Question

我使用我在这里看到的一些例子写了一个简单的Hook函数，它可以工作。我设法将CreateProcess重定向到一个修改了一些参数的trampoline函数，而不是将控制权交还给CreateProcess。

我不喜欢它因为我使用pop和push来执行此操作，因为我可以简单地引用它们相对于ebp的地址。

__declspec(naked)
InterceptCreateProc()
{
    LPBYTE pJmpAdr;

    void *inject;

    HMODULE hModule;
    void* oldFuncAdr;
    DWORD dwInject;

    inject = (void* )Inject; // function that will inject this dll in every process created
    dwInject = (DWORD)inject;

    __asm
    {
        // stack frame
        push ebp
        mov ebp, esp
        sub esp, __LOCAL_SIZE // crashes with and without this

        or [ebp + 28], CREATE_SUSPENDED // dwCreationFlags | CREATE_SUSPENDED

        xor eax, eax
        mov eax, [ebp + 4] // return address
        mov g_returnAdrCreateProc, eax // save it

        mov eax, dwInject
        mov [ebp + 4], eax // new return address is my Inject function

        mov eax, [ebp + 44]
        mov g_procInfo, eax // lpProcessInformation
    };


    // give control back to CreateProcess
    hModule = LoadLibrary(TEXT("kernel32.dll"));
    oldFuncAdr = (void* )GetProcAddress(hModule,
        "CreateProcessW");

    pJmpAdr = (LPBYTE)oldFuncAdr + 5;

    __asm
    {
        jmp pJmpAdr
        /*
          tried push pJmpAdr
                ret
          no difference
        */
    };
}

这在最后一个__asm块之前崩溃。

我无法弄清楚我搞砸了哪里。是否可能以某种方式保护堆栈，并且当CreateProcess启动时，它会看到有人在那里写入数据并使应用程序崩溃？

当我做了大量的弹出和推动时似乎并不介意。这是旧函数，我认为它有更大的机会搞乱堆栈。

__declspec(naked)
InterceptCreateProc()
{
    LPBYTE pJmpAdr;

    LPCTSTR lpApplicationName;
    LPTSTR lpCommandLine;
    LPSECURITY_ATTRIBUTES lpProcessAttributes;
    LPSECURITY_ATTRIBUTES lpThreadAttributes;
    BOOL bInheritHandles;
    DWORD dwCreationFlags;
    LPVOID lpEnvironment;
    LPCTSTR lpCurrentDirectory;
    LPSTARTUPINFO lpStartupInfo;
    LPPROCESS_INFORMATION lpProcessInformation;
    DWORD retv;

    void *inject;

    HMODULE hModule;
    void* oldFuncAdr;

    inject = (void* )Inject;

    __asm
    {
        pop retv
        pop lpApplicationName
        pop lpCommandLine
        pop lpProcessAttributes
        pop lpThreadAttributes
        pop bInheritHandles
        pop dwCreationFlags
        pop lpEnvironment
        pop lpCurrentDirectory
        pop lpStartupInfo
        pop lpProcessInformation
    };

    dwCreationFlags = dwCreationFlags | CREATE_SUSPENDED;
    g_returnAdrCreateProc = retv;
    retv = (DWORD)inject;
    g_procInfo = lpProcessInformation;

    __asm
    {
        push lpProcessInformation
        push lpStartupInfo
        push lpCurrentDirectory
        push lpEnvironment
        push dwCreationFlags
        push bInheritHandles
        push lpThreadAttributes
        push lpProcessAttributes
        push lpCommandLine
        push lpApplicationName
        push retv
    };


    __asm
    {
        push ebp
        mov ebp, esp
    };

    hModule = LoadLibrary(TEXT("kernel32.dll"));
    oldFuncAdr = (void* )GetProcAddress(hModule,
        "CreateProcessW");

    pJmpAdr = (LPBYTE)oldFuncAdr + 5;

    __asm
    {
        jmp pJmpAdr
    };
}

当我直接访问堆栈而不是弹出和推送时，我试图弄清楚我修改了什么，但我找不到任何东西。

蹦床功能崩溃

0 个答案: