Question

我正在试验Detours。

首先，我有一个ForHook.cpp，它使用gdiplus DrawString打印“Hello”。

VOID OnPaint(HDC hdc)
{
    Graphics graphics(hdc);
    FontFamily  fontFamily(L"Times New Roman");
    Font        font(&fontFamily, 24, FontStyleRegular, UnitPixel);
    PointF      pointF(30.0f, 10.0f);
    SolidBrush  solidBrush(Color(255, 0, 0, 255));
    graphics.DrawString(L"Hello", -1, &font, pointF, &solidBrush);
}

我在ForHook.cpp中编写了绕行代码，它拦截了DrawString命令，将“Haha”写入窗口而不是“Hello”。它有效。用于替换gdiplus DrawString的代码：

class CDetour {
public:
    static Gdiplus::Status(CDetour::*pDrawString)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b);
    Gdiplus::Status MyDrawString(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b);
};
Gdiplus::Status CDetour::MyDrawString(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b)
{
    WCHAR* a = L"Haha!";
    return (this->*pDrawString)(a, len, f, org, b);
}

Gdiplus::Status(CDetour::* CDetour::pDrawString)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b) = (Gdiplus::Status(CDetour::*)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b))&Graphics::DrawString;

迂回代码：

Gdiplus::Status(CDetour::* pMyDrawString)(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b) = &CDetour::MyDrawString;
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
DetourTransactionCommit();

然后，我将它们移动到dll，并在ForHook.cpp中加载dll。在我习惯绕道代码的地方：

LoadLibrary(TEXT("Mydll.dll"));

迂回代码置于DllMain：

之下

case DLL_PROCESS_ATTACH:
    //detours
    MessageBox(0, L"Process Attach", L"Info", MB_OK);
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
    if (DetourTransactionCommit() == NO_ERROR)
    { 

        //WCHAR buffer[15];
        //_ultow_s(GetCurrentThreadId(), buffer, 15, 10);
        MessageBox(0, L"Dll successfully injected.", L"Info", MB_OK);
        //MessageBox(0, buffer, L"Info", MB_OK);
    }
    break;

当dll分离时我使用detourdetach：

case DLL_PROCESS_DETACH:
    MessageBox(0, L"Process Detach", L"Info", MB_OK);
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourDetach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
    DetourTransactionCommit();
    break;

由于在ForHook.cpp中不会调用detours API，我还删除了#include <detours.h>和#pragma comment(lib, "detours.lib)。

棘手的是，dll已附加，我使用Listdlls.exe验证了它。该DLL位于ForHook.exe进程ID下。但程序仍然打印“Hello”而不是“Haha”。

为什么它不起作用？我怎么能改变它？

dllmain.cpp：

// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
#include <detours.h>
#include <gdiplus.h>
#include <windows.h>
#include <objidl.h>

using namespace Gdiplus;
#pragma comment (lib,"Gdiplus.lib")
#pragma comment(lib,"detours.lib")

//class __declspec(dllexport) CDetour
class CDetour
{

public:
    static Gdiplus::Status(CDetour::*pDrawString)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b);
    Gdiplus::Status  MyDrawString(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b);

};

Gdiplus::Status CDetour::MyDrawString(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b)
{
    WCHAR* a = L"Haha!";
    return (this->*pDrawString)(a, len, f, org, b);
}

DWORD GetMainThreadId(DWORD dwPid)
{
    LPVOID lpTid;

    _asm
    {
        mov eax, fs:[18h]
            add eax, 36
            mov[lpTid], eax
    }

    HANDLE hProcess = OpenProcess(PROCESS_VM_READ, FALSE, dwPid);
    if (hProcess == NULL)
        return NULL;

    DWORD dwTid;
    if (ReadProcessMemory(hProcess, lpTid, &dwTid, sizeof(dwTid), NULL) == FALSE)
    {
        CloseHandle(hProcess);
        return NULL;
    }

    CloseHandle(hProcess);

    return dwTid;
}

Gdiplus::Status(CDetour::* CDetour::pDrawString)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b) = (Gdiplus::Status(CDetour::*)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b))&Graphics::DrawString;


BOOL APIENTRY DllMain( HMODULE hModule,
                   DWORD  ul_reason_for_call,
                   LPVOID lpReserved
                 )
{
    //MessageBox(0, TEXT("Why?"), TEXT("Info"), MB_OK);

    Gdiplus::Status(CDetour:: *pMyDrawString)(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b) = &CDetour::MyDrawString;
    //WCHAR buf[15];
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        //MessageBox(0, L"Process Attach", L"Info", MB_OK);
        //_ultow_s(GetMainThreadId(GetCurrentProcessId()), buf, 15, 10);
        //MessageBox(0, buf, L"Info", MB_OK);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
        if (DetourTransactionCommit() == NO_ERROR)
        {

            WCHAR buffer[15];
            _ultow_s(GetCurrentThreadId(), buffer, 15, 10);
            //MessageBox(0, L"Dll successfully injected.", L"Info", MB_OK);
            MessageBox(0, buffer, L"Info", MB_OK);
        }
        break;
    case DLL_THREAD_ATTACH:
        //detours
        //MessageBox(0, L"Thread Attach", L"Info", MB_OK);
        //_ultow_s(GetMainThreadId(GetCurrentProcessId()), buf, 15, 10);
        //MessageBox(0, buf, L"Info", MB_OK);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
        if (DetourTransactionCommit() == NO_ERROR)
        {

            WCHAR buffer[15];
            _ultow_s(GetCurrentThreadId(), buffer, 15, 10);
            //MessageBox(0, L"Dll successfully injected.", L"Info", MB_OK);
            MessageBox(0, buffer, L"Info", MB_OK);
        }
        break;
    case DLL_THREAD_DETACH:
        //MessageBox(0, L"Thread Detach", L"Info", MB_OK);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
        DetourTransactionCommit();
        break;
    case DLL_PROCESS_DETACH:
        //MessageBox(0, L"Proccess Detach", L"Info", MB_OK);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
        DetourTransactionCommit();
        break;
    }

    return TRUE;
}

Answer 1

首先，你想尽量避免在DllMain（）中做任何事情。其次，当你可能真的想在DLL_THREAD_ATTACH中调用它时，你在PROCESS attach中进行设置。如果您在代码中添加了某种可视标记，那么在加载DLL时，您会发现Windows会执行一些 WHACKY 内容。你会看到一个ProcessAttach，（好的，当然......），然后你会看到一个ThreadAttach（）......好吧......但是你会看到一个ThreadDetatch（），当你的应用程序CLOSES，您将获得PROCESS_DETATCH，但不是THREAD_DETATCH ......

您在PROCESS_ATTACH中设置的线程信息很可能是 NOT 实际正在进行工作的线程...将代码移动到THREAD_ATTACH，它可能会起作用。代码最有可能使用TLS，另一种可怕的技术，就DLL来说......

在dll中剔除DrawString不起作用

1 个答案: