Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Structure IMAGE_IMPORT_DESCRIPTOR
- OriginalFirstThunk.l
- TimeDateStamp.l
- ForwarderChain.l
- Name.l
- FirstThunk.l
- EndStructure
- Structure IMAGE_THUNK_DATA
- *Function
- EndStructure
- Prototype.l _ImageDirectoryEntryToData(ImageBase.l,MappedAsImage.l,DirectoryEntry.l,Size.l)
- Import "Kernel32.lib"
- GetProcAddress_(hMod.i, Name.p-ascii) As "_GetProcAddress@8"
- EndImport
- Procedure __MyDebug(str.s)
- Debug str
- EndProcedure
- Procedure __MyError(str.s)
- Debug str
- EndProcedure
- Procedure __MyWarn(str.s)
- Debug str
- EndProcedure
- Prototype.i MyCloseHandle(hFile)
- Global OrgCloseHandle.MyCloseHandle
- Procedure __GetModuleIATLastByte(*Module.IMAGE_DOS_HEADER)
- Protected *Img_NT_Headers.IMAGE_NT_HEADERS
- If *Module
- *Img_NT_Headers = *Module + *Module\e_lfanew
- If *Img_NT_Headers
- If *Img_Nt_Headers\OptionalHeader
- If *Img_Nt_Headers\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_IAT]
- ProcedureReturn *Img_Nt_Headers\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_IAT]\Size + *Img_Nt_Headers\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_IAT]\VirtualAddress
- EndIf
- EndIf
- EndIf
- EndIf
- ProcedureReturn #Null
- EndProcedure
- Procedure.i __HOOKAPI_SetMemoryProtection(*Addr, iProtection)
- Protected mbi.MEMORY_BASIC_INFORMATION, iOldProtection.i
- If VirtualQuery_(*addr, mbi.MEMORY_BASIC_INFORMATION,SizeOf(MEMORY_BASIC_INFORMATION))
- If VirtualProtect_(mbi\BaseAddress, mbi\RegionSize, iProtection, @iOldProtection)
- ProcedureReturn iOldProtection
- EndIf
- EndIf
- ProcedureReturn -1
- EndProcedure
- Procedure.i __HOOKAPI_GetImportTable(*Module.IMAGE_DOS_HEADER)
- Protected ImageDirectoryEntryToData._ImageDirectoryEntryToData
- Protected *Imagehlp
- Protected iErrMode.i
- Protected *ptr.LONG,*pEntryImports.IMAGE_IMPORT_DESCRIPTOR
- Protected *Img_NT_Headers.IMAGE_NT_HEADERS
- If *Module
- ; ;iErrMode = SetErrorMode_(#SEM_FAILCRITICALERRORS) ; Don't display error messages
- ; *Imagehlp = GetModuleHandle_("imagehlp.dll")
- ;
- ; ;First try To use imagehlp API (2000/XP/Vista)
- ; If *Imagehlp
- ; ImageDirectoryEntryToData = GetProcAddress_(*Imagehlp,"ImageDirectoryEntryToData")
- ; If ImageDirectoryEntryToData
- ; *pEntryImports = ImageDirectoryEntryToData(*Module, #True, #IMAGE_DIRECTORY_ENTRY_IMPORT, @lSize)
- ; If *pEntryImports
- ; ProcedureReturn *pEntryImports
- ; EndIf
- ; EndIf
- ; EndIf
- ;If imagehlp api is not available
- *Img_NT_Headers = *Module + *Module\e_lfanew
- If *Img_NT_Headers
- *ptr = *Img_Nt_Headers\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_IMPORT]
- If *ptr
- *pEntryImports = *Module + *ptr\l
- ProcedureReturn *pEntryImports
- EndIf
- EndIf
- EndIf
- ProcedureReturn #Null
- EndProcedure
- Procedure.i __HOOKAPI_GetExportTable(*Module.IMAGE_DOS_HEADER)
- Protected ImageDirectoryEntryToData._ImageDirectoryEntryToData
- Protected *Imagehlp
- Protected iErrMode.i
- Protected *ptr.LONG,*pEntryExports.IMAGE_EXPORT_DIRECTORY
- Protected *Img_NT_Headers.IMAGE_NT_HEADERS
- If *Module
- ; ;iErrMode = SetErrorMode_(#SEM_FAILCRITICALERRORS) ; Don't display error messages
- ; *Imagehlp = GetModuleHandle_("imagehlp.dll")
- ; ;SetErrorMode_(iErrMode)
- ;
- ; ; First try to use imagehlp API (2000/XP/Vista)
- ; If *Imagehlp
- ; ImageDirectoryEntryToData = GetProcAddress_(*Imagehlp,"ImageDirectoryEntryToData")
- ; If ImageDirectoryEntryToData
- ; *pEntryExports = ImageDirectoryEntryToData(*Module, #True, #IMAGE_DIRECTORY_ENTRY_EXPORT, @lSize)
- ; If *pEntryExports
- ; ProcedureReturn *pEntryExports
- ; EndIf
- ; EndIf
- ; EndIf
- ;If imagehlp api is not available
- *Img_NT_Headers = *Module + *Module\e_lfanew
- If *Img_NT_Headers
- *ptr = *Img_Nt_Headers\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_EXPORT]
- If *ptr
- *pEntryExports = *Module + *ptr\l
- ProcedureReturn *pEntryExports
- EndIf
- EndIf
- EndIf
- ProcedureReturn #Null
- EndProcedure
- Procedure.s __GetRealModuleName(sModule.s)
- ;CompilerIf #USE_NOT_RECOMMENDED_WIN8_VIRTUAL_FILE_FIX
- ; ProcedureReturn sModule ; Just always return the file name
- ;CompilerElse
- If OSVersion() >= #PB_OS_Windows_8 ; F�r WINDOWS 8
- Protected modulehandle, result.s = sModule
- ; Echten Modulnamen ermittelt notwendig, weil in den Importtabellen der DLLs steht api-ms...
- ; Da wir aber KernelBase.dll anstelle von Kernel32.dll hooken und GetModuleHandle("api-ms...") das gleiche wie f�r KernelBase.dll zur�ckgibt,
- ; m�ssen wir sicherstellen, das die Funktionen auch gehookt werden (ohne __GetRealModuleName() w�rde es nicht gehookt werden, das api-ms...dll <> KernelBase.dll!)
- modulehandle = GetModuleHandle_(sModule)
- If modulehandle <> #Null;If it fails return at least sModule
- result.s = Space(2048 + 1)
- If GetModuleFileName_(modulehandle, @result, 2048) = 0
- result = sModule ; 0 bedeuted fehler
- EndIf
- EndIf
- ProcedureReturn result
- Else
- ProcedureReturn sModule ; F�R < WIN 8 einfach den Modulnamen zur�ckgeben
- EndIf
- ;CompilerEndIf
- EndProcedure
- Procedure.i __HOOKAPI_ReplaceImportedFunctionInModule(hModule.i,sModuleName.s, sFunction.s, *NewFunctionPtr, *OldFunction)
- Protected *ImportedDLLs.IMAGE_IMPORT_DESCRIPTOR, LastByte.i
- Protected sName.s, addr1.i, *itd.IMAGE_THUNK_DATA, iOldProtection.i
- If *OldFunction
- *ImportedDLLs.IMAGE_IMPORT_DESCRIPTOR = __HOOKAPI_GetImportTable(hModule)
- If *ImportedDLLs
- LastByte.i = __GetModuleIATLastByte(hModule) + hModule
- While *ImportedDLLs\Name And *ImportedDLLs\FirstThunk
- sName.s = ""
- If *ImportedDLLs\Name And *ImportedDLLs\FirstThunk
- addr1 = *ImportedDLLs\Name + hModule;RvaToVa(hModule,*ImportedDLLs\Name)
- If *ImportedDLLs\Name And LastByte - (*ImportedDLLs\FirstThunk + hModule) > 0 And hModule
- ;XXXDebug = *ImportedDLLs\Name
- ;sName.s = UCase(PeekS(hModule + *ImportedDLLs\Name))
- sName.s = UCase(PeekS(addr1,-1, #PB_Ascii)) ; 2010-08-31
- EndIf
- EndIf
- ;__HookLogDebug( sName
- If UCase(__GetRealModuleName(sName)) = UCase(__GetRealModuleName(sModuleName))
- *itd.IMAGE_THUNK_DATA = *ImportedDLLs\FirstThunk + hModule
- If *ImportedDLLs\FirstThunk
- ;*itd.IMAGE_THUNK_DATA = RvaToVa(hModule,*ImportedDLLs\FirstThunk)
- ;If *itd
- While *itd\Function
- If *itd\Function = *OldFunction
- iOldProtection.i = __HOOKAPI_SetMemoryProtection(*itd, #PAGE_EXECUTE_READWRITE)
- If iOldProtection <> -1
- *itd\Function = *NewFunctionPtr ; Set new Function pointer
- __MyDebug("replace pointer for " + sFunction)
- __HOOKAPI_SetMemoryProtection(*itd, iOldProtection)
- Else
- __MyError("ERROR: cannot set memory protection")
- EndIf
- EndIf
- *itd + SizeOf(IMAGE_THUNK_DATA)
- Wend
- EndIf
- EndIf
- *ImportedDLLs + SizeOf(IMAGE_IMPORT_DESCRIPTOR)
- Wend
- Else
- __MyError("ERROR: cannot get import table")
- EndIf
- Else
- EndIf
- EndProcedure
- Procedure.i __HOOKAPI_ReplaceExportedFunctionInModule(sModuleName.s, sFunction.s, *NewFunctionPtr, *OldFunction)
- Protected hModule.i, *ExportedFunctions.IMAGE_EXPORT_DIRECTORY
- Protected *Addr.Integer, i.i, iOldProtection.i
- hModule.i = GetModuleHandle_(sModuleName.s)
- If *OldFunction And *NewFunctionPtr And hModule
- *ExportedFunctions.IMAGE_EXPORT_DIRECTORY = __HOOKAPI_GetExportTable(hModule)
- If *ExportedFunctions
- *Addr.Integer = *ExportedFunctions\AddressOfFunctions + hModule
- If *Addr
- For i = 0 To *ExportedFunctions\NumberOfFunctions - 1
- If *Addr\i + hModule = *OldFunction
- iOldProtection.i = __HOOKAPI_SetMemoryProtection(*Addr, #PAGE_EXECUTE_READWRITE)
- If iOldProtection <> -1
- ;k= *Addr\i
- ;MessageBox_(0,Str(*Addr),Str(IsBadWritePtr_(*addr,4)),#MB_OK)
- *Addr\i = *NewFunctionPtr - hModule
- ;new = k;*NewFunctionPtr - hModule
- ;WriteProcessMemory_(GetCurrentProcess_(),*Addr,@new,4,#Null)
- __HOOKAPI_SetMemoryProtection(*Addr, iOldProtection)
- EndIf
- EndIf
- *Addr + SizeOf(Integer)
- Next
- EndIf
- EndIf
- EndIf
- EndProcedure
- Procedure.s __GetModuleFullPath(sModule.s)
- Protected hModule.i,sName.s
- hModule = GetModuleHandle_(sModule)
- If hModule
- sName.s =Space(#MAX_PATH+1)
- GetModuleFileName_(hModule, @sName, #MAX_PATH)
- If Trim(sName) <> ""
- sModule = sName
- EndIf
- EndIf
- ProcedureReturn sModule
- EndProcedure
- Procedure.i __HOOKAPI_ReplaceImportedFunctionInAllModules(sModuleName.s, sFunction.s, *NewFunctionPtr, *OldFunction)
- Protected iResult.i, snapshot.i, modulehandle.MODULEENTRY32
- iResult.i = #False
- snapshot = CreateToolhelp32Snapshot_(#TH32CS_SNAPMODULE, 0)
- If snapshot
- modulehandle.MODULEENTRY32
- modulehandle\dwSize = SizeOf(MODULEENTRY32)
- If Module32First_(snapshot, @modulehandle)
- While Module32Next_(snapshot, @modulehandle)
- If modulehandle\hModule
- ;If Not __IsModuleInBlackList(PeekS(@modulehandle\szModule)) ; 2010-08-30 ; 2010-09-13 Unicode Bugfix
- ;If g_VirtualFile\bFirstFunctionModuleOutput
- __MyDebug("Hooking import table of " + __GetModuleFullPath(PeekS(@modulehandle\szModule))) ; 2010-08-30 ; 2010-09-13 Unicode Bugfix
- ;EndIf
- iResult = __HOOKAPI_ReplaceImportedFunctionInModule(modulehandle\hModule, sModuleName, sFunction, *NewFunctionPtr, *OldFunction)
- ;Else
- ; __MyDebug(PeekS(@modulehandle\szModule) + " is in black list, ignoring...") ; 2010-08-30 ; 2010-09-13 Unicode Bugfix
- ;EndIf
- EndIf
- Wend
- EndIf
- If OrgCloseHandle
- OrgCloseHandle(snapshot)
- Else
- __MyWarn("Orginal CloseHandle is null, handle cannot be released!")
- EndIf
- ;CloseHandle_(snapshot)
- EndIf
- iResult = __HOOKAPI_ReplaceImportedFunctionInModule(GetModuleHandle_(0), sModuleName, sFunction, *NewFunctionPtr, *OldFunction)
- ProcedureReturn iResult
- EndProcedure
- Procedure.i __HookApi(sModule.s, sFunction.s, *NewFunction, bHookExport = #True, bHookImport = #True)
- Protected *OldFunction
- If *NewFunction
- __MyDebug("Hooking function " + sModule + " " + sFunction)
- *OldFunction = GetProcAddress_(GetModuleHandle_(sModule), sFunction)
- If bHookImport
- __HOOKAPI_ReplaceImportedFunctionInAllModules(sModule.s, sFunction.s, *NewFunction, *OldFunction)
- EndIf
- If bHookExport
- __HOOKAPI_ReplaceExportedFunctionInModule(sModule.s, sFunction.s, *NewFunction, *OldFunction)
- EndIf
- ProcedureReturn *OldFunction
- EndIf
- EndProcedure
- Procedure wix(a)
- Debug "wix"
- EndProcedure
- old = __HookApi("Kernel32.dll", "LoadLibraryW",@wix())
- Debug old
- LoadLibrary_("xxy")
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement