extern "C" int main(int argc, wchar_t* argv[])
{
HMODULE hUser32 = LoadLibraryA("user32.dll");
TRACED_HOOK_HANDLE hHook = new HOOK_TRACE_INFO();
NTSTATUS NtStatus;
ULONG ACLEntries[1] = {0};
UNICODE_STRING* NameBuffer = NULL;
HANDLE hRemoteThread;
// test driver...
printf("Installing support driver...\n");
FORCE(RhInstallSupportDriver());
printf("Installing test driver...\n");
if(RhIsX64System())
FORCE(RhInstallDriver(L"TestDriver64.sys", L"TestDriver64.sys"))
else
FORCE(RhInstallDriver(L"TestDriver32.sys", L"TestDriver32.sys"));
// test stealth thread creation...
printf("Testing stealth thread creation...\n");
hRemoteThread = CreateThread(NULL, 0, TestThread, NULL, 0, NULL);
FORCE(RhCreateStealthRemoteThread(GetCurrentProcessId(), HijackEntry, (PVOID)0x12345678, &hRemoteThread));
Sleep(500);
/*
The following shows how to install and remove local hooks...
*/
FORCE(LhInstallHook(
GetProcAddress(hUser32, "MessageBeep"),
MessageBeepHook,
(PVOID)0x12345678,
hHook));
// won't invoke the hook handler because hooks are inactive after installation
MessageBeep(123);
// activate the hook for the current thread
FORCE(LhSetInclusiveACL(ACLEntries, 1, hHook));
// will be redirected into the handler...
MessageBeep(123);
// this will also invalidate "hHook", because it is a traced handle...
LhUninstallAllHooks();
// this will do nothing because the hook is already removed...
LhUninstallHook(hHook);
// now we can safely release the traced handle
delete hHook;
hHook = NULL;
// even if the hook is removed, we need to wait for memory release
LhWaitForPendingRemovals();
/*
In many situations you will need the handler utilities.
*/
HANDLE Handle = CreateEventA(NULL, TRUE, FALSE, "MyEvent");
ULONG RequiredSize;
ULONG RealThreadId;
ULONG ThreadId;
// handle to name
if(!SUCCEEDED(NtStatus = DbgHandleToObjectName(Handle, NULL, 0, &RequiredSize)))
goto ERROR_ABORT;
NameBuffer = (UNICODE_STRING*)malloc(RequiredSize);
FORCE(DbgHandleToObjectName(Handle, NameBuffer, RequiredSize, &RequiredSize));
printf("\n[Info]: Event name is \"%S\".\n", NameBuffer->Buffer);
// handle to thread ID
Handle = CreateThread(NULL, 0, NULL, NULL, CREATE_SUSPENDED, &RealThreadId);
FORCE(DbgGetThreadIdByHandle(Handle, &ThreadId));
if(ThreadId != RealThreadId)
return EXIT_FAILURE;
_getch();
return 0;
ERROR_ABORT:
if(hHook != NULL)
delete hHook;
if(NameBuffer != NULL)
free(NameBuffer );
printf("\n[Error(0x%p)]: \"%S\" (code: %d {0x%p})\n", (PVOID)NtStatus, RtlGetLastErrorString(), RtlGetLastError(), (PVOID)RtlGetLastError());
_getch();
return NtStatus;
}
extern "C" int main(int argc, wchar_t* argv[])
{
TRACED_HOOK_HANDLE hHook = new HOOK_TRACE_INFO();
NTSTATUS NtStatus;
ULONG ACLEntries[1] = {0};
UNICODE_STRING* NameBuffer = NULL;
ORIG_CreateFontIndirectW = CreateFontIndirectW;
FORCE(LhInstallHook(
ORIG_CreateFontIndirectW,
IMPL_CreateFontIndirectW,
(PVOID)0,
hHook));
FORCE(LhSetInclusiveACL(ACLEntries, 1, hHook));
CreateFontIndirectW(0);
CreateFontW(10, 10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, L"system");
LOGFONTA lf = {};
CreateFontIndirectA(&lf);
CreateFontA(12, 0, 0, 0, 400, 0, 0, 0, 2, 0, 0, 0, 0, "MARLETT");
#if 0
ORIG_GetTextExtentPoint32A = GetTextExtentPoint32A;
FORCE(LhInstallHook(
ORIG_GetTextExtentPoint32A,
IMPL_GetTextExtentPoint32A,
(PVOID)0,
hHook));
HDC hdc = GetDC(NULL);
SIZE size;
FORCE(LhSetInclusiveACL(ACLEntries, 1, hHook));
GetTextExtentPoint32W(hdc, L"abc", 3, &size);
GetTextExtentPointW(hdc, L"abc", 3, &size);
GetTextExtentPoint32A(hdc, "abc", 3, &size);
GetTextExtentPointA(hdc, "abc", 3, &size);
#endif
#if 0
ORIG_MessageBeepHook = MessageBeep;
/*
The following shows how to install and remove local hooks...
*/
FORCE(LhInstallHook(
ORIG_MessageBeepHook,
MessageBeepHook,
(PVOID)0,
hHook));
printf(".\n");
// won't invoke the hook handler because hooks are inactive after installation
MessageBeep(123);
getch();
BOOL flags = 1;
FORCE(LhIsThreadIntercepted(hHook, 0, &flags));
printf("Intercepted %d\n", flags);
// activate the hook for the current thread
FORCE(LhSetInclusiveACL(ACLEntries, 1, hHook));
FORCE(LhIsThreadIntercepted(hHook, 0, &flags));
printf("Intercepted %d\n", flags);
printf(".\n");
// will be redirected into the handler...
MessageBeep(123);
getch();
FORCE(LhSetGlobalExclusiveACL(ACLEntries, 1));
printf(".\n");
// will be redirected into the handler...
MessageBeep(123);
getch();
FORCE(LhSetGlobalInclusiveACL(ACLEntries, 1));
printf(".\n");
// will be redirected into the handler...
MessageBeep(123);
getch();
printf(".\n");
// won't invoke the hook handler because hooks are inactive after installation
ORIG_MessageBeepHook(123);
getch();
#endif
// this will also invalidate "hHook", because it is a traced handle...
LhUninstallAllHooks();
// this will do nothing because the hook is already removed...
LhUninstallHook(hHook);
printf(".\n");
// will be redirected into the handler...
MessageBeep(123);
getch();
// now we can safely release the traced handle
delete hHook;
hHook = NULL;
// even if the hook is removed, we need to wait for memory release
LhWaitForPendingRemovals();
return 0;
ERROR_ABORT:
if(hHook != NULL)
delete hHook;
if(NameBuffer != NULL)
free(NameBuffer );
printf("\n[Error(0x%p)]: \"%S\" (code: %d {0x%p})\n", (PVOID)NtStatus, RtlGetLastErrorString(), RtlGetLastError(), (PVOID)RtlGetLastError());
_getch();
return NtStatus;
}
void CWinSystemWin32DX::InitHooks(IDXGIOutput* pOutput)
{
DXGI_OUTPUT_DESC outputDesc;
if (!pOutput || FAILED(pOutput->GetDesc(&outputDesc)))
return;
DISPLAY_DEVICEW displayDevice;
displayDevice.cb = sizeof(DISPLAY_DEVICEW);
DWORD adapter = 0;
bool deviceFound = false;
// delete exiting hooks.
UninitHooks();
// enum devices to find matched
while (EnumDisplayDevicesW(nullptr, adapter, &displayDevice, 0))
{
if (wcscmp(displayDevice.DeviceName, outputDesc.DeviceName) == 0)
{
deviceFound = true;
break;
}
adapter++;
}
if (!deviceFound)
return;
CLog::Log(LOGDEBUG, __FUNCTION__": Hooking into UserModeDriver on device %S. ", displayDevice.DeviceKey);
wchar_t* keyName =
#ifndef _M_X64
// on x64 system and x32 build use UserModeDriverNameWow key
CSysInfo::GetKernelBitness() == 64 ? keyName = L"UserModeDriverNameWow" :
#endif // !_WIN64
L"UserModeDriverName";
DWORD dwType = REG_MULTI_SZ;
HKEY hKey = nullptr;
wchar_t value[1024];
DWORD valueLength = sizeof(value);
LSTATUS lstat;
// to void \Registry\Machine at the beginning, we use shifted pointer at 18
if (ERROR_SUCCESS == (lstat = RegOpenKeyExW(HKEY_LOCAL_MACHINE, displayDevice.DeviceKey + 18, 0, KEY_READ, &hKey))
&& ERROR_SUCCESS == (lstat = RegQueryValueExW(hKey, keyName, nullptr, &dwType, (LPBYTE)&value, &valueLength)))
{
// 1. registry value has a list of drivers for each API with the following format: dx9\0dx10\0dx11\0dx12\0\0
// 2. we split the value by \0
std::vector<std::wstring> drivers;
const wchar_t* pValue = value;
while (*pValue)
{
drivers.push_back(std::wstring(pValue));
pValue += drivers.back().size() + 1;
}
// no entries in the registry
if (drivers.empty())
return;
// 3. we take only first three values (dx12 driver isn't needed if it exists ofc)
if (drivers.size() > 3)
drivers = std::vector<std::wstring>(drivers.begin(), drivers.begin() + 3);
// 4. and then iterate with reverse order to start iterate with the best candidate for d3d11 driver
for (auto it = drivers.rbegin(); it != drivers.rend(); ++it)
{
m_hDriverModule = LoadLibraryW(it->c_str());
if (m_hDriverModule != nullptr)
{
s_fnOpenAdapter10_2 = reinterpret_cast<PFND3D10DDI_OPENADAPTER>(GetProcAddress(m_hDriverModule, "OpenAdapter10_2"));
if (s_fnOpenAdapter10_2 != nullptr)
{
ULONG ACLEntries[1] = { 0 };
m_hHook = new HOOK_TRACE_INFO();
// install and activate hook into a driver
if (SUCCEEDED(LhInstallHook(s_fnOpenAdapter10_2, HookOpenAdapter10_2, nullptr, m_hHook))
&& SUCCEEDED(LhSetInclusiveACL(ACLEntries, 1, m_hHook)))
{
CLog::Log(LOGDEBUG, __FUNCTION__": D3D11 hook installed and activated.");
break;
}
else
{
CLog::Log(LOGDEBUG, __FUNCTION__": Unable ot install and activate D3D11 hook.");
SAFE_DELETE(m_hHook);
FreeLibrary(m_hDriverModule);
m_hDriverModule = nullptr;
}
}
}
}
}
if (lstat != ERROR_SUCCESS)
CLog::Log(LOGDEBUG, __FUNCTION__": error open registry key with error %ld.", lstat);
if (hKey != nullptr)
RegCloseKey(hKey);
}