About ShutDown of Windows（四）
天氣很冷，接著折騰
利用Windows Hooks注入
Windows系統(tǒng)給我們提供了一些掛鉤函數(shù)，
使得被掛鉤的進(jìn)程可以在自己處理接收到的消息之前，
先執(zhí)行我們的消息處理函數(shù)，
而這個消息處理函數(shù)一般會放在DLL中，
來讓目標(biāo)進(jìn)程加載，這實(shí)際上已經(jīng)達(dá)到了注入代碼的效果。
一般情況下，我們把掛鉤函數(shù)和消息處理函數(shù)都放在dll中：
?所謂的注入，就是讓其它進(jìn)程強(qiáng)制加載一個DLL的意思吧
二至四中，忽悠到了 SetHook... 的最后一個參數(shù)
WINUSERAPI
HHOOK
WINAPI
SetWindowsHookExW(
??? int idHook,
??? HOOKPROC lpfn,
??? HINSTANCE hmod,
??? DWORD dwThreadId);
最后一個是需要注入的 Thread ID
HOOKDLL_API?void?Hook(void)
{
????//?TODO:?Add?extra?initialization?here
#ifndef?WH_KEYBOARD_LL
#define?WH_KEYBOARD_LL?13
#endif
????g_Hook?=?SetWindowsHookEx(WH_KEYBOARD_LL,?MyKeyHook,?g_IT,?8800);
????
????if(?g_Hook?==?NULL?)
????{
????????char?szBuf[200]=?{0};
????????sprintf(szBuf,?"Failed?to?Set?Hook?(%d)",?GetLastError());
????????MessageBox(NULL,?szBuf,?NULL,?MB_OK);
????}
//????return?42;
}
返回的錯誤碼是 87
Google 告訴我，WH_KEYBOARD_LL 不支持線程，只能用 WH_KEYBOARD
修改了下代碼
//?HookDLL.cpp?:?Defines?the?entry?point?for?the?DLL?application.
//
#include?"stdafx.h"
#include?"HookDLL.h"
#include?<stdio.h>
HINSTANCE?g_IT;
BOOL?APIENTRY?DllMain(?HINSTANCE?hInstance,?
???????????????????????DWORD??ul_reason_for_call,?
???????????????????????LPVOID?lpReserved
?????????????????????)
{
????g_IT?=?hInstance;
????switch?(ul_reason_for_call)
????{
????????case?DLL_PROCESS_ATTACH:
????????????MessageBox(NULL,?"DLL_PROCESS_ATTACH",?"",?MB_OK);
????????????break;
????????case?DLL_THREAD_ATTACH:
????????????MessageBox(NULL,?"DLL_THREAD_ATTACH",?"",?MB_OK);
????????????break;
????????case?DLL_THREAD_DETACH:
????????????MessageBox(NULL,?"DLL_THREAD_DETACH",?"",?MB_OK);
????????????break;
????????case?DLL_PROCESS_DETACH:
????????????MessageBox(NULL,?"DLL_PROCESS_DETACH",?"",?MB_OK);
????????????break;
????}
????return?TRUE;
}
//?This?is?an?example?of?an?exported?variable
HOOKDLL_API?int?nHookDLL=0;
HHOOK?g_Hook?=?NULL;
LRESULT?CALLBACK?MyKeyHook(int?code,?WPARAM?wParam,?LPARAM?lParam)
{
#if?(_WIN32_WINNT?<?0x0400)
/*
*?Structure?used?by?WH_KEYBOARD_LL
????*/
????typedef?struct?tagKBDLLHOOKSTRUCT?{
????????DWORD???vkCode;
????????DWORD???scanCode;
????????DWORD???flags;
????????DWORD???time;
????????DWORD???dwExtraInfo;
????}?KBDLLHOOKSTRUCT,?FAR?*LPKBDLLHOOKSTRUCT,?*PKBDLLHOOKSTRUCT;
#endif
????
????PKBDLLHOOKSTRUCT?kbDLLHOOK?=?(PKBDLLHOOKSTRUCT)lParam;
????
????const?char?*info?=?NULL;
????
????if?(wParam?==?WM_KEYDOWN)
????????info?=?"key?down";????
????else?if?(wParam?==?WM_KEYUP)
????????info?=?"key?up";
????else?if?(wParam?==?WM_SYSKEYDOWN)
????????info?=?"sys?key?down";????
????else?if?(wParam?==?WM_SYSKEYUP)
????????info?=?"sys?key?up";
????
????//FILE*?f?=?fopen("hook.txt",?"a+");
????
????//CString?strLog;
????//strLog.Format("%s?-?vkCode?[%04x],?[%c]?scanCode?[%04x]\n",?info,?kbDLLHOOK->vkCode,?kbDLLHOOK->vkCode,?kbDLLHOOK->scanCode);
????
????//fwrite(strLog,?1,?strLog.GetLength(),?f);
????//fclose(f);
????
????//?always?call?next?hook
????//?return?CallNextHookEx(g_Hook,?code,?wParam,?lParam);
????return?TRUE;
}????
//?This?is?an?example?of?an?exported?function.
HOOKDLL_API?void?Hook(void)
{
????//?TODO:?Add?extra?initialization?here
#ifndef?WH_KEYBOARD_LL
#define?WH_KEYBOARD_LL?13
#endif
????g_Hook?=?SetWindowsHookEx(WH_KEYBOARD_LL,?MyKeyHook,?g_IT,?8800);
????
????if(?g_Hook?==?NULL?)
????{
????????char?szBuf[200]=?{0};
????????sprintf(szBuf,?"Failed?to?Set?Hook?(%d)",?GetLastError());
????????MessageBox(NULL,?szBuf,?NULL,?MB_OK);
????}
//????return?42;
}
//?This?is?the?constructor?of?a?class?that?has?been?exported.
//?see?HookDLL.h?for?the?class?definition
CHookDLL::CHookDLL()
{?
????return;?
}
void?CHookTestDlg::OnButton1()?
{
????TCHAR?szPath[MAX_PATH]?=?{0};
????GetModuleFileName(NULL,?szPath,?MAX_PATH);
?????PathRenameExtension(szPath,?_T(""));
????typedef?void?(*TYPE_pfnLoadLibrary)();
????TYPE_pfnLoadLibrary?pfnLoadLibrary?=?NULL;
????HMODULE?Module?=?LoadLibrary(szPath);
????pfnLoadLibrary?=?(TYPE_pfnLoadLibrary)GetProcAddress(Module,?"Hook");
????
????pfnLoadLibrary();
}
其中，8800 是另一個進(jìn)程其中的一個線程，雖然沒返回錯誤碼，但到
8800那條線程所在的進(jìn)程看了下，并沒有注入HookTest.dll （使用 syscheck）
原因是啥，還沒搞清楚
Google到的資料
http://bbs.pediy.com/showthread.php?p=445390http://edison.5d6d.com/thread-742-1-1.html明天再搞