Detours 拦截API导致目标程序崩溃

Question

系统环境为Windows7,X64,注入程序,DLL,目标程序为VS2013生成的Win32项目
代码再回复中贴出

Answer 1

// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
#include "detours.h"
#include
#include
#include
#include
#include

#pragma comment(lib, "detours.lib")

static BOOL(WINAPI*system_BitBlt)(HDC hdcDest, int nXDest, int nYDest,
int nWidth, int nHeight, HDC hdcSrc, int nXSrc, int nYSrc, DWORD dwRop) = BitBlt;
BOOL hook_BitBlt(HDC hdcDest, int nXDest, int nYDest, int nWidth, int nHeight,
HDC hdcSrc, int nXSrc, int nYSrc, DWORD dwRop)
{
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[2560] = { 0 };
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_BitBlt\r\nhdcDest %s\r\nnXDest %d\r\nnYDest %d\r\nnWidth %d\r\nnHeight %d\r\nhdcSrc %s\r\nnXsrc %d\r\nnySrc %d \r\ndwRop %d",
GetCurrentProcessId(), szProcessPathname, hdcDest, nXDest, nYDest, nWidth, nHeight, hdcSrc, nXSrc, nYSrc, dwRop);

//StringCchPrintfW(sz, _countof(sz),
    //L"\r\nProcess: (%d) %s\r\nhook_BitBlt",
    //GetCurrentProcessId(), szProcessPathname);
FILE *fp;
fopen_s(&fp, "C:\\PosLabel.txt", "a");
fwrite(sz, sizeof(char), sizeof(sz), fp);
fclose(fp);

return system_BitBlt(hdcDest, nXDest, nYDest, nWidth, nHeight, hdcSrc, nXSrc, nYSrc, dwRop);

}
static BOOL(WINAPI*system_OpenPrinterA)(LPSTR pPrinterName, LPHANDLE phPrinter, LPPRINTER_DEFAULTSA pDefault) = OpenPrinterA;
BOOL hook_OpenPrinterA(LPSTR pPrinterName, LPHANDLE phPrinter, LPPRINTER_DEFAULTSA pDefault)
{
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[256] = { 0 };
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_OpenPrinter",
GetCurrentProcessId(), szProcessPathname);

FILE *fp;
fopen_s(&fp, "C:\\PosLabel.txt", "a");
fwrite(sz, sizeof(char), sizeof(sz), fp);
fclose(fp);

return system_OpenPrinterA(pPrinterName, phPrinter, pDefault);

}

static BOOL(WINAPI*system_GetTextExtentPoint32A)(HDC hdc, LPCSTR lpstring, int c, LPSIZE lpSize) = GetTextExtentPoint32A;
BOOL hook_GetTextExtentPoint32A(HDC hdc, LPCSTR lpstring, int c, LPSIZE lpSize)
{
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[256] = { 0 };
/*StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_GetTextExtentPoint32A\r\nhdc:%s\r\nlpstring:%s\r\nc:%d\r\nlpSize:%d",
GetCurrentProcessId(), szProcessPathname, hdc, lpstring, c, lpSize);*/
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_GetTextExtentPoint32A\r\nlpstring:%s\r\nc:%d\r\nlpSizex:%d\r\nlpSizey:%d",
GetCurrentProcessId(), szProcessPathname, lpstring, c, lpSize->cx, lpSize->cy);

FILE *fp;
fopen_s(&fp, "C:\\PosLabel.txt", "a");
fwrite(sz, sizeof(char), sizeof(sz), fp);
fclose(fp);

return system_GetTextExtentPoint32A(hdc, lpstring, c, lpSize);

}
static HFONT(WINAPI*system_CreateFontA)(int cHeight, int cWidth, int cEscapement, int cOrientation, int cWeight, DWORD bItalic,
DWORD bUnderline, DWORD bStrikeOut, DWORD iCharSet, DWORD iOutPrecision, DWORD iClipPrecision,
DWORD iQuality, DWORD iPitchAndFamily, LPCSTR pszFaceName) = CreateFontA;
static HFONT(WINAPI*system_CreateFontW)(int cHeight, int cWidth, int cEscapement, int cOrientation, int cWeight, DWORD bItalic,
DWORD bUnderline, DWORD bStrikeOut, DWORD iCharSet, DWORD iOutPrecision, DWORD iClipPrecision,
DWORD iQuality, DWORD iPitchAndFamily, LPCWSTR pszFaceName) = CreateFontW;
HFONT hook_CreateFontA(int cHeight, int cWidth, int cEscapement, int cOrientation, int cWeight, DWORD bItalic,
DWORD bUnderline, DWORD bStrikeOut, DWORD iCharSet, DWORD iOutPrecision, DWORD iClipPrecision,
DWORD iQuality, DWORD iPitchAndFamily, LPCSTR pszFaceName)
{
//MessageBoxA(NULL, "Hook This!", "My hook", MB_OK);
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[256] = { 0 };
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_CreateFontA\r\n%s",
GetCurrentProcessId(), szProcessPathname, pszFaceName);

    FILE *fp;
    fopen_s(&fp, "C:\\PosLabel.txt", "a");
    fwrite(sz, sizeof(char), sizeof(sz), fp);
    fclose(fp);
    return system_CreateFontA(cHeight, cWidth, cEscapement, cOrientation, cWeight, bItalic,
        bUnderline, bStrikeOut, iCharSet, iOutPrecision, iClipPrecision,
        iQuality, iPitchAndFamily, pszFaceName);

}
HFONT hook_CreateFontW(int cHeight, int cWidth, int cEscapement, int cOrientation, int cWeight, DWORD bItalic,
DWORD bUnderline, DWORD bStrikeOut, DWORD iCharSet, DWORD iOutPrecision, DWORD iClipPrecision,
DWORD iQuality, DWORD iPitchAndFamily, LPCWSTR pszFaceName)
{
//MessageBoxA(NULL, "Hook This!", "My hook", MB_OK);
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[256] = { 0 };
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_CreateFontW\r\n%s",
GetCurrentProcessId(), szProcessPathname, pszFaceName);

    FILE *fp;
    fopen_s(&fp, "C:\\PosLabel.txt", "a");
    fwrite(sz, sizeof(char), sizeof(sz), fp);
    fclose(fp);
    return system_CreateFontW(cHeight, cWidth, cEscapement, cOrientation, cWeight, bItalic,
        bUnderline, bStrikeOut, iCharSet, iOutPrecision, iClipPrecision,
        iQuality, iPitchAndFamily, pszFaceName);

}
static int(WINAPI*system_StartPage)(HDC hdc) = StartPage;
int hook_StartPage(HDC hdc)
{
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[256] = { 0 };
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_StartPage",
GetCurrentProcessId(), szProcessPathname);

FILE *fp;
fopen_s(&fp, "C:\\PosLabel.txt", "a");
fwrite(sz, sizeof(char), sizeof(sz), fp);
fclose(fp);
return system_StartPage(hdc);

}
static int(WINAPI*system_EndPage)(HDC hdc) = EndPage;
int hook_EndPage(HDC hdc)
{
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[256] = { 0 };
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_CreateFontA\r\n%s",
GetCurrentProcessId(), szProcessPathname, hdc);

FILE *fp;
fopen_s(&fp, "C:\\PosLabel.txt", "a");
fwrite(sz, sizeof(char), sizeof(sz), fp);
fclose(fp);
return system_EndPage(hdc);

}
static BOOL(WINAPI*system_TextOutA)(HDC hdc, int x, int y, LPCSTR lpString, int c) = TextOutA;
static BOOL(WINAPI*system_TextOutW)(HDC hdc, int x, int y, LPCWSTR lpString, int c) = TextOutW;
BOOL hook_TextOutA(HDC hdc, int x, int y, LPCSTR lpString, int c)
{
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[256] = { 0 };
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_TextOutA\r\nHDC:%s\r\n%s",
GetCurrentProcessId(), szProcessPathname, hdc, lpString);

FILE *fp;
fopen_s(&fp, "C:\\PosLabel.txt", "a");
fwrite(sz, sizeof(char), sizeof(sz), fp);
fclose(fp);
return system_TextOutA(hdc, x, y, lpString, c);

}
BOOL hook_TextOutW(HDC hdc, int x, int y, LPCWSTR lpString, int c)
{
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
wchar_t sz[256] = { 0 };
StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_TextOutW\r\nHDC:%s\r\n%s",
GetCurrentProcessId(), szProcessPathname, hdc, lpString);

FILE *fp;
fopen_s(&fp, "C:\\PosLabel.txt", "a");
fwrite(sz, sizeof(char), sizeof(sz), fp);
fclose(fp);
return system_TextOutW(hdc, x, y, lpString, c);

}
static int(WINAPI* system_GetDeviceCaps)(HDC hdc, int index) = GetDeviceCaps;
int hook_GetDeviceCaps(HDC hdc, int index)
{
int ret = system_GetDeviceCaps(hdc, index);
wchar_t szProcessPathname[MAX_PATH];
::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
//wchar_t sz[256] = { 0 };
char sz[256] = { 0 };
/*StringCchPrintfW(sz, _countof(sz),
L"\r\nProcess: (%d) %s\r\n\r\nhook_GetDeviceCaps",
GetCurrentProcessId(), szProcessPathname);
StringCchPrintfA(sz, _countof(sz),
"\r\nhook_GetDeviceCaps\r\nhdc:%s\r\nindex:%d\r\nret %d", hdc, index, ret);*/
StringCchPrintfA(sz, _countof(sz),
"\r\nhook_GetDeviceCaps\r\nret %d", ret);
FILE *fp;
fopen_s(&fp, "C:\PosLabel.txt", "a");
fwrite(sz, sizeof(char), sizeof(sz), fp);
fclose(fp);
return ret;
}

//typedef int (WINAPI *PfuncMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);
//typedef int (WINAPI *PfuncMessageBoxW)(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType);
//
//PVOID system_MessageBoxA = DetourFindFunction("User32.dll", "MessageBoxA");
//PVOID system_MessageBoxW = DetourFindFunction("User32.dll", "MessageBoxW");
//
//int WINAPI hook_MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType)
//{
// wchar_t szProcessPathname[MAX_PATH];
// ::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
// wchar_t sz[256] = { 0 };
// StringCchPrintfW(sz, _countof(sz),
// L"\r\nProcess: (%d) %s\r\n\r\nHook_MessageBoxWsss\r\n\r\nhWnd %s\r\nlpText %s\r\nlpCaption %s\r\nuType %d",
// GetCurrentProcessId(), szProcessPathname, hWnd, lpText, lpCaption, uType);
//
// FILE *fp;
// fopen_s(&fp, "C:\notepad.txt", "a");
// fwrite(sz, sizeof(char), sizeof(sz), fp);
// fclose(fp);
// return ((PfuncMessageBoxA)system_MessageBoxA)(hWnd, "Hook This!", "My hook", uType);
//}
//
//int WINAPI hook_MessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType)
//{
// wchar_t szProcessPathname[MAX_PATH];
// ::GetModuleFileName(NULL, szProcessPathname, MAX_PATH);
// wchar_t sz[256] = { 0 };
// StringCchPrintfW(sz, _countof(sz),
// L"\r\nProcess: (%d) %s\r\n\r\nHook_MessageBoxWsss\r\n\r\nhWnd %s\r\nlpText %s\r\nlpCaption %s\r\nuType %d",
// GetCurrentProcessId(), szProcessPathname, hWnd, lpText, lpCaption, uType);
//
// FILE *fp;
// fopen_s(&fp, "C:\notepad.txt", "a");
// fwrite(sz, sizeof(char), sizeof(sz), fp);
// fclose(fp);
// return ((PfuncMessageBoxW)system_MessageBoxW)(hWnd, L"Hook This!", L"My hook", uType);
//}

BOOL APIENTRY InstallHook()
{
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
//DetourAttach((PVOID*)&system_OpenPrinterA, hook_OpenPrinterA);//引起崩溃的函数
//DetourAttach((PVOID*)&system_StartPage, hook_StartPage);//引起崩溃的函数
//DetourAttach((PVOID*)&system_EndPage, hook_EndPage);//引起崩溃的函数
//DetourAttach((PVOID*)&system_BitBlt, hook_BitBlt);//引起崩溃的函数
//DetourAttach((PVOID*)&system_GetTextExtentPoint32A, hook_GetTextExtentPoint32A);//引起崩溃的函数
//DetourAttach((PVOID*)&system_GetDeviceCaps, hook_GetDeviceCaps);//引起崩溃的函数

    DetourAttach((PVOID*)&system_TextOutA, hook_TextOutA);               //没有引起崩溃的函数
DetourAttach((PVOID*)&system_TextOutW, hook_TextOutW);               //没有引起崩溃的函数
/*DetourAttach((PVOID*)&system_CreateFontA, hook_CreateFontA);    //没有引起崩溃的函数
DetourAttach((PVOID*)&system_CreateFontW, hook_CreateFontW);*/  //没有引起崩溃的函数

LONG ret = DetourTransactionCommit();
return ret == NO_ERROR;

}

BOOL APIENTRY UnInstallHook()
{
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());

//DetourDetach((PVOID*)&system_StartPage, hook_StartPage);
//DetourDetach((PVOID*)&system_EndPage, hook_EndPage);
//DetourDetach((PVOID*)&system_BitBlt, hook_BitBlt);
//DetourDetach((PVOID*)&system_GetTextExtentPoint32A, hook_GetTextExtentPoint32A);
//DetourDetach((PVOID*)&system_GetDeviceCaps, hook_GetDeviceCaps);
//DetourDetach((PVOID*)&system_OpenPrinterA, hook_OpenPrinterA);


DetourDetach((PVOID*)&system_TextOutA, hook_TextOutA);
DetourDetach((PVOID*)&system_TextOutW, hook_TextOutW);
/*DetourDetach((PVOID*)&system_CreateFontA, hook_CreateFontA);
DetourDetach((PVOID*)&system_CreateFontW, hook_CreateFontW);*/
LONG ret = DetourTransactionCommit();
return ret == NO_ERROR;

}

BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
OutputDebugString(L"DLL_PROCESS_ATTACH\n");
if (!InstallHook())
MessageBoxA(NULL, "No InstallHook Failed", "DllMain", MB_OK);
break;

case DLL_THREAD_ATTACH:break;
case DLL_THREAD_DETACH:break;
case DLL_PROCESS_DETACH:
    OutputDebugString(L"DLL_PROCESS_DETACH\n");
    if (!UnInstallHook())
        MessageBoxA(NULL, "No UnInstallHook Failed", "DllMain", MB_OK);
    break;
}
return TRUE;

}

//注入程序
// createhook.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include
#include
#include
#include
#include
#include
#include

void ErrorExit(LPTSTR lpszFunction)
{
LPVOID lpMsgBuf;
LPVOID lpDisplayBuf;
DWORD dw = GetLastError();
FormatMessage(
FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
dw,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR)&lpMsgBuf,
0, NULL);
lpDisplayBuf = (LPVOID)LocalAlloc(LMEM_ZEROINIT,
(lstrlen((LPCTSTR)lpMsgBuf) + lstrlen((LPCTSTR)lpszFunction) + 40)*sizeof(TCHAR));
StringCchPrintf((LPTSTR)lpDisplayBuf,
LocalSize(lpDisplayBuf),
TEXT("\r\n%s failed with error %d: %s"),
lpszFunction, dw, lpMsgBuf);
MessageBox(NULL, (LPCTSTR)lpDisplayBuf, TEXT("Error"), MB_OK);

FILE *fp;
fopen_s(&fp, "C:\\errorlog.txt", "a ");
fwrite(lpDisplayBuf, sizeof(char), sizeof(lpDisplayBuf), fp);
fclose(fp);

LocalFree(lpMsgBuf);
LocalFree(lpDisplayBuf);
//ExitProcess(dw);

}

int EnableDebugPrivilege(const char* name)
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
LUID luid;
//打开进程令牌环
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
&hToken);
//ErrorExit("OpenProcessToken ");
//查看系统权限的特权值，返回信息到一个LUID结构体里
LookupPrivilegeValueA(NULL, name, &luid);
//ErrorExit("LookupPrivilegeValueA ");
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
tp.Privileges[0].Luid = luid;
//调整权限
AdjustTokenPrivileges(hToken, 0, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
ErrorExit("AdjustTokenPrivileges ");

return 0;

}

BOOL InjectDll(const char* dll_absolute_path, const DWORD dwRemoteProcessID)
{
HANDLE hRemoteProcess;
EnableDebugPrivilege(SE_DEBUG_NAME);
//打开远程线程
hRemoteProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwRemoteProcessID);
//ErrorExit("OpenProcess ");
//printf_s("hRemoteProcess:%d", hRemoteProcess);
if (hRemoteProcess == NULL)
MessageBox(NULL, "No hRemoteProcess Failed", TEXT("InjectDll"), MB_OK);

char* pszLibFileRemote;
//使用VirtualAllocEx函数在远程进程的内存地址空间分配dll文件名空间
pszLibFileRemote = (char *)VirtualAllocEx(hRemoteProcess, NULL,
    lstrlen(dll_absolute_path) + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (pszLibFileRemote == NULL)
    MessageBox(NULL, "No  pszLibFileRemote Failed", TEXT("VirtualAllocEx"), MB_OK);
//ErrorExit("VirtualAllocEx "); 
//使用WriteProcessMemory函数将DLL的路径名写入到远程进程的内存空间
if (WriteProcessMemory(hRemoteProcess, pszLibFileRemote, (void*)dll_absolute_path,
    lstrlen(dll_absolute_path) + 1, NULL) != TRUE)
{
    MessageBox(NULL, "No  WriteProcessMemory Failed", TEXT("WriteProcessMemory"), MB_OK);
}

//ErrorExit("WriteProcessMemory ");
//printf_s("WriteProcessMemory:%d", GetLastError());
//计算LoadLibarayA的入口地址
PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress
    (GetModuleHandleA("Kernel32.dll"), "LoadLibraryA");
if (pfnStartAddr == NULL)
{
    MessageBox(NULL, "No  GetProcAddress Failed", TEXT("GetProcAddress"), MB_OK);
}
//ErrorExit("GetProcAddress ");

//启动远程线程LoadLibraryA,通过远程线程创建新线程
HANDLE hRemoteThread;
if ((hRemoteThread = CreateRemoteThread(hRemoteProcess, NULL, 0,
    pfnStartAddr, pszLibFileRemote, 0, NULL)) == NULL)
{
    MessageBox(NULL, "No  CreateRemoteThread Failed", TEXT("CreateRemoteThread"), MB_OK);
    return FALSE;
}
WaitForSingleObject(hRemoteThread, INFINITE);
if (pszLibFileRemote != NULL)
    VirtualFreeEx(hRemoteProcess, pszLibFileRemote,0, MEM_COMMIT);



//ErrorExit("CreateRemoteThread ");
//释放句柄 
CloseHandle(hRemoteProcess);
CloseHandle(hRemoteThread);

return TRUE;

}

DWORD GetProcessID(char* targetFile)//获取exe执行时的进程ID
{
DWORD pid = -1;

//创建系统快照
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
//ErrorExit("CreateToolhelp32Snapshot ");
PROCESSENTRY32 lprs;
//取得系统快照中的第一个进程信息,判断是否为目标exe的运行进程
Process32First(hSnap, &lprs);
//ErrorExit("Process32First ");
if (strstr(targetFile, lprs.szExeFile))
{
    pid = lprs.th32ProcessID;
    return pid;
}

while (1)
{
    ZeroMemory(&lprs, sizeof(lprs));
    lprs.dwSize = (&lprs, sizeof(lprs));
    if (!Process32Next(hSnap, &lprs))
    {
        pid = -1;
        break;
    }
    if (strstr(targetFile, lprs.szExeFile))
    {
        pid = lprs.th32ProcessID; 
        break;
    }
}
printf_s("pid:%d", pid);
//MessageBox(NULL, (LPCTSTR)&pid, TEXT("Error"), MB_OK);
return pid;

}

int _tmain(int argc, _TCHAR* argv[])
{
if (InjectDll("E:\chf_yjy's_work\work5\0503\detourlib\Release\detourlib.dll",
GetProcessID("printtest.exe")))
MessageBox(NULL, "Yes InjectDll Successed", TEXT("InjectDll"), MB_OK);
else
MessageBox(NULL, "No InjectDll Failed", TEXT("InjectDll"), MB_OK);

return 0;

}