CreateFile挂钩

Question

我正在尝试为CreateFile创建一个钩子，所以当一个进程试图创建一个文件时，我们创建的钩子将通知用户：“这个进程xx.exe正在尝试创建xx.exe，你想处理吗？”

到目前为止，我需要在这段代码中修改：

library CreateFileHook;

uses
 Windows, Dialogs, SysUtils;

type
OldCode = packed record
 One: dword;
 two: word;
end;

far_jmp = packed record
 PuhsOp: byte;
 PushArg: pointer;
 RetOp: byte;
end;

var
  JmpCfw, JmpCfa: far_jmp;
  OldCfw, OldCfa: OldCode;
  CfwAdr, CfaAdr: pointer;

function NewCreateFileA(lpFileName: PChar;
                       dwDesiredAccess: DWORD;
                       dwShareMode: DWORD;
                       lpSecurityAttributes: PSecurityAttributes;
                       dwCreationDisposition: DWORD;
                       dwFlagsAndAttributes: DWORD;
                       hTemplateFile: THandle): THandle; stdcall;
var
  file_name: PWideChar;
  name_len: dword;
begin
  name_len := lstrlen(lpFileName) * SizeOf(WideChar) + 2;
  GetMem(file_name, name_len);
  StringToWideChar(lpFileName, file_name, name_len);

  CreateFileW(file_name, dwDesiredAccess, dwShareMode, lpSecurityAttributes,
              dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);

  FreeMem(file_name);
end;

function TrueCreateFileW(lpFileName: PWideChar;
                        dwDesiredAccess: DWORD;
                        dwShareMode: DWORD;
                        lpSecurityAttributes: PSecurityAttributes;
                        dwCreationDisposition: DWORD;
                        dwFlagsAndAttributes: DWORD;
                        hTemplateFile: THandle): THandle; stdcall;
var
Written: dword;
begin
 WriteProcessMemory(INVALID_HANDLE_VALUE, CfwAdr,
                    @OldCfw, SizeOf(OldCode), Written);

 CreateFileW(lpFileName,
             dwDesiredAccess,
             dwShareMode,
             lpSecurityAttributes,
             dwCreationDisposition,
             dwFlagsAndAttributes,
             hTemplateFile);

 WriteProcessMemory(INVALID_HANDLE_VALUE, CfwAdr,
                    @JmpCfw, SizeOf(far_jmp), Written);
end;

function NewCreateFileW(lpFileName: PWideChar;
                       dwDesiredAccess: DWORD;
                       dwShareMode: DWORD;
                       lpSecurityAttributes: PSecurityAttributes;
                       dwCreationDisposition: DWORD;
                       dwFlagsAndAttributes: DWORD;
                       hTemplateFile: THandle): THandle; stdcall;
begin
 TrueCreateFileW(lpFileName,
                 dwDesiredAccess,
                 dwShareMode,
                 lpSecurityAttributes,
                 dwCreationDisposition,
                 dwFlagsAndAttributes,
                 hTemplateFile);
end;

Procedure SetHook();
var
  kernel32: dword;
  Bytes: dword;
begin
  kernel32 := GetModuleHandle('Kernel32.dll');
  CfwAdr  := GetProcAddress(kernel32, 'CreateFileW');
  CfaAdr  := GetProcAddress(kernel32, 'CreateFileA');
  ReadProcessMemory(INVALID_HANDLE_VALUE, CfwAdr, @OldCfw, SizeOf(OldCode), Bytes);
  ReadProcessMemory(INVALID_HANDLE_VALUE, CfaAdr, @OldCfa, SizeOf(OldCode), Bytes);
  JmpCfw.PuhsOp  := $68;
  JmpCfw.PushArg := @NewCreateFileW;
  JmpCfw.RetOp   := $C3;
  JmpCfa.PuhsOp  := $68;
  JmpCfa.PushArg := @NewCreateFileA;
  JmpCfa.RetOp   := $C3;
  WriteProcessMemory(INVALID_HANDLE_VALUE, CfwAdr, @JmpCfw, SizeOf(far_jmp), Bytes);
  WriteProcessMemory(INVALID_HANDLE_VALUE, CfaAdr, @JmpCfa, SizeOf(far_jmp), Bytes);
end;

Procedure Unhook();
var
Bytes: dword;
begin
 WriteProcessMemory(INVALID_HANDLE_VALUE, CfaAdr, @OldCfa, SizeOf(OldCode), Bytes);
 WriteProcessMemory(INVALID_HANDLE_VALUE, CfwAdr, @OldCfw, SizeOf(OldCode), Bytes);
end;

Function MessageProc(code : integer; wParam : word;
                   lParam : longint) : longint; stdcall;
begin
  CallNextHookEx(0, Code, wParam, lparam);
  Result := 0;
end;

Procedure SetGlobalHookProc();
begin
  SetWindowsHookEx(WH_GETMESSAGE, @MessageProc, HInstance, 0);
  Sleep(INFINITE);
end;

Procedure SetGlobalHook();
var
  hMutex: dword;
  TrId: dword;
begin
  hMutex := CreateMutex(nil, false, 'CreateFileHook');
  if GetLastError = 0 then
  CreateThread(nil, 0, @SetGlobalHookProc, nil, 0, TrId) else
  CloseHandle(hMutex);
end;

procedure DLLEntryPoint(dwReason: DWord);
begin
 case dwReason of
   DLL_PROCESS_ATTACH: begin
                         SetGlobalHook();
                         Randomize();
                         SetHook()
                       end;
   DLL_PROCESS_DETACH: UnHook();
 end;
end;

begin
  DllProc := @DLLEntryPoint;
  DLLEntryPoint(DLL_PROCESS_ATTACH);
end.

Answer 1

快速浏览一下，我发现这段代码有几个问题。你从哪里弄到这个的？我手头没有参考资料，但我很确定你可以在网上找到你正在尝试做的事情的工作示例。

你不应该使用Read/WriteProcessMemory，因为你在试图修改的进程中- Windows会为你做写时复制。

如果您确实想/需要使用Read/WriteProcessMemory，那么获取要使用的句柄的方法是OpenProcess。

这个钩子代码不是可重入的--一个线程可能正在退出ReadFile，在另一个线程试图调用它之前恢复重定向代码，但在第二个线程认为它只是“修复”它之后。

一种更简洁的方法是将指向您希望挂钩的函数的指针保存在导入地址表中，然后修改该指针以调用挂钩例程。现在，您可以使用保存的指针从钩子中调用原始例程。

一旦你让它正常工作，准备好看到很多对CreateFile的调用。CreateFile除了用于创建/打开物理文件之外，还用于创建/打开许多东西，例如COM端口、管道、控制台缓冲区等等。