Question

我正在尝试与微软的弯路做一些基本的挂钩，我无法让它工作。我基本上使用了这个帖子中发布的代码：

How can I hook Windows functions in C/C++?

但没有骰子。我更新了DLL代码中的发送/接收函数，只是简单地将数据记录到文件中，我尝试将主程序挂钩到“互联网检查程序”程序中，但是一个日志文件永远不会被创建，所以看来这个dll没注射。

我正在运行Windows 7 64位，Visual Studio 10.0，Detours 3.0（我的环境似乎设置正确，没有问题构建或任何问题）。我创建了一个DLL项目，粘贴在上面链接的DLL代码中，发送/ recv更新如下：

FILE * pSendLogFile;
fopen_s(&pSendLogFile, "C:\\SendLog.txt", "a+");
fprintf(pSendLogFile, "%s\n", buf);
fclose(pSendLogFile);

并编译。然后创建另一个项目，粘贴在上面链接的主代码中，将其设置为查找chkrzm.exe程序（检查器），并将DLL路径硬编码为：

fullPath = "C:\\Users\\PM\\Documents\\Programs\\C Code\\Test\\DLLTester2\\Debug\\DLLTester2.dll";

然后跑了，但没有骰子。知道为什么我不能让它工作吗？

Answer 1

FYI解决了这个问题。要查看哪些进程是32位，只需ctrl-alt-delete并转到任务管理器;列出了32位进程，旁边是* 32。也得到了我的钩子工作;这是代码。我放弃了CreateRemoteThread方法，只使用了系统范围的钩子。我把代码拼凑在一起：

How to hook external process with SetWindowsHookEx and WH_KEYBOARD http://www.codingthewheel.com/archives/how-i-built-a-working-online-poker-bot-4 http://www.codingthewheel.com/archives/how-i-built-a-working-online-poker-bot-7

该程序只是在32位进程中反转文本（如上面的上一个链接所示）。例如。打开文本板并将鼠标悬停在菜单上;他们的文本应该反转。

dll：

#include <windows.h>
#include <detours.h>
#include <stdio.h>
#include <iostream>
using namespace std;


// Initial stuff
#ifdef _MANAGED
#pragma managed(push, off)
#endif

#pragma comment( lib, "Ws2_32.lib" )
#pragma comment( lib, "detours.lib" )

#pragma data_seg("Shared")
HHOOK   g_hHook  = NULL;
#pragma data_seg()


// Globals
HINSTANCE  g_hInstance = NULL;


// ExtTextOut - original
BOOL (WINAPI * Real_ExtTextOut)(HDC hdc, int X, int Y, UINT options, const RECT* lprc, LPCTSTR text, UINT cbCount, const INT* lpSpacingValues) = ExtTextOut;

// ExtTextOut - overridden
BOOL WINAPI Mine_ExtTextOut(HDC hdc, int X, int Y, UINT options, const RECT* lprc, LPCTSTR text, UINT cbCount, const INT* lpSpacingValues)
{
    if (!text)
        return TRUE;

    // Make a copy of the supplied string..safely
    LPWSTR szTemp = (LPWSTR)LocalAlloc(0, (cbCount+1) * 2);
    memcpy(szTemp, text, cbCount*2); // can't use strcpy here
    szTemp[cbCount] = L'\0'; // append terminating null

    // Reverse it..
    wcsrev(szTemp);

    // Pass it on to windows...
    BOOL rv = Real_ExtTextOut(hdc, X, Y, options, lprc, szTemp, cbCount, lpSpacingValues);

    // Cleanup
    LocalFree(szTemp);

    return TRUE;
}


// DLLMain
BOOL APIENTRY DllMain( HANDLE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved  )
{
    switch (ul_reason_for_call)
    {
        case DLL_PROCESS_ATTACH:
            g_hInstance  = (HINSTANCE) hModule;

            DetourTransactionBegin(); 
            DetourUpdateThread(GetCurrentThread());
            DetourAttach(&(PVOID&)Real_ExtTextOut, Mine_ExtTextOut); // <- magic
            DetourTransactionCommit();
            break;

        case DLL_PROCESS_DETACH:
            DetourTransactionBegin(); 
            DetourUpdateThread(GetCurrentThread());
            DetourDetach(&(PVOID&)Real_ExtTextOut, Mine_ExtTextOut);
            DetourTransactionCommit();
            break;
    }

    return TRUE;
}


// CBT Hook - dll is hooked into all processes (only 32 bit processes on my machine)
LRESULT CALLBACK CBTProc(int nCode, WPARAM wParam, LPARAM lParam)
{
    if (nCode < 0)
        return CallNextHookEx(g_hHook, nCode, wParam, lParam);

    // Return 0 to allow window creation/destruction/activation to proceed as normal.
    return 0;
}


// Install hook
extern "C" __declspec(dllexport) bool install()
{
    g_hHook = SetWindowsHookEx(WH_CBT, (HOOKPROC) CBTProc, g_hInstance, 0);

    return g_hHook != NULL;
}


// Uninstall hook
extern "C" __declspec(dllexport) void uninstall()
{
    if (g_hHook)
    {
        UnhookWindowsHookEx(g_hHook);
        g_hHook = NULL;
    }
}

主程序：

#include <Windows.h>
#include <stdio.h>
#include <tchar.h>
#include <iostream>
using namespace std;


// Main
int _tmain(int argc, _TCHAR* argv[])
{
    // Load dll
    HINSTANCE hinst = LoadLibrary(_T("C:\\Users\\PM\\Documents\\Programs\\C Code\\Test\\DLLTesterFinal\\Debug\\DLLTesterFinal.dll")); 

    if (hinst)
    {
        // Get functions
        typedef bool (*Install)();
        typedef void (*Uninstall)();
        Install install = (Install) GetProcAddress(hinst, "install");
        Uninstall uninstall = (Uninstall) GetProcAddress(hinst, "uninstall");
        cout << "GetLastError1: " << GetLastError () << endl << endl;

        // Install hook
        bool hookInstalledSuccessfully = install ();
        cout << "GetLastError2: " << GetLastError () << endl;
        cout << "Hook installed successfully? " << hookInstalledSuccessfully << endl << endl;

        // At this point, go to a 32-bit process (eg. textpad, chrome) and hover over menus; their text should get reversed
        cout << "Text should now be reversed in 32-bit processes" << endl;
        system ("Pause");

        // Uninstall hook
        uninstall();
        cout << endl << "GetLastError3: " << GetLastError () << endl;
        cout << "Done" << endl;
        system ("Pause");
    }

    return 0;
}

然而，在尝试绕过Java应用程序中的ExtTextOut时，java应用程序崩溃了;需要对此进行调查。

Answer 2

我正在运行Windows 7 64位，Visual Studio 10.0

您必须在WIN7上以管理员用户身份运行MS DETOUR INJECT。要验证工作迂回代码，请使用绕行3.0的样本进行目标测试。

cmd>$Path/Detours Express 3.0>nmake test

微软绕道而行

2 个答案: