Hook

[Quell]

Hey.
this is a post that is also in the return error post by me as well. I repostested since it was getting of the main topic of the previous post.
ok...here is the source code of this hook test.
the test consists of 3 parts:
1->injected dll that will hook functions.
2->injecter that will inject dll into the process
3->tested app into which the dll will be injected.
i do not provide code of the injector since i tested it alot of times and it workes fine on many other ocasions withou errors....
THe problem is that the hook will not hook the MessageBoxA function.....
and i am not sure why that is....
1->Dll code:
0.1->main.cpp

#pragma comment(lib,"OpenGL32.lib")
#pragma comment(lib,"GLu32.lib")
#pragma comment(lib,"GLaux.lib")

#include <windows.h>
#include <gl\gl.h>
#include <gl\glu.h>
#include <gl\glaux.h>
#include "apihook.h"

FARPROC ( WINAPI *pGetProcAddress )( HMODULE hModule, LPCSTR lpProcName );

FARPROC WINAPI sysGetProcAddress( HMODULE hModule, LPCSTR lpProcName );
int WINAPI sysMessageBox( HWND hWnd,LPCTSTR lpText,LPCTSTR lpCaption, UINT uType);

bool WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved )
{
if( fdwReason == DLL_PROCESS_ATTACH )
{
pGetProcAddress = ( FARPROC(WINAPI*)(HMODULE,LPCSTR))InterceptDllCall(GetModuleHandle(NULL )
,"Kernel32.dll"
,"GetProcAddress"
,(DWORD)&sysGetProcAddress );
}
return( true );
}

FARPROC WINAPI sysGetProcAddress( HMODULE hModule, LPCSTR lpProcName )
{
MessageBox(0,lpProcName,"sysGetProcAdress",0);
if(!lstrcmp(lpProcName,"GetProcAddressA" ))
{
return((FARPROC)&sysGetProcAddress);
}
else if(!lstrcmp(lpProcName,"MessageBoxA"))
{
return((FARPROC)&sysMessageBox);
}
else
{
return(GetProcAddress(hModule, lpProcName));
}
}

int WINAPI sysMessageBox( HWND hWnd,LPCTSTR lpText,LPCTSTR lpCaption, UINT uType)
{
MessageBox(0,"From hook ed MessegeBoxA",0,0);

return(MessageBox(hWnd,lpText,lpCaption, uType));
}

0.2->apihook.cpp

#include "apihook.h"

#define MakePtr( cast, ptr, addValue )( cast )( ( DWORD )( ptr ) + ( DWORD )( addValue ) )

void *InterceptDllCall( HMODULE hModule, char *szDllName, char *szFunctionName, DWORD pNewFunction )
{
PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNTHeader;
PIMAGE_IMPORT_DESCRIPTOR pImportDesc;
PIMAGE_THUNK_DATA pThunk;
DWORD dwOldProtect;
DWORD dwOldProtect2;
void *pOldFunction;

if( !( pOldFunction = GetProcAddress( GetModuleHandle( szDllName ), szFunctionName ) ) )
return 0;

pDosHeader = ( PIMAGE_DOS_HEADER )hModule;
if( pDosHeader->e_magic != IMAGE_DOS_SIGNATURE )
return( NULL );

pNTHeader = MakePtr( PIMAGE_NT_HEADERS, pDosHeader, pDosHeader->e_lfanew );
if( pNTHeader->Signature != IMAGE_NT_SIGNATURE
|| ( pImportDesc = MakePtr( PIMAGE_IMPORT_DESCRIPTOR, pDosHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress ) ) == ( PIMAGE_IMPORT_DESCRIPTOR )pNTHeader )
return( NULL );

while( pImportDesc->Name )
{
char *szModuleName = MakePtr( char *, pDosHeader, pImportDesc->Name );
if( !stricmp( szModuleName, szDllName ) )
break;
pImportDesc++;
}
if( pImportDesc->Name == NULL )
return( NULL );

pThunk = MakePtr( PIMAGE_THUNK_DATA, pDosHeader, pImportDesc->FirstThunk );
while( pThunk->u1.Function )
{
if( pThunk->u1.Function == ( PDWORD )pOldFunction )
{
VirtualProtect( ( void * )&pThunk->u1.Function, sizeof( DWORD ), PAGE_EXECUTE_READWRITE, &dwOldProtect );
pThunk->u1.Function = ( PDWORD )pNewFunction;
VirtualProtect( ( void * )&pThunk->u1.Function, sizeof( DWORD ), dwOldProtect, &dwOldProtect2 );
return( pOldFunction );
}
pThunk++;
}
return( NULL );
}

0.3 apihoook.h

#include <windows.h>
#pragma warning(disable:4311)
#pragma warning(disable:4312)

void *InterceptDllCall( HMODULE hModule, char *szDllName, char *szFunctionName, DWORD pNewFunction );



2->Injected INTO prog

// tests.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
MessageBox(0,"test","test",0);
// TODO: Place code here.

return 0;
}


can somone please take a look at this code and see what did i do wrong with the dll so it does not hook the MessageBox?
i knwo it is alot of code but it is rather simple..
this is not the prog on wich the hooked function worked evry second time here it deosn't work at all, i didn;t post the other prog due to enourmouse amount of source....
thx in advnace

[Mick]

Because your patching GetProcAddress(...). But none of the code you posted is calling GetProcAddress(...) at that point. Inject your Dll then run through the list of functions you want to patch, including MessageBoxA. Describing how your injector works is also a good idea, if it is a simple CreateRemoteThread(...)/LoadLibrary(...) then that would be your problem.

[Quell]

ok. here is a bit of info that i found out.....
first of all my app can;t call the MesseGeBox withopu GetProcAdress unless the MessageBox is inlined into my program, and i don;t think i did that....
the MessageBox is in kerner32.dll...
to call it i need to call teh GetPrccAdress(One version of it is inliend into the progrma so it can call other sys function from the respective dlles).
BUt however since the GetProcAdress is not being detected...therefore MessageBox is inlined.....why is that so?
thx in advance

[Quell]

also....what otehr way then simple createthread etc...
is there?

[Mick]

also....what otehr way then simple createthread etc...
is there?

Depends on your requirements, for example you could use AppInit_DLLs if it met those requirements.

[Mick]

ok. here is a bit of info that i found out.....
first of all my app can;t call the MesseGeBox withopu GetProcAdress unless the MessageBox is inlined into my program, and i don;t think i did that....
the MessageBox is in kerner32.dll...
to call it i need to call teh GetPrccAdress(One version of it is inliend into the progrma so it can call other sys function from the respective dlles).
BUt however since the GetProcAdress is not being detected...therefore MessageBox is inlined.....why is that so?
thx in advance

what you posted does not make a bit of sense to me.

MessageBox is in User32.dll.

Again what I stated in my previous post still stands as your problem. You should get a better debugger such as SoftIce or the free windbg (or it's console equivs).

windbg:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tools/tools/windbg_debugger.asp

Set up the symbol server, so you can download the symbols from MS symbol server.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vsdebug/html/vxtskusingasymbolserver.asp

Now use the debugger to walk though the disassembly of LdrXXX routines so you can get a better idea of what happens when a executable is executed (including dll attachement)

[Quell]

ok , i am doing that to get some info and all.....buit what other way is there to load the dll into the memory?
thx

[Quell]

hey, sry for the mistake in the prev post about the user32/kernerl32 dll.....
anyways...
what goes to the AppInit_DLLs registry value>?
i mean is it like path to the dll to be injected:
c:\\Folder\\mydll.dll
or do i put the mydll.dll into some sys folder adn tehn just do this:
mydll.dll
for the AppInit_DLLs value in the reg?
thx

[Mick]

It follows the search order of LoadLibrary(...)

Here is a article on some of the various techniques.

http://www.thecodeproject.com/system/hooksys.asp

Note and read the references at the bottom, also a good idea to buy some windoze internals books which some are mentioned.