逆向 | IATHook 全屏加速挂

这次hook的是timeGetTime这个函数，位于winmm.dll中，直接上代码了。

1.dll:

// 1.cpp : Defines the entry point for the DLL application.
//

#include "stdafx.h"
#include <stdio.h>


DWORD g_dwOldAddr;         // 原始函数地址
DWORD g_dwNewAddr;         // Hook函数地址
DWORD g_dwIATHookFlag;     // 标志有没有被hook

BOOL SetIATHook(DWORD dwOldAddr, DWORD dwNewAddr){
BOOL bFlag = FALSE;
DWORD dwImageBase = 0;
PDWORD pFuncAddr = NULL;
PIMAGE_NT_HEADERS pNtHeader = NULL;
PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = NULL;
DWORD dwOldProtect = 0;

// 得到exe模块基址
dwImageBase = (DWORD)GetModuleHandle(NULL);
pNtHeader = (PIMAGE_NT_HEADERS)(dwImageBase + ((PIMAGE_DOS_HEADER)dwImageBase)->e_lfanew);
pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(dwImageBase + 
pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);


// 遍历IAT表 找到这个函数的地址
while (pImportDescriptor->FirstThunk != 0 && bFlag == FALSE)
    {
printf("pImportDescriptor: %x \n", pImportDescriptor);
pFuncAddr = (PDWORD)(dwImageBase + pImportDescriptor->FirstThunk);
while (*pFuncAddr) // 遍历该模块中的函数
        {
if(dwOldAddr == *pFuncAddr){
// 找到要Hook的函数，先修改内存页的属性
VirtualProtect(pFuncAddr, sizeof(DWORD), PAGE_READWRITE, &dwOldProtect);
printf("found IAT Addr: %x\n", pFuncAddr);
*pFuncAddr = dwNewAddr;   // !!!更改过IAT中函数的地址
VirtualProtect(pFuncAddr, sizeof(DWORD), dwOldProtect, 0);
bFlag = TRUE;
break;
            }
pFuncAddr ++;
        }
pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pImportDescriptor+sizeof(IMAGE_IMPORT_DESCRIPTOR));
    }
if(bFlag == FALSE){
// 没找到
printf("iat not found...\n");
    }
// 修改状态
g_dwOldAddr = dwOldAddr;
g_dwNewAddr = dwNewAddr;
g_dwIATHookFlag = 1;
return bFlag;
}        

BOOL UnIATHook(){
BOOL bFlag = FALSE;
DWORD dwImageBase = 0;
PDWORD pFuncAddr = NULL;
PIMAGE_NT_HEADERS pNtHeader = NULL;
PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = NULL;
DWORD dwOldProtect = 0;

// 判断是否hook
if (!g_dwIATHookFlag)
    {
OutputDebugString("UnIATHook失败：尚未进行IAT Hook!");
return bFlag;
    }

// 得到exe模块基址
dwImageBase = (DWORD)GetModuleHandle(NULL);
pNtHeader = (PIMAGE_NT_HEADERS)(dwImageBase + ((PIMAGE_DOS_HEADER)dwImageBase)->e_lfanew);
pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(dwImageBase + 
pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

// 遍历IAT表 找到这个函数的地址
while (pImportDescriptor->FirstThunk != 0 && bFlag == FALSE)
    {
pFuncAddr = (PDWORD)(dwImageBase + pImportDescriptor->FirstThunk);
while (*pFuncAddr) // 遍历该模块中的函数
        {
if(g_dwNewAddr == *pFuncAddr){
// 找到要Hook的函数，先修改内存页的属性
VirtualProtect(pFuncAddr, sizeof(DWORD), PAGE_READWRITE, &dwOldProtect);
*pFuncAddr = g_dwOldAddr;   // !!!更改过IAT中函数的地址
VirtualProtect(pFuncAddr, sizeof(DWORD), dwOldProtect, 0);
bFlag = TRUE;
break;
            }
pFuncAddr ++;
        }
pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pImportDescriptor+sizeof(PIMAGE_IMPORT_DESCRIPTOR));
    }
// 修改状态
g_dwOldAddr = 0;
g_dwNewAddr = 0;
g_dwIATHookFlag = 1;
return bFlag;
}       


int WINAPI MyHookFunc(){
static int last_time = 100;
static int i = 0;
// 定义函数指针
typedef DWORD (WINAPI *PFNTIMEGETTIME)(VOID);

// 执行真正的函数
int ret = ((PFNTIMEGETTIME)g_dwOldAddr)();
ret = ret + last_time*i;
i++;
return ret;
}




// 线程函数
DWORD WINAPI ThreadProc(LPVOID lpParameter){
// 保存原始函数地址
DWORD pOldFuncAddr = (DWORD)GetProcAddress(LoadLibrary("winmm.dll"), "timeGetTime");
printf("Get Original func addr: %x\n", pOldFuncAddr);
// 安装或者卸载HOOK
if (!g_dwIATHookFlag){
SetIATHook(pOldFuncAddr, (DWORD)MyHookFunc);
    }else{
UnIATHook();
    }
return 0;
}




BOOL APIENTRY DllMain( HANDLE hModule, 
DWORD  ul_reason_for_call, 
LPVOID lpReserved
                     )
{
switch ( ul_reason_for_call)
    {
case DLL_PROCESS_ATTACH:
CreateThread(NULL,0,
            (LPTHREAD_START_ROUTINE)ThreadProc,
NULL, 0,NULL);//创建新线程执行代码
break;
case DLL_PROCESS_DETACH:
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
    }
return TRUE;
}

然后注入用的是之前的：

injection.cpp:

#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>

DWORD GetPid(char* szName){
HANDLE hprocessSnap = NULL;
PROCESSENTRY32 pe32 = {0};
hprocessSnap = CreateToolhelp32Snapshot(
TH32CS_SNAPPROCESS,
0);//捕捉所有进程的快照
if (hprocessSnap == INVALID_HANDLE_VALUE){
//快照失败
return 0;
    }
//初始化pe32结构体
pe32.dwSize = sizeof(PROCESSENTRY32);
if (Process32First(hprocessSnap, &pe32)){
do{
if (!strcmp(szName, pe32.szExeFile)){
printf("Process Found, PID: %d \n", (int)pe32.th32ProcessID);
return (int)pe32.th32ProcessID;
            }
//遍历查找进程名
        }while (Process32Next(hprocessSnap, &pe32));
    }else{
CloseHandle(hprocessSnap);
    }
return 0;
}



//远程线程注入
BOOL load_dll(DWORD dwProcessID, char* szDllPathName)
//进程PID和dll完整的路径
{
BOOL bRet;
HANDLE hProcess;
HANDLE hThread;
DWORD dwLength;
DWORD dwLoadAddr;
LPVOID lpAllocAddr;
DWORD dwThreadID;
HMODULE hModule;
//获取进程句柄
hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessID);
printf("%x \n", hProcess);
if (hProcess == NULL)
    {
OutputDebugString("fail to open process \n");
return FALSE;
    }
//把DLL文件路径字符串存入被注入进程的内存空间
//计算dll路径名字长度，并且加上结尾0的空间
dwLength = strlen(szDllPathName)+1;
//远程申请内存空间
lpAllocAddr = (LPVOID)VirtualAllocEx(hProcess,NULL,dwLength,MEM_COMMIT,PAGE_READWRITE);
if (lpAllocAddr == NULL){
OutputDebugString("VirtualAllocEx error \n");
CloseHandle(hProcess);
return FALSE;
    }
//拷贝dll路径名字到目标进程的内存
bRet = WriteProcessMemory(hProcess, lpAllocAddr,szDllPathName,dwLength,NULL);
if (bRet == NULL){
OutputDebugString("bRet error \n");
CloseHandle(hProcess);
return FALSE;
    }
//获取kernel32.dll的地址
hModule = GetModuleHandle("Kernel32.dll");
if (!hModule)
    {
OutputDebugString("GetModuleHandle error \n");
CloseHandle(hProcess);
return FALSE;
    }
//获取LoadLibraryA函数地址
dwLoadAddr = (DWORD)GetProcAddress(hModule, "LoadLibraryA");
if (!dwLoadAddr )
    {
OutputDebugString("GetProcAddress error \n");
CloseHandle(hProcess);
CloseHandle(hModule);
return FALSE;
    }

//创建远程线程，加载dll
hThread = CreateRemoteThread(hProcess, NULL, 0, (unsigned long (__stdcall *)(void *))dwLoadAddr, lpAllocAddr, 0, NULL);
printf("%x \n", hThread);
if (hThread == NULL)
    {
OutputDebugString("fail to open RomoteThread \n");
CloseHandle(hProcess);
return FALSE;
    }
CloseHandle(hProcess);

return TRUE;
}

//之后在main函数中调用即可
//例：load_dll(1304, "C:\\Documents and Settings\\Administrator\\桌面\\线程注入\\6.dll");
//popcapgame1.exe
void main(){
load_dll(GetPid("popcapgame1.exe"), "C:\\Users\\thinkpad\\Desktop\\IATHook\\dll2全屏加速\\1\\Debug\\1.dll");
}