chenx221/Textractor_test
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor hooking code and add some more logging

Browse Source
This commit is contained in:
Akash Mozumdar 2018-11-04 20:48:27 -05:00
parent 46ffaf017c
commit 3db253c790
2 changed files with 121 additions and 153 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

109
vnrhook/hijack/texthook.cc
View File

@ -26,34 +26,22 @@ TextHook *hookman;
namespace { // unnamed namespace { // unnamed
#ifndef _WIN64 #ifndef _WIN64
const BYTE common_hook[] = { BYTE common_hook[] = {
0x9c, // pushfd 0x9c, // pushfd
0x60, // pushad 0x60, // pushad
0x9c, // pushfd 0x9c, // pushfd ; Artikash 11/4/2018: not sure why pushfd happens twice. Anyway, after this a total of 0x28 bytes are pushed
0x8d,0x54,0x24,0x28, // lea edx,[esp+0x28] ; esp value 0x8d, 0x44, 0x24, 0x28, // lea eax,[esp+0x28]
0x8b,0x32, // mov esi,[edx] ; return address 0x50, // push eax ; dwDatabase
0xb9, 0,0,0,0, // mov ecx, $ ; pointer to TextHook 0xb9, 0,0,0,0, // mov ecx,@this
0xe8, 0,0,0,0, // call @hook 0xbb, 0,0,0,0, // mov ebx,@TextHook::Send
0xff, 0xd3, // call ebx
0x9d, // popfd 0x9d, // popfd
0x61, // popad 0x61, // popad
0x9d, // popfd 0x9d, // popfd
0xe9 // jmp @original 0x68, 0,0,0,0, // push @original
0xc3 // ret ; basically absolute jmp to @original
}; };
__declspec(naked) // jichi 10/2/2013: No prolog and epilog
int ProcessHook(DWORD dwDataBase, DWORD dwRetn, TextHook *hook) // Use SEH to ensure normal execution even bad hook inserted.
{
// jichi 12/17/2013: The function parameters here are meaning leass. The parameters are in esi and edi
__asm
{
push esi
push edx
call TextHook::Send
retn // jichi 12/13/2013: return near, see: http://stackoverflow.com/questions/1396909/ret-retn-retf-how-to-use-them
}
}
#else #else
const BYTE common_hook[] = { const BYTE common_hook[] = {
0x9c, // push rflags 0x9c, // push rflags
@ -114,30 +102,22 @@ bool TextHook::InsertHook()
} }
#ifndef _WIN64 #ifndef _WIN64
// jichi 12/2/2013: This function mostly return 0.
// It return the hook address only for auxiliary case.
// However, because no known hooks are auxiliary, this function always return 0.
//
// jichi 5/11/2014: // jichi 5/11/2014:
// - dwDataBase: the stack address // - dwDataBase: the stack address
// - dwRetn: the return address of the hook void TextHook::Send(DWORD dwDataBase)
DWORD TextHook::Send(DWORD dwDataBase, DWORD dwRetn)
{ {
DWORD ret = 0; __try
ITH_WITH_SEH(ret = UnsafeSend(dwDataBase, dwRetn));
return ret;
}
DWORD TextHook::UnsafeSend(DWORD dwDataBase, DWORD dwRetn)
{ {
DWORD dwCount, DWORD dwCount,
dwAddr, dwAddr,
dwDataIn, dwDataIn,
dwRetn,
dwSplit; dwSplit;
BYTE pbData[PIPE_BUFFER_SIZE]; BYTE pbData[PIPE_BUFFER_SIZE];
DWORD dwType = hp.type; DWORD dwType = hp.type;
dwAddr = hp.insertion_address; dwAddr = hp.insertion_address;
dwRetn = *(DWORD*)dwDataBase; // first value on stack (if hooked start of function, this is return address)
/** jichi 12/24/2014 /** jichi 12/24/2014
* @param addr function address * @param addr function address
@ -152,8 +132,7 @@ DWORD TextHook::UnsafeSend(DWORD dwDataBase, DWORD dwRetn)
if (hp.hook_fun && !hp.hook_fun(dwDataBase, &hp)) if (hp.hook_fun && !hp.hook_fun(dwDataBase, &hp))
hp.hook_fun = nullptr; hp.hook_fun = nullptr;
if (dwType & HOOK_EMPTY) // jichi 10/24/2014: dummy hook only for dynamic hook if (dwType & HOOK_EMPTY) return; // jichi 10/24/2014: dummy hook only for dynamic hook
return 0;
dwCount = 0; dwCount = 0;
dwSplit = 0; dwSplit = 0;
@ -164,29 +143,24 @@ DWORD TextHook::UnsafeSend(DWORD dwDataBase, DWORD dwRetn)
} }
else { else {
if (dwDataIn == 0) if (dwDataIn == 0)
return 0; return;
if (dwType & FIXING_SPLIT) if (dwType & FIXING_SPLIT)
dwSplit = FIXED_SPLIT_VALUE; // fuse all threads, and prevent floating dwSplit = FIXED_SPLIT_VALUE; // fuse all threads, and prevent floating
else if (dwType & USING_SPLIT) { else if (dwType & USING_SPLIT) {
dwSplit = *(DWORD *)(dwDataBase + hp.split); dwSplit = *(DWORD *)(dwDataBase + hp.split);
if (dwType & SPLIT_INDIRECT) { if (dwType & SPLIT_INDIRECT) {
if (IthGetMemoryRange((LPVOID)(dwSplit + hp.split_index), 0, 0)) if (IthGetMemoryRange((LPVOID)(dwSplit + hp.split_index), 0, 0)) dwSplit = *(DWORD *)(dwSplit + hp.split_index);
dwSplit = *(DWORD *)(dwSplit + hp.split_index); else return;
else
return 0;
} }
} }
if (dwType & DATA_INDIRECT) { if (dwType & DATA_INDIRECT) {
if (IthGetMemoryRange((LPVOID)(dwDataIn + hp.index), 0, 0)) if (IthGetMemoryRange((LPVOID)(dwDataIn + hp.index), 0, 0)) dwDataIn = *(DWORD *)(dwDataIn + hp.index);
dwDataIn = *(DWORD *)(dwDataIn + hp.index); else return;
else
return 0;
} }
dwCount = GetLength(dwDataBase, dwDataIn); dwCount = GetLength(dwDataBase, dwDataIn);
} }
// jichi 12/25/2013: validate data size // jichi 12/25/2013: validate data size
if (dwCount == 0 || dwCount > PIPE_BUFFER_SIZE - sizeof(ThreadParam)) if (dwCount == 0 || dwCount > PIPE_BUFFER_SIZE - sizeof(ThreadParam)) return;
return 0;
if (hp.length_offset == 1) { if (hp.length_offset == 1) {
dwDataIn &= 0xffff; dwDataIn &= 0xffff;
@ -200,9 +174,7 @@ DWORD TextHook::UnsafeSend(DWORD dwDataBase, DWORD dwRetn)
::memcpy(pbData + sizeof(ThreadParam), (void *)dwDataIn, dwCount); ::memcpy(pbData + sizeof(ThreadParam), (void *)dwDataIn, dwCount);
// jichi 10/14/2014: Add filter function // jichi 10/14/2014: Add filter function
if (hp.filter_fun && !hp.filter_fun(pbData + sizeof(ThreadParam), &dwCount, &hp, 0) || dwCount <= 0) { if (hp.filter_fun && !hp.filter_fun(pbData + sizeof(ThreadParam), &dwCount, &hp, 0) || dwCount <= 0) return;
return 0;
}
if (dwType & (NO_CONTEXT | FIXING_SPLIT)) if (dwType & (NO_CONTEXT | FIXING_SPLIT))
dwRetn = 0; dwRetn = 0;
@ -215,8 +187,11 @@ DWORD TextHook::UnsafeSend(DWORD dwDataBase, DWORD dwRetn)
WriteFile(::hookPipe, pbData, dwCount + sizeof(ThreadParam), &unused, nullptr); WriteFile(::hookPipe, pbData, dwCount + sizeof(ThreadParam), &unused, nullptr);
//CliUnlockPipe(); //CliUnlockPipe();
} }
return 0; }
__except (EXCEPTION_EXECUTE_HANDLER)
{
ConsoleOutput("Textractor: Send ERROR (likely an incorrect H-code)");
}
} }
bool TextHook::InsertHookCode() bool TextHook::InsertHookCode()
@ -226,9 +201,9 @@ bool TextHook::InsertHookCode()
if (hp.type & MODULE_OFFSET) // Map hook offset to real address if (hp.type & MODULE_OFFSET) // Map hook offset to real address
if (hp.type & FUNCTION_OFFSET) if (hp.type & FUNCTION_OFFSET)
if (FARPROC function = GetProcAddress(GetModuleHandleW(hp.module), hp.function)) hp.insertion_address += (uint64_t)function; if (FARPROC function = GetProcAddress(GetModuleHandleW(hp.module), hp.function)) hp.insertion_address += (uint64_t)function;
else return ConsoleOutput("Textractor: UnsafeInsertHookCode: FAILED: function not present"), false; else return ConsoleOutput("Textractor: InsertHookCode FAILED: function not present"), false;
else if (HMODULE moduleBase = GetModuleHandleW(hp.module)) hp.insertion_address += (uint64_t)moduleBase; else if (HMODULE moduleBase = GetModuleHandleW(hp.module)) hp.insertion_address += (uint64_t)moduleBase;
else return ConsoleOutput("Textractor: UnsafeInsertHookCode: FAILED: module not present"), false; else return ConsoleOutput("Textractor: InsertHookCode FAILED: module not present"), false;
BYTE* original; BYTE* original;
insert: insert:
@ -240,18 +215,15 @@ insert:
} }
else else
{ {
ConsoleOutput(("Textractor: UnsafeInsertHookCode: FAILED: error " + std::string(MH_StatusToString(err))).c_str()); ConsoleOutput(("Textractor: InsertHookCode FAILED: error " + std::string(MH_StatusToString(err))).c_str());
return false; return false;
} }
void* thisPtr = (void*)this;
void* funcPtr = (void*)((BYTE*)ProcessHook - (BYTE*)(trampoline + 19));
DWORD dist = original - (trampoline + sizeof(common_hook)) - 4;
*(TextHook**)(common_hook + 9) = this;
*(void(TextHook::**)(DWORD))(common_hook + 14) = &TextHook::Send;
*(BYTE**)(common_hook + 24) = original;
memcpy(trampoline, common_hook, sizeof(common_hook)); memcpy(trampoline, common_hook, sizeof(common_hook));
memcpy(trampoline + 10, &thisPtr, sizeof(void*));
memcpy(trampoline + 15, &funcPtr, sizeof(void*));
memcpy(trampoline + sizeof(common_hook), &dist, sizeof(dist));
//BYTE* original; //BYTE* original;
//MH_CreateHook((void*)hp.address, (void*)trampoline, (void**)&original); //MH_CreateHook((void*)hp.address, (void*)trampoline, (void**)&original);
@ -274,20 +246,12 @@ DWORD WINAPI ReaderThread(LPVOID hookPtr)
BYTE buffer[PIPE_BUFFER_SIZE] = {}; BYTE buffer[PIPE_BUFFER_SIZE] = {};
unsigned int changeCount = 0; unsigned int changeCount = 0;
int dataLen = 0; int dataLen = 0;
__try
{
const void* currentAddress = (void*)hook->hp.insertion_address; const void* currentAddress = (void*)hook->hp.insertion_address;
while (true) while (true)
{ {
if (!IthGetMemoryRange((void*)hook->hp.insertion_address, nullptr, nullptr))
{
ConsoleOutput("Textractor: can't read desired address");
break;
}
if (hook->hp.type & DATA_INDIRECT) currentAddress = *((char**)hook->hp.insertion_address + hook->hp.index); if (hook->hp.type & DATA_INDIRECT) currentAddress = *((char**)hook->hp.insertion_address + hook->hp.index);
if (!IthGetMemoryRange(currentAddress, nullptr, nullptr))
{
ConsoleOutput("Textractor: can't read desired address");
break;
}
Sleep(500); Sleep(500);
if (memcmp(buffer + sizeof(ThreadParam), currentAddress, dataLen + 1) == 0) if (memcmp(buffer + sizeof(ThreadParam), currentAddress, dataLen + 1) == 0)
{ {
@ -310,6 +274,11 @@ DWORD WINAPI ReaderThread(LPVOID hookPtr)
DWORD unused; DWORD unused;
WriteFile(::hookPipe, buffer, dataLen + sizeof(ThreadParam), &unused, nullptr); WriteFile(::hookPipe, buffer, dataLen + sizeof(ThreadParam), &unused, nullptr);
} }
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
ConsoleOutput("Textractor: ReaderThread ERROR (likely an incorrect R-code)");
}
ConsoleOutput("Textractor: remove read code"); ConsoleOutput("Textractor: remove read code");
hook->ClearHook(); hook->ClearHook();
return 0; return 0;

3
vnrhook/hijack/texthook.h
View File

@ -20,7 +20,6 @@ class TextHook
{ {
bool InsertHookCode(); bool InsertHookCode();
bool InsertReadCode(); bool InsertReadCode();
DWORD UnsafeSend(DWORD dwDataBase, DWORD dwRetn);
int GetLength(DWORD base, DWORD in); // jichi 12/25/2013: Return 0 if failed int GetLength(DWORD base, DWORD in); // jichi 12/25/2013: Return 0 if failed
void RemoveHookCode(); void RemoveHookCode();
void RemoveReadCode(); void RemoveReadCode();
@ -32,7 +31,7 @@ public:
bool InsertHook(); bool InsertHook();
void InitHook(const HookParam &hp, LPCSTR name, DWORD set_flag); void InitHook(const HookParam &hp, LPCSTR name, DWORD set_flag);
DWORD Send(DWORD dwDataBase, DWORD dwRetn); void Send(DWORD dwDataBase);
void ClearHook(); void ClearHook();
}; };