟地址
 76             for( ; pThunk->u1.Function; pThunk++ )
 77             {
 78                 if( pThunk->u1.Function == (DWORD)OldFunction)
 79                 {
 80                     // 修改内存页为可读可写可执行
 81                     VirtualProtect((LPVOID)&pThunk->u1.Function, 
 82                                    4, 
 83                                    PAGE_EXECUTE_READWRITE, 
 84                                    &dwOldProtect);
 85 
 86                     // 修改函数地址
 87                     pThunk->u1.Function = (DWORD)NewFunction;
 88                 
 89                     VirtualProtect((LPVOID)&pThunk->u1.Function, 
 90                                    4, 
 91                                    dwOldProtect, 
 92                                    &dwOldProtect);                        
 93 
 94                     return TRUE;
 95                 }
 96             }
 97         }
 98     }
 99 
100     return FALSE;
101 }
102 
103 
104 
105 BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
106 {
107     switch( fdwReason )
108     {
109         case DLL_PROCESS_ATTACH : 
110           
111                OldFunction = GetProcAddress(GetModuleHandle(L"user32.dll"), 
112                                         "SetWindowTextW");
113 
114             //HOOK
115             HOOKIAT("user32.dll", OldFunction, (PROC)MySetWindowTextW);
116             break;
117 
118         case DLL_PROCESS_DETACH :
119             //UNHOOK
120             HOOKIAT("user32.dll", (PROC)MySetWindowTextW, OldFunction);
121             break;
122     }
123 
124     return TRUE;
125 }

    参考《逆向工程核心原理》

 

posted @ 2017-04-11 21:00  _小北  阅读(1605)  评论(0)  编辑  收藏  举报