1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
| // AVHookDll.cpp : Defines the entry point for the DLL application.
//
// By Taron for Anti-Viruses Project with Mùpùf (2005)
#include "stdafx.h"
#include "AVHookDll.h"
#include <ImageHlp.h>
#pragma comment(lib, "ImageHlp")
#define _DEBUG_
int __stdcall HookFunction();
bool MakeHook(bool);
HINSTANCE hThisMod;
HHOOK hHook;
PROC FunctionHooked, *AddressOfFunction;
const char *szDllName = "Advapi32.dll";
BOOL APIENTRY DllMain(HINSTANCE hModule, DWORD dwReason, LPVOID lpReserved)
{
switch(dwReason)
{
case DLL_PROCESS_ATTACH:
{
hThisMod = hModule;
MakeHook(true);
}
case DLL_PROCESS_DETACH:
{
MakeHook(false);
}
}
return TRUE;
}
bool MakeHook(bool bToActive)
{
if(bToActive)
{
HMODULE hModCaller = GetModuleHandle(0);
HMODULE hLibrary = LoadLibrary(szDllName);
if(!hLibrary) return false;
FunctionHooked = GetProcAddress(hLibrary, "RegCreateKeyEx");
if(!FunctionHooked) return false;
ULONG uSize;
PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)
ImageDirectoryEntryToData(hModCaller, true, IMAGE_DIRECTORY_ENTRY_IMPORT, &uSize);
if(!pImportDesc) return false;
for(; pImportDesc->Name ; pImportDesc++)
{
PSTR pszModName = (PSTR)((BYTE) hModCaller + pImportDesc->Name);
if(lstrcmpiA(pszModName, szDllName) == 0) break;
}
if(!pImportDesc->Name) return false;
PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)((BYTE) hModCaller + pImportDesc->FirstThunk);
for(; pThunk->u1.Function ; pThunk++)
{
PROC *pFn = (PROC *)&pThunk->u1.Function;
if(*pFn == FunctionHooked)
{
AddressOfFunction = pFn;
break;
}
}
DWORD dwOld;
VirtualProtect(AddressOfFunction, 4, PAGE_EXECUTE_READWRITE, &dwOld);
*AddressOfFunction = HookFunction;
VirtualProtect(AddressOfFunction, 4, dwOld, 0);
}
else
{
DWORD dwOld;
VirtualProtect(AddressOfFunction, 4, PAGE_EXECUTE_READWRITE, &dwOld);
*AddressOfFunction = FunctionHooked;
VirtualProtect(AddressOfFunction, 4, dwOld, 0);
}
return true;
}
int __stdcall HookFunction()
{
HANDLE hFile;
hFile = CreateFile("avhook.txt", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, NULL);
WriteFile(hFile, "Tentative d'écriture détectée !", 32, 0, 0);
return 0;
}
LRESULT CALLBACK HookProc(int nCode, WPARAM wParam, LPARAM lParam)
{
return CallNextHookEx(hHook, nCode, wParam, lParam);
}
extern "C" AVHOOKDLL_API void InstallHook()
{
#ifdef _DEBUG_
MessageBox(0, "InstallHook", "DEBUG", MB_OK);
#endif
if(!hHook) hHook = SetWindowsHookEx(WH_CBT, HookProc, hThisMod, 0);
}
extern "C" AVHOOKDLL_API void UninstallHook()
{
#ifdef _DEBUG_
MessageBox(0, "UninstallHook", "DEBUG", MB_OK);
#endif
UnhookWindowsHookEx(hHook);
hHook = 0;
} |
