Question

我正在尝试使用EasyHook来检测本地LoadLibrary调用。

它确实检测到库的加载，但是该过程导致冻结。这是因为下面的 LoadLibrary_Hook 方法无法加载dll或库，因为它返回0 IntPtr （可能找不到该库。）。

我什至尝试将事件设置为“ void”类型，但随后过程崩溃，这可能是因为EasyHook希望我返回一个值来覆盖函数。

我是否可以通过某种方式返回完全需要加载的库，或者只是获得要加载的库的名称而无需手动加载该库？

（此过程中也正在加载类似这样的名称：瑮汤⹬汤l逦逦仇嗿謘ౕ㍓四襗ﱝ嶉觬嶉觰嶉㯨࿓ﾄă谋ࡅ쌻萏Ͽ oddă㬀瓋謇ᡅᦉᢉ綋㬜有点奇怪...）

private static LocalHook hook;

[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
public static extern IntPtr GetModuleHandle(string lpModuleName);

[DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
public static extern IntPtr LoadLibrary(string lpFileName);

[DllImport("kernel32.dll", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)]
public static extern IntPtr GetProcAddress(IntPtr handle, string varormethodname);

[UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
public delegate IntPtr LoadLibraryDelegate(string lpFileName);

public TestHook()
{
    IntPtr kernel32 = GetModuleHandle("kernel32.dll");
    Logger.Log("Kernel: " + kernel32);
    IntPtr address = GetProcAddress(kernel32, "LoadLibraryA");
    Logger.Log("Address: " + address);

    hook = LocalHook.Create(address,
    new LoadLibraryDelegate(LoadLibrary_Hook),
    null);
    hook.ThreadACL.SetExclusiveACL(new Int32[] {0});

    //RemoteHooking.WakeUpProcess();
}


public IntPtr LoadLibrary_Hook(string lpFileName)
{
    Logger.Log("File load: " + lpFileName);
    return LoadLibrary(lpFileName);
}

Answer 1

解决方案是使用原始函数地址调用原始方法：

public IntPtr LoadLibrary_Hook(string lpFileName)
{
    Logger.Log("File load: " + lpFileName);
    LoadLibraryDelegate origMethod = (LoadLibraryDelegate)Marshal.GetDelegateForFunctionPointer(LoadLibraryAddress, typeof(LoadLibraryDelegate));
    return origMethod(lpFileName);
}

EasyHook LoadLibrary崩溃失败

1 个答案: