bool InitHooksLibrary() { #ifdef _DEBUG extern HookItem *gpHooks; extern size_t gnHookedFuncs; // Must be placed on top _ASSERTE(gpHooks && gnHookedFuncs==0 && gpHooks[0].NewAddress==NULL); #endif HLOG1("InitHooksLibrary",0); bool lbRc = false; HookItem HooksLib1[] = { /* ************************ */ HOOK_ITEM_BY_NAME(LoadLibraryA, kernel32), HOOK_ITEM_BY_NAME(LoadLibraryExA, kernel32), HOOK_ITEM_BY_NAME(LoadLibraryExW, kernel32), HOOK_ITEM_BY_NAME(FreeLibrary, kernel32), /* ************************ */ {0} }; HookItem HooksLib2[] = { /* ************************ */ HOOK_ITEM_BY_NAME(LoadLibraryW, kernel32), /* ************************ */ {0} }; // Need to hook All LoadLibrary### if the work isn't done by LdrRegisterDllNotification if (gnLdrDllNotificationUsed != ldr_FullSupport) { if (InitHooks(HooksLib1) < 0) goto wrap; } // Also LoadLibraryW, it handles "ExtendedConsole.dll" loading in Far 32/64 if (gbIsFarProcess || (gnLdrDllNotificationUsed != ldr_FullSupport)) { if (InitHooks(HooksLib2) < 0) goto wrap; } lbRc = true; wrap: HLOGEND1(); return lbRc; }
// Подменить Импортируемые функции в 0PictureView.dl_ bool __stdcall SetAllHooks( HMODULE ahOurDll, HMODULE ahPicView ) { // т.к. SetAllHooks может быть вызван из разных dll - запоминаем однократно if (!hOurModule) hOurModule = ahOurDll; InitHooks ( NULL ); #ifdef _DEBUG char szHookProc[128]; for (int i = 0; Hooks[i].NewAddress; i++) { wsprintfA(szHookProc, "## %s -> 0x%08X (exe: 0x%X)\n", Hooks[i].Name, (DWORD)Hooks[i].NewAddress, (DWORD)Hooks[i].ExeOldAddress); OutputDebugStringA(szHookProc); } #endif // ID основной нити (должна быть текущей) nMainThreadId = GetCurrentThreadId(); // Теперь - замена SetHook( ahPicView, TRUE /* чтобы по имени тоже шел */ ); return true; }
BOOL CFindReplaceDialogEx::OnInitDialog() { CFindReplaceDialog::OnInitDialog(); InitHooks(HM_KEYBOARD); return TRUE; }
bool InitHooksCmdExe() { if (!gbIsCmdProcess) return true; HLOG1("InitHooksCmdExe",0); bool lbRc = false; HookItem HooksCmdOnly[] = { // Vista and below: AdvApi32.dll // **NB** In WinXP this module is not linked statically HOOK_ITEM_BY_NAME(RegQueryValueExW, IsWin7() ? kernel32 : advapi32), {0, 0, 0} }; if (InitHooks(HooksCmdOnly) < 0) goto wrap; lbRc = true; wrap: HLOGEND1(); return lbRc; }
// DllMain...this is where the magic happens ;) // This procedure will be executed if the dll get loaded. // All functions in htHookTable get h000k333d ! ;) BOOL APIENTRY DllMain(HINSTANCE hInst,DWORD dwReason,LPVOID pvReserved) { u_int i; // Initialize htHookTable's hook addresses InitHooks(); switch (dwReason) { case DLL_PROCESS_ATTACH: i=0; // Hook while (htHookTable[i].dll && htHookTable[i].func) { htHookTable[i].ppOriginal=HookFunctionInCurrentProcess(htHookTable[i].dll,htHookTable[i].func,htHookTable[i].ppHook); i++; } break; case DLL_PROCESS_DETACH: i=0; // Unhook while (htHookTable[i].dll && htHookTable[i].func) { UnHookFunctionInCurrentProcess(htHookTable[i].dll,htHookTable[i].func,htHookTable[i].ppOriginal); i++; } break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; } return 1; }
BOOL APIENTRY DllMain( HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: if(!dll_cs.LockCount && !dll_cs.OwningThread) InitializeCriticalSection(&dll_cs); if (!hook_cs.LockCount && !hook_cs.OwningThread) InitializeCriticalSection(&hook_cs); InitHooks(); GetCurrentConfig(&dxglcfg, true); break; case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: break; case DLL_PROCESS_DETACH: ShutdownHooks(); DeleteCriticalSection(&hook_cs); ZeroMemory(&hook_cs, sizeof(CRITICAL_SECTION)); DeleteCriticalSection(&dll_cs); ZeroMemory(&dll_cs, sizeof(CRITICAL_SECTION)); break; } return TRUE; }
bool InitHooksKernel() { HLOG1("InitHooksKernel",0); bool lbRc = false; HookItem HooksKernel[] = { /* ************************ */ HOOK_ITEM_BY_NAME(OpenFileMappingW, kernel32), HOOK_ITEM_BY_NAME(MapViewOfFile, kernel32), HOOK_ITEM_BY_NAME(UnmapViewOfFile, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(SetEnvironmentVariableA, kernel32), HOOK_ITEM_BY_NAME(SetEnvironmentVariableW, kernel32), HOOK_ITEM_BY_NAME(GetEnvironmentVariableA, kernel32), HOOK_ITEM_BY_NAME(GetEnvironmentVariableW, kernel32), #if 0 HOOK_ITEM_BY_NAME(GetEnvironmentStringsA, kernel32), #endif HOOK_ITEM_BY_NAME(GetEnvironmentStringsW, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(GetSystemTime, kernel32), HOOK_ITEM_BY_NAME(GetLocalTime, kernel32), HOOK_ITEM_BY_NAME(GetSystemTimeAsFileTime, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(Beep, kernel32), /* ************************ */ {0} }; if (InitHooks(HooksKernel) < 0) goto wrap; #if 0 // Проверка, как реагирует на дубли HooksCommon[1].NewAddress = NULL; _ASSERTEX(FALSE && "Testing"); InitHooks(HooksCommon); #endif lbRc = true; wrap: HLOGEND1(); return lbRc; }
bool InitHooksReg() { bool lbRc = false; #ifdef HOOKS_USE_VIRT_REGISTRY CESERVER_CONSOLE_MAPPING_HDR* pInfo = GetConMap(); if (!pInfo || !(pInfo->isHookRegistry&1) || !*pInfo->sHiveFileName) return false; DEBUGSTR(L"ConEmuHk: Preparing for registry virtualization\n"); HookItem HooksRegistry[] = { /* ************************ */ {(void*)OnRegCloseKey, "RegCloseKey", advapi32}, {(void*)OnRegCreateKeyA, "RegCreateKeyA", advapi32}, {(void*)OnRegCreateKeyW, "RegCreateKeyW", advapi32}, {(void*)OnRegCreateKeyExA, "RegCreateKeyExA", advapi32}, {(void*)OnRegCreateKeyExW, "RegCreateKeyExW", advapi32}, {(void*)OnRegOpenKeyA, "RegOpenKeyA", advapi32}, {(void*)OnRegOpenKeyW, "RegOpenKeyW", advapi32}, {(void*)OnRegOpenKeyExA, "RegOpenKeyExA", advapi32}, {(void*)OnRegOpenKeyExW, "RegOpenKeyExW", advapi32}, {(void*)OnRegDeleteKeyA, "RegDeleteKeyA", advapi32}, {(void*)OnRegDeleteKeyW, "RegDeleteKeyW", advapi32}, /* ************************ */ {(void*)OnRegConnectRegistryA, "RegConnectRegistryA", advapi32}, {(void*)OnRegConnectRegistryW, "RegConnectRegistryW", advapi32}, /* ************************ */ {0} }; lbRc = (InitHooks(HooksRegistry) >= 0); if (lbRc) { PrepareHookedKeyList(); DEBUGSTR(L"ConEmuHk: Registry virtualization prepared\n"); // Если advapi32.dll уже загружена - можно сразу дернуть экспорты if (ghAdvapi32) { RegOpenKeyEx_f = (RegOpenKeyEx_t)GetProcAddress(ghAdvapi32, "RegOpenKeyExW"); RegCreateKeyEx_f = (RegCreateKeyEx_t)GetProcAddress(ghAdvapi32, "RegCreateKeyExW"); RegCloseKey_f = (RegCloseKey_t)GetProcAddress(ghAdvapi32, "RegCloseKey"); } } else { DEBUGSTR(L"ConEmuHk: Registry virtualization failed!\n"); } #else lbRc = true; #endif return lbRc; }
bool LuaEx::Load(PluginId id, ISmmAPI *ismm, char *error, size_t maxlen, bool late) { PLUGIN_SAVEVARS(); InitGlobals(error, maxlen); InitHooks(); for (auto i = ScriptExtensions().begin(); i != ScriptExtensions().end(); ++i) { (*i)->Init(); } return true; }
bool InitHooksDebugging() { #if !defined(_DEBUG) return true; #else HLOG1("InitHooksDebugging",0); bool lbRc = false; HookItem HooksDbg[] = { /* ************************ */ HOOK_ITEM_BY_NAME(CreateNamedPipeW, kernel32), HOOK_ITEM_BY_NAME(VirtualAlloc, kernel32), #if 0 HOOK_ITEM_BY_NAME(VirtualProtect, kernel32), #endif HOOK_ITEM_BY_NAME(SetUnhandledExceptionFilter, kernel32), /* ************************ */ #ifdef HOOK_ERROR_PROC HOOK_ITEM_BY_NAME(GetLastError, kernel32), HOOK_ITEM_BY_NAME(SetLastError, kernel32), // eSetLastError #endif /* ************************ */ {0} }; if (InitHooks(HooksDbg) < 0) goto wrap; lbRc = true; wrap: HLOGEND1(); return lbRc; #endif // _DEBUG }
bool InitHooksExecutor() { HLOG1("InitHooksExecutor",0); bool lbRc = false; HookItem HooksCommon[] = { /* ************************ */ HOOK_ITEM_BY_LIBR(ExitProcess, kernel32, 0, ghKernel32), // Hook the kernel32.dll, not kernelbase.dll HOOK_ITEM_BY_NAME(TerminateProcess, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(CreateThread, kernel32), HOOK_ITEM_BY_NAME(SetThreadContext, kernel32), HOOK_ITEM_BY_NAME(TerminateThread, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(CreateProcessA, kernel32), HOOK_ITEM_BY_NAME(CreateProcessW, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(SetCurrentDirectoryA, kernel32), HOOK_ITEM_BY_NAME(SetCurrentDirectoryW, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(ShellExecuteExA, shell32), HOOK_ITEM_BY_NAME(ShellExecuteExW, shell32), HOOK_ITEM_BY_NAME(ShellExecuteA, shell32), HOOK_ITEM_BY_NAME(ShellExecuteW, shell32), /* ************************ */ // OnWinExec/WinExec is used in DefTerm only /* ************************ */ {0} }; if (InitHooks(HooksCommon) < 0) goto wrap; lbRc = true; wrap: HLOGEND1(); return lbRc; }
bool InitHooksFarExe() { HLOG1("InitHooksFarExe",0); bool lbRc = false; // Проверить, фар ли это? Если нет - можно не ставить HooksFarOnly bool lbIsFar = false; wchar_t* pszExe = (wchar_t*)calloc(MAX_PATH+1,sizeof(wchar_t)); if (pszExe) { if (GetModuleFileName(NULL, pszExe, MAX_PATH)) { if (IsFarExe(pszExe)) lbIsFar = true; } free(pszExe); } HookItem HooksFarOnly[] = { /* ************************ */ HOOK_ITEM_BY_NAME(CompareStringW, kernel32), /* ************************ */ {0} }; if (lbIsFar) { if (InitHooks(HooksFarOnly) < 0) goto wrap; } lbRc = true; wrap: HLOGEND1(); return lbRc; }
/* ************************ */ bool InitHooksDefTerm() { HLOG1("InitHooksDefTerm",0); bool lbRc = false; // These functions are required for seizing console and behave as Default Terminal HookItem HooksCommon[] = { HOOK_ITEM_BY_NAME(CreateProcessW, kernel32), // Need to "hook" OnCreateProcessA because it is used in "OnWinExec" HOOK_ITEM_BY_NAME(CreateProcessA, kernel32), // Used in some programs, Issue 853 HOOK_ITEM_BY_NAME(WinExec, kernel32), // Need for hook "Run as administrator" HOOK_ITEM_BY_NAME(ShellExecuteExW, shell32), {0} }; HookItem HooksAllocConsole[] = { // gh-888, gh-55: Allow to use ConEmu as default console in third-party applications HOOK_ITEM_BY_NAME(AllocConsole, kernel32), // Only for "*.vshost.exe"? {0} }; HookItem HooksCmdLine[] = { // Issue 1125: "Run as administrator" too. Must be last export HOOK_ITEM_BY_ORDN(ShellExecCmdLine, shell32, 265), {0} }; HookItem HooksVshost[] = { // Issue 1312: .Net applications runs in "*.vshost.exe" helper GUI application when debugging // AllocConsole moved to HooksCommon HOOK_ITEM_BY_NAME(ShowWindow, user32), /* ************************ */ {0} }; // Required in VisualStudio and CodeBlocks (gdb) debuggers // Don't restrict to them, other Dev Envs may behave in similar way HookItem HooksDevStudio[] = { HOOK_ITEM_BY_NAME(ResumeThread, kernel32), /* ************************ */ {0} }; // Required for hooking in OS // bool check if (!InitHooksLibrary()) goto wrap; // Start our functions if (InitHooks(HooksCommon) < 0) goto wrap; if (gbIsNetVsHost || gbPrepareDefaultTerminal) { if (InitHooks(HooksAllocConsole) < 0) goto wrap; } // Windows 7. There is new undocumented function "ShellExecCmdLine" used by Explorer if (IsWin7()) { if (InitHooks(HooksCmdLine) < 0) goto wrap; } // "*.vshost.exe" uses special helper if (gbIsNetVsHost) { if (InitHooks(HooksVshost) < 0) goto wrap; } // Required in VisualStudio and CodeBlocks (gdb) debuggers // Don't restrict to them, other Dev Envs may behave in similar way { if (InitHooks(HooksDevStudio) < 0) goto wrap; } gnDllState |= ds_HooksDefTerm; lbRc = true; wrap: HLOGEND1(); return lbRc; }
// user32 & gdi32 bool InitHooksUser32() { HLOG1("InitHooksUser32",0); bool lbRc = false; HookItem HooksUserGdi[] = { /* ************************ */ HOOK_ITEM_BY_NAME(TrackPopupMenu, user32), HOOK_ITEM_BY_NAME(TrackPopupMenuEx, user32), HOOK_ITEM_BY_NAME(FlashWindow, user32), HOOK_ITEM_BY_NAME(FlashWindowEx, user32), HOOK_ITEM_BY_NAME(SetForegroundWindow, user32), HOOK_ITEM_BY_NAME(GetForegroundWindow, user32), HOOK_ITEM_BY_NAME(GetWindowRect, user32), HOOK_ITEM_BY_NAME(ScreenToClient, user32), /* ************************ */ //HOOK_ITEM_BY_NAME(CreateWindowA, user32), -- there is not such export //HOOK_ITEM_BY_NAME(CreateWindowW, user32), -- there is not such export HOOK_ITEM_BY_NAME(CreateWindowExA, user32), HOOK_ITEM_BY_NAME(CreateWindowExW, user32), HOOK_ITEM_BY_NAME(ShowCursor, user32), HOOK_ITEM_BY_NAME(ShowWindow, user32), HOOK_ITEM_BY_NAME(SetFocus, user32), HOOK_ITEM_BY_NAME(SetParent, user32), HOOK_ITEM_BY_NAME(GetParent, user32), HOOK_ITEM_BY_NAME(GetWindow, user32), HOOK_ITEM_BY_NAME(GetAncestor, user32), HOOK_ITEM_BY_NAME(GetClassNameA, user32), HOOK_ITEM_BY_NAME(GetClassNameW, user32), HOOK_ITEM_BY_NAME(GetActiveWindow, user32), HOOK_ITEM_BY_NAME(MoveWindow, user32), HOOK_ITEM_BY_NAME(SetWindowPos, user32), HOOK_ITEM_BY_NAME(SetWindowLongA, user32), HOOK_ITEM_BY_NAME(SetWindowLongW, user32), #ifdef WIN64 HOOK_ITEM_BY_NAME(SetWindowLongPtrA, user32), HOOK_ITEM_BY_NAME(SetWindowLongPtrW, user32), #endif HOOK_ITEM_BY_NAME(GetWindowLongA, user32), HOOK_ITEM_BY_NAME(GetWindowLongW, user32), #ifdef WIN64 HOOK_ITEM_BY_NAME(GetWindowLongPtrA, user32), HOOK_ITEM_BY_NAME(GetWindowLongPtrW, user32), #endif HOOK_ITEM_BY_NAME(GetWindowTextLengthA, user32), HOOK_ITEM_BY_NAME(GetWindowTextLengthW, user32), HOOK_ITEM_BY_NAME(GetWindowTextA, user32), HOOK_ITEM_BY_NAME(GetWindowTextW, user32), // HOOK_ITEM_BY_NAME(GetWindowPlacement, user32), HOOK_ITEM_BY_NAME(SetWindowPlacement, user32), HOOK_ITEM_BY_NAME(mouse_event, user32), HOOK_ITEM_BY_NAME(SendInput, user32), HOOK_ITEM_BY_NAME(PostMessageA, user32), HOOK_ITEM_BY_NAME(PostMessageW, user32), HOOK_ITEM_BY_NAME(SendMessageA, user32), HOOK_ITEM_BY_NAME(SendMessageW, user32), HOOK_ITEM_BY_NAME(GetMessageA, user32), HOOK_ITEM_BY_NAME(GetMessageW, user32), HOOK_ITEM_BY_NAME(PeekMessageA, user32), HOOK_ITEM_BY_NAME(PeekMessageW, user32), HOOK_ITEM_BY_NAME(MessageBeep, user32), HOOK_ITEM_BY_NAME(CreateDialogParamA, user32), HOOK_ITEM_BY_NAME(CreateDialogParamW, user32), HOOK_ITEM_BY_NAME(CreateDialogIndirectParamA, user32), HOOK_ITEM_BY_NAME(CreateDialogIndirectParamW, user32), HOOK_ITEM_BY_NAME(DialogBoxIndirectParamAorW, user32), HOOK_ITEM_BY_NAME(SetMenu, user32), HOOK_ITEM_BY_NAME(GetDC, user32), HOOK_ITEM_BY_NAME(GetDCEx, user32), HOOK_ITEM_BY_NAME(ReleaseDC, user32), /* ************************ */ /* ************************ */ HOOK_ITEM_BY_NAME(StretchDIBits, gdi32), HOOK_ITEM_BY_NAME(BitBlt, gdi32), HOOK_ITEM_BY_NAME(StretchBlt, gdi32), /* ************************ */ {0} }; if (InitHooks(HooksUserGdi) < 0) goto wrap; lbRc = true; wrap: HLOGEND1(); return lbRc; }
// Console, ANSI, Read/Write, etc. bool InitHooksConsole() { HLOG1("InitHooksConsole",0); bool lbRc = false; HookItem HooksConsole[] = { /* ************************ */ HOOK_ITEM_BY_NAME(CreateFileW, kernel32), HOOK_ITEM_BY_NAME(CreateFileA, kernel32), HOOK_ITEM_BY_NAME(WriteFile, kernel32), HOOK_ITEM_BY_NAME(ReadFile, kernel32), HOOK_ITEM_BY_NAME(CloseHandle, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(SetStdHandle, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(GetConsoleWindow, kernel32), HOOK_ITEM_BY_NAME(GetConsoleMode, kernel32), HOOK_ITEM_BY_NAME(SetConsoleMode, kernel32), HOOK_ITEM_BY_NAME(SetConsoleTitleA, kernel32), HOOK_ITEM_BY_NAME(SetConsoleTitleW, kernel32), HOOK_ITEM_BY_NAME(GetConsoleAliasesW, kernel32), HOOK_ITEM_BY_NAME(AllocConsole, kernel32), HOOK_ITEM_BY_NAME(FreeConsole, kernel32), HOOK_ITEM_BY_NAME(SetConsoleKeyShortcuts, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(SetConsoleTextAttribute, kernel32), HOOK_ITEM_BY_NAME(WriteConsoleOutputW, kernel32), HOOK_ITEM_BY_NAME(WriteConsoleOutputA, kernel32), HOOK_ITEM_BY_NAME(ReadConsoleW, kernel32), HOOK_ITEM_BY_NAME(ReadConsoleA, kernel32), HOOK_ITEM_BY_NAME(PeekConsoleInputW, kernel32), HOOK_ITEM_BY_NAME(PeekConsoleInputA, kernel32), HOOK_ITEM_BY_NAME(ReadConsoleInputW, kernel32), HOOK_ITEM_BY_NAME(ReadConsoleInputA, kernel32), HOOK_ITEM_BY_NAME(WriteConsoleInputA, kernel32), HOOK_ITEM_BY_NAME(WriteConsoleInputW, kernel32), HOOK_ITEM_BY_NAME(WriteConsoleA, kernel32), HOOK_ITEM_BY_NAME(WriteConsoleW, kernel32), HOOK_ITEM_BY_NAME(ScrollConsoleScreenBufferA, kernel32), HOOK_ITEM_BY_NAME(ScrollConsoleScreenBufferW, kernel32), HOOK_ITEM_BY_NAME(WriteConsoleOutputCharacterA, kernel32), HOOK_ITEM_BY_NAME(WriteConsoleOutputCharacterW, kernel32), /* Others console functions */ HOOK_ITEM_BY_NAME(GetNumberOfConsoleInputEvents, kernel32), HOOK_ITEM_BY_NAME(FlushConsoleInputBuffer, kernel32), HOOK_ITEM_BY_NAME(CreateConsoleScreenBuffer, kernel32), HOOK_ITEM_BY_NAME(SetConsoleActiveScreenBuffer, kernel32), HOOK_ITEM_BY_NAME(SetConsoleWindowInfo, kernel32), HOOK_ITEM_BY_NAME(SetConsoleScreenBufferSize, kernel32), HOOK_ITEM_BY_NAME(SetCurrentConsoleFontEx, kernel32), HOOK_ITEM_BY_NAME(SetConsoleScreenBufferInfoEx, kernel32), HOOK_ITEM_BY_NAME(GetLargestConsoleWindowSize, kernel32), HOOK_ITEM_BY_NAME(SetConsoleCursorPosition, kernel32), HOOK_ITEM_BY_NAME(SetConsoleCursorInfo, kernel32), /* ************************ */ HOOK_ITEM_BY_NAME(GetCurrentConsoleFont, kernel32), HOOK_ITEM_BY_NAME(GetConsoleFontSize, kernel32), /* ************************ */ // https://conemu.github.io/en/MicrosoftBugs.html#chcp_hung HOOK_ITEM_BY_NAME(SetConsoleCP, kernel32), HOOK_ITEM_BY_NAME(SetConsoleOutputCP, kernel32), /* ************************ */ {0} }; if (InitHooks(HooksConsole) < 0) goto wrap; lbRc = true; wrap: HLOGEND1(); return lbRc; }