API HOOK技术

Author：傻猫
发布时间：July 21, 2010
5441views
No comments
9334 words
Categories：搞软件

APIHook一直是使大家感兴趣的话题。屏幕取词，内码转化，屏幕翻译，中文平台等等都涉及到了此项技术。有很多文章涉及到了这项技术，但都闪烁其词不肯明明白白的公布。我仅在这里公布以下我用Delphi制作APIHook的一些心得。 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 通常的APIHOOK有这样几种方法： &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1、自己写一个动态链接库，里面定义自己写的想取代系统的API。把这个动态链接库映射到2G以上的系统动态链接库所在空间，把系统动态链接库中的该API的指向修改指向自己的函数。这种方法的好处就是可以取代系统中运行全部程序的该API。但他有个局限，就是只适用于Win9x。（原因是NT中动态链接库不是共享的，每个进程都有自己的一份动态链接库在内存中的映射） &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2、自己写一个动态链接库，里面定义自己写得象替代系统的API。把这个动态链接库映射到进程的空间里。将该进程对API的调用指向自己写的动态链接库。这种方法的好处是可以选择性的替代哪个进程的API。而且适用于所有的Windows操作系统。
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 这里我选用的是第二种方法。 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 第二种方法需要先了解一点PE文件格式的知识。 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 首先是一个实模式的的DOS文件头，是为了保持和DOS的兼容。 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 接着是一个DOS的代理模块。你在纯DOS先运行Win32的可执行文件，看看是不是也执行了，只是显示的的是一行信息大意是说该Windows程序不能在DOS实模式下运行。 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 然后才是真正意义上的Windows可执行文件的文件头。它的具体位置不是每次都固定的。是由文件偏移$3C决定的。我们要用到的就是它。 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 如果我们在程序中调用了一个MessageBoxA函数那么它的实现过程是这样的。他先调用在本进程中的MessageBoxA函数然后才跳到动态链接库的MessageBoxA的入口点。即： &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; call messageBoxA(0040106c) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; jmp dword ptr [_jmp_MessageBoxA@16(00425294)] 其中00425294的内容存储的就是就是MessageBoxA函数的入口地址。如果我们做一下手脚，那么...... &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 那就开始吧！ 我们需要定义两个结构 type &nbsp;&nbsp; PImage_Import_Entry = ^Image_Import_Entry; &nbsp;&nbsp; Image_Import_Entry = record &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Characteristics: DWORD; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; TimeDateStamp: DWORD; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MajorVersion: Word; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MinorVersion: Word; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Name: DWORD; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LookupTable: DWORD; &nbsp;&nbsp; end; type &nbsp;&nbsp; TImportCode = packed record &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JumpInstruction: Word; file: //定义跳转指令jmp &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; AddressOfPointerToFunction: ^Pointer; file: //定义要跳转到的函数 &nbsp;&nbsp; end; &nbsp;&nbsp; PImportCode = ^TImportCode; 然后是确定函数的地址。 function LocateFunctionAddress(Code: Pointer): Pointer; var &nbsp;&nbsp; func: PImportCode; begin &nbsp;&nbsp; Result := Code; &nbsp;&nbsp; if Code = nil then exit; &nbsp;&nbsp; try &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; func := code; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (func.JumpInstruction = $25FF) then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; begin &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Result := func.AddressOfPointerToFunction^; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; end; &nbsp;&nbsp; except &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Result := nil; &nbsp;&nbsp; end; end; 参数Code是函数在进程中的指针，即那条Jmp XXX的指令。$25FF就是跳转指令的机器码。 再下一篇我会讲如何替换下那个XXX的内容，让他跳到你想去的地方。
 在这里我将要实现转跳。有人说修改内存内容要进入Ring 0 才可以。可是Windows本身提供了一个写内存的指令WriteProcessMemory。有了这把利器，我们几乎无所不能。如游戏的修改等在这里我们只谈APIHOOK。 function RepointFunction(OldFunc, NewFunc: Pointer): Integer; var &nbsp;&nbsp; IsDone: TList; &nbsp;&nbsp; function RepointAddrInModule(hModule: THandle; OldFunc, NewFunc: Pointer): Integer; &nbsp;&nbsp; var &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Dos: PImageDosHeader; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NT: PImageNTHeaders; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ImportDesc: PImage_Import_Entry; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RVA: DWORD; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Func: ^Pointer; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DLL: string; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; f: Pointer; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; written: DWORD; &nbsp;&nbsp; begin &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Result := 0; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Dos := Pointer(hModule); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if IsDone.IndexOf(Dos) &gt;= 0 then exit; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IsDone.Add(Dos);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OldFunc := LocateFunctionAddress(OldFunc);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if IsBadReadPtr(Dos, SizeOf(TImageDosHeader)) then exit; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if Dos.e_magic &lt;&gt; IMAGE_DOS_SIGNATURE then exit; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NT := Pointer(Integer(Dos) + dos._lfanew);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RVA := NT^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT] &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; .VirtualAddress;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if RVA = 0 then exit; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ImportDesc := pointer(integer(Dos) + RVA); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; while (ImportDesc^.Name &lt;&gt; 0) do &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; begin &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DLL := PChar(Integer(Dos) + ImportDesc^.Name); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RepointAddrInModule(GetModuleHandle(PChar(DLL)), OldFunc, NewFunc); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Func := Pointer(Integer(DOS) + ImportDesc.LookupTable); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; while Func^ &lt;&gt; nil do &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; begin &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; f := LocateFunctionAddress(Func^); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if f = OldFunc then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; begin &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; WriteProcessMemory(GetCurrentProcess, Func, @NewFunc, 4, written); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if Written &gt; 0 then Inc(Result); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; end; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Inc(Func); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; end; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Inc(ImportDesc); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; end; &nbsp;&nbsp; end;
begin &nbsp;&nbsp; IsDone := TList.Create; &nbsp;&nbsp; try &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Result := RepointAddrInModule(GetModuleHandle(nil), OldFunc, NewFunc); &nbsp;&nbsp; finally &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IsDone.Free; &nbsp;&nbsp; end; end; 有了这两个函数我们几乎可以更改任何API函数。 我们可以先写一个DLL文件。我这里以修改Text相关函数为例： 先定义几个函数： type &nbsp;&nbsp; TTextOutA = function(DC: HDC; X, Y: Integer; Str: PAnsiChar; Count: Integer): BOOL; stdcall; &nbsp;&nbsp; TTextOutW = function(DC: HDC; X, Y: Integer; Str: PWideChar; Count: Integer): BOOL; stdcall; &nbsp;&nbsp; TTextOut = function(DC: HDC; X, Y: Integer; Str: PChar; Count: Integer): BOOL; stdcall; &nbsp;&nbsp; TDrawTextA = function(hDC: HDC; lpString: PAnsiChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall; &nbsp;&nbsp; TDrawTextW = function(hDC: HDC; lpString: PWideChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall; &nbsp;&nbsp; TDrawText = function(hDC: HDC; lpString: PChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall; var &nbsp;&nbsp; OldTextOutA: TTextOutA; &nbsp;&nbsp; OldTextOutW: TTextOutW; &nbsp;&nbsp; OldTextOut: TTextOut; &nbsp;&nbsp; OldDrawTextA: TDrawTextA; &nbsp;&nbsp; OldDrawTextW: TDrawTextW; &nbsp;&nbsp; OldDrawText: TDrawText; ...... function MyTextOutA(DC: HDC; X, Y: Integer; Str: PAnsiChar; Count: Integer): BOOL; stdcall; begin &nbsp;&nbsp; OldTextOutA(DC, X, Y, 'ABC', length('ABC')); end;
function MyTextOutW(DC: HDC; X, Y: Integer; Str: PWideChar; Count: Integer): BOOL; stdcall; begin &nbsp;&nbsp; OldTextOutW(DC, X, Y, 'ABC', length('ABC')); end;
function MyTextOut(DC: HDC; X, Y: Integer; Str: PChar; Count: Integer): BOOL; stdcall; begin &nbsp;&nbsp; OldTextOut(DC, X, Y, 'ABC', length('ABC')); end;
function MyDrawTextA(hDC: HDC; lpString: PAnsiChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall; begin &nbsp;&nbsp; OldDrawTextA(hDC, 'ABC', length('ABC'), lpRect, uFormat); end;
function MyDrawTextW(hDC: HDC; lpString: PWideChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall; begin &nbsp;&nbsp; OldDrawTextW(hDC, 'ABC', length('ABC'), lpRect, uFormat); end;
function MyDrawText(hDC: HDC; lpString: PChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall; begin &nbsp;&nbsp; OldDrawText(hDC, 'ABC', length('ABC'), lpRect, uFormat); end;
调用时我们要把原来的函数地址保存下来： &nbsp;&nbsp; if @OldTextOutA = nil then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; @OldTextOutA := LocateFunctionAddress(@TextOutA); &nbsp;&nbsp; if @OldTextOutW = nil then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; @OldTextOutW := LocateFunctionAddress(@TextOutW); &nbsp;&nbsp; if @OldTextOut = nil then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; @OldTextOut := LocateFunctionAddress(@TextOut); &nbsp;&nbsp; if @OldDrawTextA = nil then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; @OldDrawTextA := LocateFunctionAddress(@DrawTextA); &nbsp;&nbsp; if @OldDrawTextW = nil then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; @OldDrawTextW := LocateFunctionAddress(@DrawTextW); &nbsp;&nbsp; if @OldDrawText = nil then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; @OldDrawText := LocateFunctionAddress(@DrawText); 然后很顺其自然的用自己的函数替换掉原来的函数 &nbsp;&nbsp; RepointFunction(@OldTextOutA, @MyTextOutA); &nbsp;&nbsp; RepointFunction(@OldTextOutW, @MyTextOutW); &nbsp;&nbsp; RepointFunction(@OldTextOut, @MyTextOut); &nbsp;&nbsp; RepointFunction(@OldDrawTextA, @MyDrawTextA); &nbsp;&nbsp; RepointFunction(@OldDrawTextW, @MyDrawTextW); &nbsp;&nbsp; RepointFunction(@OldDrawText, @MyDrawText); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 在结束时不要忘记恢复原来函数的入口，要不然你会死得很难看哟！好了我们在写一个Demo程序。你会说怎么文字没有变成ABC呀？是呀，你要刷新一下才行。最小化然后在最大化。看看变了没有。&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 要不然你就写代码刷新一下好了。至于去拦截其他进程的API那就用SetWindowsHookEx写一个其他的钩子将DLL映射进去就行了，我就不再浪费口水了。 掌握了该方法你几乎无所不能。你可以修改其它程序。你可以拦截Createwindow等窗口函数改变其他程序的窗口形状、你还可以入侵其它的程序，你还可以......嘿嘿。干了坏事别招出我来就行了。 我还写了个例子，请在CSDN上下载。