Question

我正在尝试将函数挂钩到cmd.exe进程 dll注入就好了问题是我无法让cmd.exe调用我的函数当我试图在命令提示符下输入单词“dir”时，它向我显示了将名字改为'dan'的相同结果。我做错了什么？

HANDLE WINAPI newFindFirstFileA(__in   LPCTSTR lpFileName, __out  LPWIN32_FIND_DATA lpFindFileData) 
{
    WIN32_FIND_DATA FindFileData;
    HANDLE hFind = FindFirstFile(lpFileName, &FindFileData);
    *FindFileData.cFileName = L'Dan';
    lpFindFileData = &FindFileData;
    return hFind;
}


BOOL APIENTRY DllMain (HINSTANCE hInst     /* Library instance handle. */ ,
                       DWORD reason        /* Reason this function is being called. */ ,
                       LPVOID reserved     /* Not used. */ )
{
    switch (reason)
    {
        case DLL_PROCESS_ATTACH:
        MessageBox(NULL,L"DLL Was injected!", L"Message" ,NULL);

        /* Hooking function */
        DWORD* dw = (DWORD*)GetProcAddress( GetModuleHandleA("kernel32.dll"), "FindFirstFileA" );
        *dw = (DWORD)newFindFirstFileA;
        break;
    }  

    /* Returns TRUE on success, FALSE on failure */
    return TRUE;
}

Answer 1

GetProcAddress不会返回指向IAT条目的指针。相反，它返回实际函数的位置。因此，*dw = (DWORD) newFindFirstFileA将覆盖FindFirstFileA函数的序言，这将是灾难性的。有关挂钩API的详细说明，请参阅this文章

IAT挂钩测试

1 个答案: