在入口函数Hook的分析

// DemoKing2.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"

#include <stdio.h>
#include <windows.h>

// 保存原始的5个字节代码,注意一定要保证完整
BYTE orig_code[5] = {0x90, 0x90, 0x90, 0x90, 0x90};
BYTE save_code[10] = {0x90, 0x90, 0x90, 0x90, 0x90};
// JMP 0xXXXXXXXX
BYTE hook_code[5] = { 0xe9, 0, 0, 0, 0 };
BYTE jmp_orig_code[5] = { 0xe9, 0, 0, 0, 0};

int func(int a,char *str);
int fake_func(int a,char *str);
void hook_func();
int jmp_back(int a,char *str);

int main(int argc, char **argv)
{
int ret;
hook_func();
ret = func(110,"pklang");
return ret;
}

int func(int a,char *str)
{

printf("I'm func(),I'm called! a:%d,str:%s/r/n",a,str);
return 0;
}

void hook_func()
{
DWORD dwOldProtect;

#ifdef _DEBUG
//Debug 模式时是用jmp跳转表,所以要算出真正的函数地址
#define  PATCH 6

DWORD fake_funcAddr=   (DWORD)fake_func+*(PDWORD)((DWORD)fake_func+1)+5;
DWORD funcAddr=         (DWORD)func+*(PDWORD)((DWORD)func+1)+5;
DWORD jmp_backAddr=    (DWORD)jmp_back+*(PDWORD)((DWORD)jmp_back+1)+5;
#else
#define  PATCH 8

DWORD fake_funcAddr=   (DWORD)fake_func;
DWORD funcAddr=         (DWORD)func;
DWORD jmp_backAddr=    (DWORD)jmp_back;
#endif

*((PDWORD)(hook_code+1) ) = (DWORD)fake_funcAddr - (DWORD)funcAddr - 5;

//save old code
//要看看入口地址前五个字节是否完整为汇编指令的,如果不是要补成完整指令
//比如fun函数在debug模式开头为
//	004010A0 >/> /55            push    ebp           //1个字节
//	004010A1  |.  8BEC          mov     ebp, esp      //2个字节
//	004010A3  |.  83EC 40       sub     esp, 40       //3个字节
//	004010A6  |.  53            push    ebx           //所以加起来至少要6个字节
//	004010A7  |.  56            push    esi
//而Release模式fun开头汇编为
//	00401020  /$  8B4424 08     mov     eax, dword ptr [esp+8]  //4个字节
//	00401024  |.  8B4C24 04     mov     ecx, dword ptr [esp+4]  //4个字节
//	00401028  |.  50            push    eax                     //所以加起来至少要8个字节
//	00401029  |.  51            push    ecx

memcpy(save_code,(LPVOID)funcAddr,PATCH);

// 修改原始入口
VirtualProtect((LPVOID)funcAddr, 5, PAGE_EXECUTE_READWRITE, &dwOldProtect);
memcpy((BYTE *)funcAddr, hook_code, 5);
VirtualProtect((LPVOID)funcAddr, 5, dwOldProtect, &dwOldProtect);

//设置原函数地址
*( (PDWORD)(jmp_orig_code+1) ) = (ULONG)funcAddr - (ULONG)jmp_backAddr -5;
VirtualProtect((LPVOID)jmp_backAddr, 15, PAGE_EXECUTE_READWRITE, &dwOldProtect);
memcpy((BYTE *)jmp_backAddr, save_code, PATCH);
memcpy((BYTE *)((DWORD)jmp_backAddr+PATCH), jmp_orig_code, 5);
VirtualProtect((LPVOID)jmp_backAddr, 15, dwOldProtect, &dwOldProtect);

}
//4011ba
__declspec(naked) int jmp_back(int a,char *str)
{
__asm
{
_emit 0x90
_emit 0x90
_emit 0x90
_emit 0x90
_emit 0x90
_emit 0x90
_emit 0x90
_emit 0x90
_emit 0x90
_emit 0x90
}

}

int fake_func(int a,char *str)
{
int ret;
printf("I'm fake_func(),I'm called! a:%d,str:%s/r/n",a,str);
ret = jmp_back(a,str);
return ret;
}