与HOOK相关的APIWord格式.docx
- 文档编号:19926263
- 上传时间:2023-01-12
- 格式:DOCX
- 页数:22
- 大小:303.50KB
与HOOK相关的APIWord格式.docx
《与HOOK相关的APIWord格式.docx》由会员分享,可在线阅读,更多相关《与HOOK相关的APIWord格式.docx(22页珍藏版)》请在冰豆网上搜索。
operatingsystemslikeDOSandWindows3.xx,thepresentWindowsOSasNT/2Kand9xprovidesophisticatedmechanismstoseparateaddressspacesofeachprocess.Thisarchitectureoffersarealmemoryprotection,thusnoapplicationisabletocorrupttheaddressspaceofanotherprocessorintheworsecaseeventocrashtheoperatingsystemitself.Thisfactmakesalotharderthedevelopmentofsystem-awarehooks.
Mymotivationforwritingthisarticlewastheneedforareallysimplehookingframework,thatwillofferaneasytouseinterfaceandabilitytocapturedifferentAPIs.Itintendstorevealsomeofthetricksthatcanhelpyoutowriteyourownspyingsystem.ItsuggestsasinglesolutionhowtobuildasetforhookingWin32APIfunctionsonNT/2Kaswellas98/Me(shortlynamedinthearticle9x)familyWindows.ForthesakeofsimplicityIdecidednottoaddasupportdoUNICODE.However,withsomeminormodificationsofthecodeyoucouldeasilyaccomplishthistask.
Spyingofapplicationsprovidesmanyadvantages:
1.APIfunction'
smonitoring
TheabilitytocontrolAPIfunctioncallsisextremelyhelpfulandenablesdeveloperstotrackdownspecific"
invisible"
actionsthatoccurduringtheAPIcall.Itcontributestocomprehensivevalidationofparametersaswellasreportsproblemsthatusuallyremainoverlookedbehindthescene.Forinstancesometimes,itmightbeveryhelpfultomonitormemoryrelatedAPIfunctionsforcatchingresourceleaks.
2.Debuggingandreverseengineering
BesidesthestandardmethodsfordebuggingAPIhookinghasadeservedreputationforbeingoneofthemostpopulardebuggingmechanisms.ManydevelopersemploytheAPIhookingtechniqueinordertoidentifydifferentcomponentimplementationsandtheirrelationships.APIinterceptionisverypowerfulwayofgettinginformationaboutabinaryexecutable.
3.Peeringinsideoperatingsystem
Oftendevelopersarekeentoknowoperatingsystemindeptandareinspiredbytheroleofbeinga"
debugger"
.HookingisalsoquiteusefultechniquefordecodingundocumentedorpoorlydocumentedAPIs.
4.ExtendingoriginallyofferedfunctionalitiesbyembeddingcustommodulesintoexternalWindowsapplicationsRe-routingthenormalcodeexecutionbyinjectinghookscanprovideaneasywaytochangeandextendexistingmodulefunctionalities.Forexamplemany3rdpartyproductssometimesdon'
tmeetspecificsecurityrequirementsandhavetobeadjustedtoyourspecificneeds.Spyingofapplicationsallowsdeveloperstoaddsophisticatedpre-andpost-processingaroundtheoriginalAPIfunctions.Thisabilityisanextremelyusefulforalteringthebehaviorofthealreadycompiledcode.
Functionalrequirementsofahookingsystem
Therearefewimportantdecisionsthathavetobemade,beforeyoustartimplementinganykindofAPIhookingsystem.Firstofall,youshoulddeterminewhethertohookasingleapplicationortoinstallasystem-awareengine.Forinstanceifyouwouldliketomonitorjustoneapplication,youdon'
tneedtoinstallasystem-widehookbutifyourjobistotrackdownallcallstoTerminateProcess()orWriteProcessMemory()theonlywaytodosoistohaveasystem-awarehook.Whatapproachyouwillchoosedependsontheparticularsituationandaddressesspecificproblems.
GeneraldesignofanAPIspyingframework
UsuallyaHooksystemiscomposedofatleasttwoparts-aHookServerandaDriver.TheHookServerisresponsibleforinjectingtheDriverintotargetedprocessesattheappropriatemoment.ItalsoadministersthedriverandoptionallycanreceiveinformationfromtheDriveraboutitsactivities
whereastheDrivermodulethatperformstheactualinterception.
Thisdesignisroughandbeyonddoubtdoesn'
tcoverallpossibleimplementations.Howeveritoutlinestheboundariesofahookframework.
Onceyouhavetherequirementspecificationofahookframework,therearefewdesignpointsyoushouldtakeintoaccount:
∙Whatapplicationsdoyouneedtohook
∙HowtoinjecttheDLLintotargetedprocessesorwhichimplantingtechniqueto
follow
∙Whichinterceptionmechanismtouse
Ihopenextthefewsectionswillprovideanswerstothoseissues.
Injectingtechniques
1.Registry
InordertoinjectaDLLintoprocessesthatlinkwithUSER32.DLL,yousimplycanaddtheDLLnametothevalueofthefollowingregistrykey:
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Windows\AppInit_DLLs
ItsvaluecontainsasingleDLLnameorgroupofDLLsseparatedeitherbycommaorspaces.AccordingtoMSDNdocumentation[7],allDLLsspecifiedbythevalueofthatkeyareloadedbyeachWindows-basedapplicationrunningwithinthecurrentlogonsession.ItisinterestingthattheactualloadingoftheseDLLsoccursasapartofUSER32'
sinitialization.USER32readsthevalueofmentionedregistrykeyandcallsLoadLibrary()fortheseDLLsinitsDllMaincode.HoweverthistrickappliesonlytoapplicationsthatuseUSER32.DLL.Anotherrestrictionisthatthisbuilt-inmechanismissupportedonlybyNTand2Koperatingsystems.AlthoughitisaharmlesswaytoinjectaDLLintoaWindowsprocessestherearefewshortcomings:
oInordertoactivate/deactivatetheinjectionprocessyouhavetorebootWindows.
oTheDLLyouwanttoinjectwillbemappedonlyintotheseprocessesthatuseUSER32.DLL,thusyoucannotexpecttogetyourhookinjectedintoconsoleapplications,sincetheyusuallydon'
timportfunctionsfromUSER32.DLL.
oOntheotherhandyoudon'
thaveanycontrolovertheinjectionprocess.ItmeansthatitisimplantedintoeverysingleGUIapplication,regardlessyouwantitornot.Itisaredundantoverheadespeciallyifyouintendtohookfewapplicationsonly.Formoredetailssee[2]"
InjectingaDLLUsingtheRegistry"
2.System-wideWindowsHooks
CertainlyaverypopulartechniqueforinjectingDLLintoatargetedprocessreliesonprovidedbyWindowsHooks.AspointedoutinMSDNahookisatrapinthesystemmessage-handlingmechanism.Anapplicationcaninstallacustomfilterfunctiontomonitorthemessagetrafficinthesystemandprocesscertaintypesofmessagesbeforetheyreachthetargetwindowprocedure.
AhookisnormallyimplementedinaDLLinordertomeetthebasicrequirementforsystem-widehooks.Thebasicconceptofthatsortofhooksisthatthehookcallbackprocedureisexecutedintheaddressspacesofeachhookedupprocessinthesystem.ToinstallahookyoucallSetWindowsHookEx()withtheappropriateparameters.Oncetheapplicationinstallsasystem-widehook,theoperatingsystemmapstheDLLintotheaddressspaceineachofitsclientprocesses.ThereforeglobalvariableswithintheDLLwillbe"
per-process"
andcannotbesharedamongtheprocessesthathaveloadedthehookDLL.Allvariablesthatcontainshareddatamustbeplacedinashareddatasection.ThediagrambellowshowsanexampleofahookregisteredbyHookServerandinjectedintotheaddressspaces
named"
Applicationone"
and"
Applicationtwo"
.
Figure1
Asystem-widehookisregisteredjustoneswhenSetWindowsHookEx()isexecuted.Ifnoerroroccursahandletothehookisreturned.Thereturned
valueisrequiredattheendofthecustomhookfunctionwhenacalltoCallNextHookEx()hastobemade.AfterasuccessfulcalltoSetWindowsHookEx(),theoperatingsysteminjectstheDLLautomatically(butnotnecessaryimmediately)intoallprocessesthatmeettherequirementsforthisparticularhookfilter.Let'
shaveacloserlookatthefollowingdummyWH_GETMESSAGEfilterfunction:
Collapse
//---------------------------------------------------------------------------
//GetMsgProc
//
//FilterfunctionfortheWH_GETMESSAGE-it'
sjustadummyfunction
LRESULTCALLBACKGetMsgProc(
intcode,//hookcode
WPARAMwParam,//removaloption
LPARAMlParam//message
)
{
//WemustpasstheallmessagesontoCallNextHookEx.
return:
:
CallNextHookEx(sg_hGetMsgHook,code,wParam,lParam);
}
Asystem-widehookisloadedbymultipleprocessesthatdon'
tsharethesameaddressspace.
Forinstancehookhandlesg_hGetMsgHook,thatisobtainedbySetWindowsHookEx()andisusedasparameterinCallNextHookEx()mustbeusedvirtuallyinalladdressspaces.ItmeansthatitsvaluemustbesharedamonghookedprocessesaswellastheHookServerapplication.Inordertomakethisvariable"
visible"
toallprocessesweshouldstoreitintheshareddatasection.
Thefollowingisanexampleofemploying#pragmadata_seg().HereIwouldliketomentionthatthedatawithinthesharedsectionmustbeinitialized,otherwisethevariableswillbeassignedtothedefaultdatasegmentand#pragmadata_seg()willhavenoeffect.
//Sharedbyallprocessesvariables
#pragmadata_seg("
.HKT"
)
HHOOKsg_h
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- HOOK 相关 API