Process Hacker源码中的用户态hook的做法

柔情只为你懂 2021-12-17 07:07 168阅读 0赞

processhacker-code-5632\\1.x\\trunk\\NProcessHacker\\hook.h

typedef struct _PH_HOOK
    {
        PVOID Function;
        PVOID Target;
        BOOLEAN Hooked;
        CHAR Bytes[5];
    } PH_HOOK, *PPH_HOOK;

这个结构体用来保存每个Hook的信息，Function是hook点的地址， Target是Trampoline的地址，Bytes用来备份Function点处原来的5个字节。

processhacker-code-5632\\1.x\\trunk\\NProcessHacker\\hook.c

VOID PHAPI PhInitializeHook(
        PPH_HOOK Hook,
        PVOID Function,
        PVOID Target
        )
    {
        memset(Hook, 0, sizeof(PH_HOOK));
        Hook->Function = Function;
        Hook->Target = Target;
    }

初始化Hook结构体，指定hook点与Trampoline的地址。

NTSTATUS PHAPI PhHook(
        PPH_HOOK Hook
        )
    {
        NTSTATUS status = STATUS_SUCCESS;
        ULONG oldProtection;
        PCHAR function;
    
        /* Change the page protection of the target page so we can write to it. */
        if (!VirtualProtect(Hook->Function, 5, PAGE_EXECUTE_READWRITE, &oldProtection))
            return STATUS_ACCESS_VIOLATION;
    
        __try
        {
            function = (PCHAR)Hook->Function;
            /* Copy the original five bytes for unhooking. */
            memcpy(Hook->Bytes, function, 5);
            /* Hook the function by writing a jump instruction. */
            Hook->Hooked = TRUE;
            /* jmp Target */
            *function = 0xe9;
            *(PULONG_PTR)(function + 1) = (ULONG_PTR)Hook->Target - (ULONG_PTR)Hook->Function - 5;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            status = GetExceptionCode();
        }
    
        /* Restore the old page protection. */
        VirtualProtect(Hook->Function, 5, oldProtection, NULL);
    
        return status;
    }

用于完成对Hook点的5个字节的替换，替换成e9 XXXXXXXX\[Trampoline与Hook点之间的偏移距离\]。

NTSTATUS PHAPI PhUnhook(
        PPH_HOOK Hook
        )
    {
        NTSTATUS status = STATUS_SUCCESS;
        ULONG oldProtection;
    
        /* Change the page protection of the target page so we can write to it. */
        if (!VirtualProtect(Hook->Function, 5, PAGE_EXECUTE_READWRITE, &oldProtection))
            return STATUS_ACCESS_VIOLATION;
    
        __try
        {
            /* Unpatch the function by restoring the original first 5 bytes. */
            memcpy(Hook->Function, Hook->Bytes, 5);
            Hook->Hooked = FALSE;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            status = GetExceptionCode();
        }
    
        /* Restore the old page protection. */
        VirtualProtect(Hook->Function, 5, oldProtection, NULL);
    
        return status;
    }

Unhook的过程恰好相反，用备份的5个字节恢复Hook点。

转载于:https://www.cnblogs.com/long123king/p/3781775.html