Question

背景

我正在开发一种遗留产品，它可以通过注入dll成功拦截一个注入过程试图进入任意dll的任意方法调用。特别是gdi32.dll库。不幸的是，它嵌入64位应用程序时不起作用。它成为一个热门按钮主题，现在是升级其功能的时候了。同样不幸的是，源代码是一堆不好的评论（典型的＆gt;： - ＆lt;），从它的外观来看，写这篇文章的人对x86指令集非常熟悉。多年来我一直没有参与组装，当我这样做的时候是摩托罗拉组装。

在浏览互联网后，我遇到了一位英特尔员工的this文章。如果我们的源代码没有在本文前约7年，那么我会说这正是我们的NoComments先生开发人员学会了执行API方法拦截的地方。这就是程序的相似之处。这篇文章也总结为一个很好的pdf（Intercepting System API calls），也可以从上述网站链接。

问题

我想真正理解英特尔网页链接中提供的示例，以便我可以很好地为64位方案创建解决方案。它有很好的文档记录，对我来说更容易理解。以下是InterceptAPI（）例程的摘录。我添加了自己的评论“//＃”（原始评论以标准“//”标注），在那里我解释了我认为我知道的内容而我不知道的是：

BOOL InterceptAPI(HMODULE hLocalModule, const char* c_szDllName,
    const char* c_szApiName, DWORD dwReplaced, DWORD dwTrampoline, int offset) 
{ 
    //# Just a foreword.  One of the bigger mysteries of this routine to me is
    //# this magical number 5 and the offset variable.  Now I'm assuming, that
    //# there are 5 bytes at the beginning of every method that are basically 
    //# there to set up some sort of pre-method-jump context switch, since its
    //# about to leave the current method and jump to another.  So I'm guessing
    //# that for all scenarios, the minimum number of bytes is 5, but for some
    //# there may be more than 5 bytes so that's what the "offset" variable is
    //# for. In the aforementioned article, the author writes "One additional 
    //# complication exists, in that the sixth byte of the original code may be
    //# part of the previous instruction. In that case, the function overwrites
    //# part of the previous instruction and then crashes."  So some method
    //# starting code contains multi-byte opcodes while others don't apparently.
    //# And if you don't know the instruction set well enough, I'm guessing
    //# you'll just have to figure it out by trial and error.
    int i; 
    DWORD dwOldProtect;

    //# Fetching the address of the method that we want to capture and reroute
    //# Example: c_szDllName="user32",   c_szApiName="SelectObject"
    DWORD dwAddressToIntercept = (DWORD)GetProcAddress( 
        GetModuleHandle((char*)c_szDllName), (char*)c_szApiName); 


    //# Storing address of method we are about to intercept in another variable
    BYTE *pbTargetCode = (BYTE *) dwAddressToIntercept;

    //# Storing address of method we are going to use to take the place of the 
    //# intercepted method in another variable.
    BYTE *pbReplaced = (BYTE *) dwReplaced; 

    //# "Trampoline" appears to be a "Microsoft Detours" term, but its basically
    //# a pointer so that we can get to the original "implementation" of the method
    //# we are intercepting.  Most of the time your replacement function will
    //# want to call the original function so this is pretty important.  What its
    //# pointing to must already be pre allocated by the caller.  The author of
    //# the aforementioned article states "Prepare a dummy function that has the
    //# same declaration that will be used as the trampoline. Make sure the dummy
    //# function is more than 10 bytes long." I believe I'd prefer allocating this
    //# memory within this function itself just to make using this InterceptAPI()
    //# method easier, but this is the implementation as it stands.
    BYTE *pbTrampoline = (BYTE *) dwTrampoline; 


    // Change the protection of the trampoline region 
    // so that we can overwrite the first 5 + offset bytes.
    //# This is voodoo magic to me, but I'm guessing you just can't hop on the
    //# stack and start changing execute instructions without ringing some
    //# alarms, so this makes sure the alarms don't ring. Here we are allowing
    //# permissions so we can change the bytes at the beginning of our
    //# trampoline method.
    VirtualProtect((void *) dwTrampoline, 5+offset, PAGE_WRITECOPY, &dwOldProtect); 

    //# More voodoo magic to me, but this appears to be a way to copy over extra
    //# opcodes that may be needed.  Some opcodes are multi byte I believe so this
    //# is where you can make sure you don't miss them.
    for (i=0;i<offset;i++) 
        *pbTrampoline++ = *pbTargetCode++; 

    //# Resetting the pbTargetCode pointer since it was modified it in the above
    //# for loop.
    pbTargetCode = (BYTE *) dwAddressToIntercept; 


    // Insert unconditional jump in the trampoline.
    //# This is pretty understandable.  0xE9 the x86 JMP command.  I looked
    //# this up in Intel's documentation and it can be followed by a 16-bit
    //# offset or a 32-bit offset. The 16-bit version is not supported in 64-bit
    //# architecture but lets just hope they are all 32-bit and that this does
    //# indeed do what it is intended in 64-bit scenarios
    *pbTrampoline++ = 0xE9;        // jump rel32 

    //# So basically here it looks like we are following up our jump command with
    //# the address its supposed to jump too.  This is a relative offset, that's why
    //# we are subtracting pbTargetCode and pbTrampoline.  Also, since JMP opcodes
    //# jump relative to the address AFTER the jump address, that's why we are
    //# adding 4 to pbTrampoline.  Also, offset is added to pbTargetCode because we
    //# advanced the pointers in the for loop above an "offset" number of bytes.
    *((signed int *)(pbTrampoline)) = (pbTargetCode+offset) - (pbTrampoline + 4); 

    //# Not quite sure why we are changing the permissions on the trampoline function
    //# again, but looks like we are making it executable here.  Maybe this is the
    //# last thing we have to do before it is actually callable and usable.
    VirtualProtect((void *) dwTrampoline, 5+offset, PAGE_EXECUTE, &dwOldProtect); 


    // Overwrite the first 5 bytes of the target function 
    //# It seems we are now setting permissions so we can modify the original
    //# intercepted routine.  It is still pointing to its original code so we
    //# need to eventually redirect it.
    VirtualProtect((void *) dwAddressToIntercept, 5, PAGE_WRITECOPY, &dwOldProtect); 

    //# This will now instruct the original method to instead jump to the next
    //# address it sees on the stack.
    *pbTargetCode++ = 0xE9;        // jump rel32

    //# this is the address we want our original intercepted method to jump to.
    //# Where its jumping to will have the code of our replacement method.
    //# The "+ 4" is because the jump occurs relative to the address of the
    //# NEXT instruction after the 4byte address.
    *((signed int *)(pbTargetCode)) = pbReplaced - (pbTargetCode +4); 

    //# Changing the permissions of our original intercepted routine back to execute
    //# permissions so it can be called by other methods.
    VirtualProtect((void *) dwAddressToIntercept, 5, PAGE_EXECUTE, &dwOldProtect); 


    // Flush the instruction cache to make sure  
    // the modified code is executed.
    //# I guess this is just to make sure that if any instructions from the old
    //# state of the methods we changed, have wound up in cache, that it gets
    //# purged out of there before it gets used.
    FlushInstructionCache(GetCurrentProcess(), NULL, NULL); 

    return TRUE; 
}

我想我对这段代码中发生的事情有了很好的理解。所以百万美元的问题是：这对64位进程不起作用？我的第一个想法是，“哦，现在地址应该是8个字节，所以这就错了。 “但我认为JMP命令仍然只采用相对32位的地址，因此即使在64位进程中使用32位地址，操作码仍应有效。除此之外我唯一相信它可能是在方法调用开始时我们神奇的5个字节实际上是一些其他神奇的数字。任何人都有更好的见解？

注意：我知道还有其他一些解决方案，如“Microsoft Detours”和“EasyHook”。前者太贵了，我正在探索后者，但到目前为止令人失望。所以，我想具体讨论这个话题。我发现它很有趣，也是我问题的最佳解决方案。所以请不要“嘿，我对此帖子一无所知，但请尝试{在此插入第三方解决方案}”。

Answer 1

由于建议的代码看起来是Microsoft平台的目标，我建议您只使用Detours。使用Detours，您的蹦床将适用于32位和64位系统。

Answer 2

在你的例子中有很多东西不起作用。

1）您正在VirtualProtect-ing到PAGE_WRITECOPY，这将失败。您想将VirtualProtect转换为PAGE_EXECUTE_READWRITE。

2）如果你的“垫片”距离你试图挂钩的dll超过4GB，你的补丁跳转不起作用，因为你正在使用jmp指令的E9形式。

3）当您回VirtualProtect时，您将保护PAGE_EXECUTE，而不是PAGE_EXECUTE_READ。实际上，你应该使用你从第一个VirtualProtect中获得的flProtect，这样你就可以很好地恢复它。

顺便说一句，“神奇的数字5”是E9跳转指令操作码的大小，即E9为一个字节，后面跟DWORD作为偏移量。

蹦床是你可以从你的代码中回调原始的API（即如果你正在填充CreateFileW，你不能从你的垫片内部调用CreateFileW，否则你最终会调用你的垫片！）。

对FlushInstructionCache的调用对x86 / x64没有影响。你应该删除它。

如何在64位进程中拦截API方法调用？

背景

问题

2 个答案: