关于文件读写的监控, 通过APIHOOK来实现

有的时候，我们需要对程序读写文件的时候进行监控，尤其是文件的数据是保密的，而且不能直接存储在磁盘上。举个最简单的例子来说，当我们有个文件在磁盘上，而这个文件是加密的，这时候在程序打开文件的时候，通过输入密钥进行解密了，但是这些解密了的数据，是不能写回磁盘的，只能放在RAM中，这时候如果程序想通过正常的文件操作来访问数据的话，那么这就需要我们来对这个文件操作的API下钩子函数了。

对于钩子函数的介绍，可以通过下面的几篇文章来了解，前提是必须了解PE格式中的输入表区块内容。

1. http://zhidao.baidu.com/question/56417343.html
2. http://baike.baidu.com/view/1037259?wtp=tt-
3. http://zhidao.baidu.com/question/5555707.html
等等，百度上一大相关文章。

在网上看了不少这方面的资料，发现很多东西写的都好散，没有封装起来，因此我就花了点功夫，把它封装了起来，还没完全测试，先把代码共享一下，如果各位有什么bug的话，请留言，我会尽快改进的。

--------------------------------------------

------------- HooAPI.h -----------------

--------------------------------------------

#pragma once
#include<vector>
#include "Toolhelp.h"

struct HookAPIEntry{
// 这个是模块的名字,比如usr32.dll
CString  strMoudleName ;
// 这个是需要下钩子的API函数
CString  strFunctionName ;
// API函数的原始地址
PROC  pOriginalProc ;
// API函数的新地址
PROC  pNewProc ;
HookAPIEntry(){
pOriginalProc = pNewProc = NULL ;
};
};
typedef HookAPIEntry * PHookAPIEntry ;
typedef HookAPIEntry * LPHookAPIEntry ;
typedef std::vector<PHookAPIEntry> HookAPIEntryList ;
typedef HookAPIEntryList * PHookAPIEntryList ;
typedef HookAPIEntryList * LPHookAPIEntryList ;
typedef std::vector<PHookAPIEntry>::iterator HookAPIEntryPos ;
class CHookAPI
{
public:
CHookAPI(void);
~CHookAPI(void);
public:
// 对钩子函数列表的操作
HRESULT  AddHookAPIEntry(const HookAPIEntry & entry ) ;
HRESULT  AddHookAPIEntry(CString strMoudleName,CString strFunctionName,PROC pNewProc) ;
HRESULT  FindHookAPIEntry(CString strMoudleName,CString strFunctionName,LPHookAPIEntry * pResult);
HRESULT  DeleteHookAPIEntry(CString strMoudleName,CString strFunctionName) ;
HRESULT  ClearAllAPIEntry( void ) ;
HRESULT  ReHookAllMoudleAPI( void ) ;
HRESULT  UnHookAllMoudleAPI( void ) ;

HRESULT  GetHookAPIEntryByNewAddress(PROC pNewAddress,LPHookAPIEntry * pResult) ;
protected:
HRESULT  HookMoudleAPI(const HookAPIEntry & hookentry);
HRESULT  UnHookMoudleAPI(const HookAPIEntry & hookentry);
HRESULT  HookMoudleAPI(HMODULE hmoudle,const HookAPIEntry & hookentry);
HRESULT  UnHookMoudleAPI(HMODULE hmoudle,const HookAPIEntry & hookentry);
HRESULT  ReplaceMoudleAPI(HMODULE hmoudleCaller, const CString &strMoudleName,
PROC pCurAddress,PROC pNewAddress);
HRESULT  GetProcessAddress(const CString &strMoudleName,const CString &strFunctionName,
PROC * pAddress ) ;
HRESULT  UpdateOriginalProc( HookAPIEntry & hookentry);
protected:
// 需要下钩子的函数集合
HookAPIEntryList   m_HookAPIEntryList ;
// 系统的信息
SYSTEM_INFO     m_si;
};

--------------------------------------------

------------- HooAPI.cpp -----------------

--------------------------------------------

#include "StdAfx.h"
#include "HookAPI.h"
#include "Dbghelp.h"
#pragma comment(lib , "imagehlp.lib")
#pragma comment(lib , "Dbghelp.lib")
CHookAPI::CHookAPI(void)
{
GetSystemInfo(&m_si) ;
}

CHookAPI::~CHookAPI(void)
{
}
////
HRESULT CHookAPI::AddHookAPIEntry(const HookAPIEntry & entry ) {
// 已经存在了,就不用添加了
if( S_OK == FindHookAPIEntry(entry.strMoudleName,entry.strFunctionName,NULL ) )
return S_FALSE ;
LPHookAPIEntry pentry = new HookAPIEntry() ;
* pentry = entry ;
m_HookAPIEntryList.push_back(pentry) ;
UpdateOriginalProc(*pentry) ;
HookMoudleAPI(entry);
return S_OK ;
}
HRESULT CHookAPI::AddHookAPIEntry(CString strMoudleName,CString strFunctionName,PROC pNewProc) {
if( S_OK == FindHookAPIEntry(strMoudleName,strFunctionName,NULL ) )
return S_FALSE ;
LPHookAPIEntry pentry = new HookAPIEntry() ;
pentry->strMoudleName = strMoudleName ;
pentry->strFunctionName = strFunctionName ;
pentry->pNewProc = pNewProc ;
m_HookAPIEntryList.push_back(pentry) ;
UpdateOriginalProc(*pentry) ;
HookMoudleAPI(*pentry);
return S_OK ;
}
HRESULT CHookAPI::FindHookAPIEntry(CString strMoudleName,CString strFunctionName,LPHookAPIEntry * pResult){
HookAPIEntryPos pos ;
for( pos = m_HookAPIEntryList.begin(); pos != m_HookAPIEntryList.end() ; pos ++ ){
PHookAPIEntry pHookAPIEntry = * pos ;
if( NULL != pHookAPIEntry &&
pHookAPIEntry->strMoudleName.CompareNoCase(strMoudleName) == 0 &&
pHookAPIEntry->strFunctionName.Compare(strFunctionName) == 0 ){
// 已经找到了
if( pResult == NULL )
* pResult = pHookAPIEntry ;
return S_OK ;
}
};
return S_FALSE ;
}
HRESULT CHookAPI::DeleteHookAPIEntry(CString strMoudleName,CString strFunctionName) {
HookAPIEntryPos pos ;
for( pos = m_HookAPIEntryList.begin(); pos != m_HookAPIEntryList.end() ; pos ++ ){
PHookAPIEntry pHookAPIEntry = * pos ;
if( NULL != pHookAPIEntry &&
pHookAPIEntry->strMoudleName.CompareNoCase(strMoudleName) == 0 &&
pHookAPIEntry->strFunctionName.Compare(strFunctionName) == 0 ){
// 已经找到了
UnHookMoudleAPI(*pHookAPIEntry) ;
m_HookAPIEntryList.erase(pos) ;
delete pHookAPIEntry ;
pHookAPIEntry = NULL ;
return S_OK ;
}
};
return S_OK ;
}
HRESULT CHookAPI::ClearAllAPIEntry( void ) {
UnHookAllMoudleAPI() ;
HookAPIEntryPos pos ;
PHookAPIEntry pHookAPIEntry = NULL ;
while( m_HookAPIEntryList.size() > 0 ) {
pos = m_HookAPIEntryList.begin() ;
pHookAPIEntry = * pos ;

m_HookAPIEntryList.erase(pos) ;
if( NULL == pHookAPIEntry ){
delete pHookAPIEntry ;
pHookAPIEntry = NULL ;
}
}
return S_OK ;
}

HRESULT CHookAPI::GetHookAPIEntryByNewAddress(PROC pNewAddress,LPHookAPIEntry * pResult ) {
HookAPIEntryPos pos ;
for( pos = m_HookAPIEntryList.begin(); pos != m_HookAPIEntryList.end() ; pos ++ ){
PHookAPIEntry pHookAPIEntry = * pos ;
if( NULL != pHookAPIEntry &&
pHookAPIEntry->pNewProc ==  pNewAddress){
// 已经找到了
if( NULL != pResult ){
* pResult = * pos ;
return S_OK ;
}
}
};
return S_FALSE ;
}
HRESULT CHookAPI::UpdateOriginalProc( HookAPIEntry & hookentry){
if(S_OK != GetProcessAddress(hookentry.strMoudleName,
hookentry.strFunctionName,&hookentry.pOriginalProc)){
ASSERT(FALSE) ;
return S_FALSE ;
}
if (hookentry.pOriginalProc > m_si.lpMaximumApplicationAddress)  {
PBYTE pb = (PBYTE) hookentry.pOriginalProc;
if (pb[0] == 0x86){
PVOID pv = * (PVOID*) &pb[1];
hookentry.pOriginalProc = (PROC) pv;
}
}
return S_OK ;
}
HRESULT CHookAPI::GetProcessAddress(const CString &strMoudleName,const CString&strFunctionName,FARPROC * pAddress ){
* pAddress = ::GetProcAddress(GetModuleHandle(strMoudleName), strFunctionName) ;
return S_OK ;
}
HRESULT CHookAPI::ReHookAllMoudleAPI( void ) {
CToolhelp th(TH32CS_SNAPMODULE, GetCurrentProcessId());
MODULEENTRY32 me = { sizeof(me) };
for (BOOL fOk = th.ModuleFirst(&me); fOk; fOk = th.ModuleNext(&me))
{
//TRACE(me.szModule);
// 监控所有的有关文件读写情况
HookAPIEntryPos pos ;
for( pos = m_HookAPIEntryList.begin(); pos != m_HookAPIEntryList.end() ; pos ++ ){
PHookAPIEntry pHookAPIEntry = * pos ;
if(pHookAPIEntry == NULL ){
ASSERT(FALSE) ;
continue ;
}
// 重新获取一下原来的地址
if( pHookAPIEntry->pOriginalProc == NULL ){
if(S_OK != UpdateOriginalProc(*pHookAPIEntry)){
ASSERT(FALSE) ;
continue ;
}
}
// 对所有模块的输入表进行替换
HookMoudleAPI(me.hModule,*pHookAPIEntry) ;
}
};
return S_OK ;
}
HRESULT CHookAPI::UnHookAllMoudleAPI( void ) {
CToolhelp th(TH32CS_SNAPMODULE, GetCurrentProcessId());
MODULEENTRY32 me = { sizeof(me) };
for (BOOL fOk = th.ModuleFirst(&me); fOk; fOk = th.ModuleNext(&me))
{
//TRACE(me.szModule);
// 监控所有的有关文件读写情况
HookAPIEntryPos pos ;
for( pos = m_HookAPIEntryList.begin(); pos != m_HookAPIEntryList.end() ; pos ++ ){
PHookAPIEntry pHookAPIEntry = * pos ;
if(pHookAPIEntry == NULL ){
ASSERT(FALSE) ;
continue ;
}
// 重新获取一下原来的地址
if( pHookAPIEntry->pOriginalProc == NULL ){
if(S_OK != UpdateOriginalProc(*pHookAPIEntry)){
ASSERT(FALSE) ;
continue ;
}
}
// 对所有模块的输入表进行替换
UnHookMoudleAPI(me.hModule,*pHookAPIEntry) ;
}
};
return S_OK ;
}
HRESULT CHookAPI::HookMoudleAPI(const HookAPIEntry & hookentry){
CToolhelp th(TH32CS_SNAPMODULE, GetCurrentProcessId());
MODULEENTRY32 me = { sizeof(me) };
for (BOOL fOk = th.ModuleFirst(&me); fOk; fOk = th.ModuleNext(&me))
{
//TRACE(me.szModule);
// 监控所有的有关文件读写情况
HookMoudleAPI(me.hModule,hookentry) ;
};
return S_OK ;
}
HRESULT CHookAPI::HookMoudleAPI(HMODULE hmoudle,const HookAPIEntry & hookentry){
return ReplaceMoudleAPI(hmoudle,hookentry.strMoudleName,hookentry.pOriginalProc,hookentry.pNewProc);
}
HRESULT CHookAPI::UnHookMoudleAPI(const HookAPIEntry & hookentry){
CToolhelp th(TH32CS_SNAPMODULE, GetCurrentProcessId());
MODULEENTRY32 me = { sizeof(me) };
for (BOOL fOk = th.ModuleFirst(&me); fOk; fOk = th.ModuleNext(&me))
{
//TRACE(me.szModule);
// 监控所有的有关文件读写情况
UnHookMoudleAPI(me.hModule,hookentry) ;
};
return S_OK ;
}
HRESULT CHookAPI::UnHookMoudleAPI(HMODULE hmoudle,const HookAPIEntry & hookentry){
return ReplaceMoudleAPI(hmoudle,hookentry.strMoudleName,hookentry.pNewProc,hookentry.pOriginalProc);
}
HRESULT CHookAPI::ReplaceMoudleAPI(HMODULE hmoduleCaller, const CString &strMoudleName,
PROC pCurAddress,PROC pNewAddress){
// 找到的IAT表
ULONG lsize = 0 ;
PIMAGE_SECTION_HEADER psecHeader ;
PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)
ImageDirectoryEntryToDataEx(hmoduleCaller,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&lsize,&psecHeader);
if( pImportDesc == NULL ){
// ASSERT(FALSE) ;
return S_FALSE ;
}
// 找输入表的相应的模块
while( pImportDesc->Name != 0){
// RVA
CString strdllname = (PSTR)((PBYTE)hmoduleCaller + pImportDesc->Name);
if( strdllname.CompareNoCase(strMoudleName) == 0 )
break ;
pImportDesc ++ ;
}
if( pImportDesc->Name == 0){
//ASSERT(FALSE) ;
return S_FALSE ;
}
// 找输入表的函数地址,FirstThunk为RVA
PIMAGE_THUNK_DATA pThunk=(PIMAGE_THUNK_DATA)((PBYTE)hmoduleCaller + pImportDesc->FirstThunk);
PROC* ppfn;
while( pThunk->u1.Function != 0 ){
ppfn = (PROC*)&pThunk->u1.Function;
if( *ppfn == pCurAddress ){
// 找到了这个输入表中的函数地址，将其修改一下
MEMORY_BASIC_INFORMATION mbi;
VirtualQuery(ppfn,&mbi,sizeof(MEMORY_BASIC_INFORMATION));
VirtualProtect(mbi.BaseAddress,mbi.RegionSize,PAGE_READWRITE,&mbi.Protect);
*ppfn=*pNewAddress;
DWORD dwOldProtect;
VirtualProtect(mbi.BaseAddress,mbi.RegionSize,mbi.Protect,&dwOldProtect);
return S_OK ;
}
pThunk ++ ;
}
return S_OK ;

}

--------------------------------------------

------------- ToolHelp.h -----------------

--------------------------------------------

#pragma once
#include "stdafx.h"
///////////////////////////////////////////////////////////////////////////////
#include <tlhelp32.h>
#include <tchar.h>
#define chINRANGE(low, Num, High) (((low) <= (Num)) && ((Num) <= (High)))
///////////////////////////////////////////////////////////////////////////////

class CToolhelp {
private:
HANDLE m_hSnapshot;
public:
CToolhelp(DWORD dwFlags = 0, DWORD dwProcessID = 0);
~CToolhelp();
BOOL CreateSnapshot(DWORD dwFlags, DWORD dwProcessID = 0);

BOOL ProcessFirst(PPROCESSENTRY32 ppe) const;
BOOL ProcessNext(PPROCESSENTRY32 ppe) const;
BOOL ProcessFind(DWORD dwProcessId, PPROCESSENTRY32 ppe) const;
BOOL ModuleFirst(PMODULEENTRY32 pme) const;
BOOL ModuleNext(PMODULEENTRY32 pme) const;
BOOL ModuleFind(PVOID pvBaseAddr, PMODULEENTRY32 pme) const;
BOOL ModuleFind(PTSTR pszModName, PMODULEENTRY32 pme) const;

BOOL ThreadFirst(PTHREADENTRY32 pte) const;
BOOL ThreadNext(PTHREADENTRY32 pte) const;

BOOL HeapListFirst(PHEAPLIST32 phl) const;
BOOL HeapListNext(PHEAPLIST32 phl) const;
int  HowManyHeaps() const;
// Note: The heap block functions do not reference a snapshot and
// just walk the process's heap from the beginning each time. Infinite
// loops can occur if the target process changes its heap while the
// functions below are enumerating the blocks in the heap.
BOOL HeapFirst(PHEAPENTRY32 phe, DWORD dwProcessID,
UINT_PTR dwHeapID) const;
BOOL HeapNext(PHEAPENTRY32 phe) const;
int  HowManyBlocksInHeap(DWORD dwProcessID, DWORD dwHeapId) const;
BOOL IsAHeap(HANDLE hProcess, PVOID pvBlock, PDWORD pdwFlags) const;
public:
static BOOL EnableDebugPrivilege(BOOL fEnable = TRUE);
static BOOL ReadProcessMemory(DWORD dwProcessID, LPCVOID pvBaseAddress,
PVOID pvBuffer, DWORD cbRead, PDWORD pdwNumberOfBytesRead = NULL);
};

--------------------------------------------

------------- ToolHelp.cpp -----------------

--------------------------------------------

///////////////////////////////////////////////////////////////////////////////

inline CToolhelp::CToolhelp(DWORD dwFlags, DWORD dwProcessID) {
m_hSnapshot = INVALID_HANDLE_VALUE;
CreateSnapshot(dwFlags, dwProcessID);
}

///////////////////////////////////////////////////////////////////////////////

inline CToolhelp::~CToolhelp() {
if (m_hSnapshot != INVALID_HANDLE_VALUE)
CloseHandle(m_hSnapshot);
}

///////////////////////////////////////////////////////////////////////////////

inline int CToolhelp::CreateSnapshot(DWORD dwFlags, DWORD dwProcessID) {
if (m_hSnapshot != INVALID_HANDLE_VALUE)
CloseHandle(m_hSnapshot);
if (dwFlags == 0) {
m_hSnapshot = INVALID_HANDLE_VALUE;
} else {
m_hSnapshot = CreateToolhelp32Snapshot(dwFlags, dwProcessID);
}
return(m_hSnapshot != INVALID_HANDLE_VALUE);
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::EnableDebugPrivilege(BOOL fEnable) {
// Enabling the debug privilege allows the application to see
// information about service applications
BOOL fOk = FALSE;    // Assume function fails
HANDLE hToken;
// Try to open this process's access token
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES,
&hToken)) {
// Attempt to modify the "Debug" privilege
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED : 0;
AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
fOk = (GetLastError() == ERROR_SUCCESS);
CloseHandle(hToken);
}
return(fOk);
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::ReadProcessMemory(DWORD dwProcessID,
LPCVOID pvBaseAddress, PVOID pvBuffer, DWORD cbRead,
PDWORD pdwNumberOfBytesRead) {
return(Toolhelp32ReadProcessMemory(dwProcessID, pvBaseAddress, pvBuffer,
cbRead, pdwNumberOfBytesRead));
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::ProcessFirst(PPROCESSENTRY32 ppe) const {
BOOL fOk = Process32First(m_hSnapshot, ppe);
if (fOk && (ppe->th32ProcessID == 0))
fOk = ProcessNext(ppe); // Remove the "[System Process]" (PID = 0)
return(fOk);
}

inline BOOL CToolhelp::ProcessNext(PPROCESSENTRY32 ppe) const {
BOOL fOk = Process32Next(m_hSnapshot, ppe);
if (fOk && (ppe->th32ProcessID == 0))
fOk = ProcessNext(ppe); // Remove the "[System Process]" (PID = 0)
return(fOk);
}

inline BOOL CToolhelp::ProcessFind(DWORD dwProcessId, PPROCESSENTRY32 ppe)
const {
BOOL fFound = FALSE;
for (BOOL fOk = ProcessFirst(ppe); fOk; fOk = ProcessNext(ppe)) {
fFound = (ppe->th32ProcessID == dwProcessId);
if (fFound) break;
}
return(fFound);
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::ModuleFirst(PMODULEENTRY32 pme) const {
return(Module32First(m_hSnapshot, pme));
}

inline BOOL CToolhelp::ModuleNext(PMODULEENTRY32 pme) const {
return(Module32Next(m_hSnapshot, pme));
}
inline BOOL CToolhelp::ModuleFind(PVOID pvBaseAddr, PMODULEENTRY32 pme) const {
BOOL fFound = FALSE;
for (BOOL fOk = ModuleFirst(pme); fOk; fOk = ModuleNext(pme)) {
fFound = (pme->modBaseAddr == pvBaseAddr);
if (fFound) break;
}
return(fFound);
}
inline BOOL CToolhelp::ModuleFind(PTSTR pszModName, PMODULEENTRY32 pme) const {
BOOL fFound = FALSE;
for (BOOL fOk = ModuleFirst(pme); fOk; fOk = ModuleNext(pme)) {
fFound = (lstrcmpi(pme->szModule,  pszModName) == 0) ||
(lstrcmpi(pme->szExePath, pszModName) == 0);
if (fFound) break;
}
return(fFound);
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::ThreadFirst(PTHREADENTRY32 pte) const {
return(Thread32First(m_hSnapshot, pte));
}

inline BOOL CToolhelp::ThreadNext(PTHREADENTRY32 pte) const {
return(Thread32Next(m_hSnapshot, pte));
}

///////////////////////////////////////////////////////////////////////////////

inline int CToolhelp::HowManyHeaps() const {
int nHowManyHeaps = 0;
HEAPLIST32 hl = { sizeof(hl) };
for (BOOL fOk = HeapListFirst(&hl); fOk; fOk = HeapListNext(&hl))
nHowManyHeaps++;
return(nHowManyHeaps);
}

inline int CToolhelp::HowManyBlocksInHeap(DWORD dwProcessID,
DWORD dwHeapID) const {
int nHowManyBlocksInHeap = 0;
HEAPENTRY32 he = { sizeof(he) };
BOOL fOk = HeapFirst(&he, dwProcessID, dwHeapID);
for (; fOk; fOk = HeapNext(&he))
nHowManyBlocksInHeap++;
return(nHowManyBlocksInHeap);
}

inline BOOL CToolhelp::HeapListFirst(PHEAPLIST32 phl) const {
return(Heap32ListFirst(m_hSnapshot, phl));
}

inline BOOL CToolhelp::HeapListNext(PHEAPLIST32 phl) const {
return(Heap32ListNext(m_hSnapshot, phl));
}

inline BOOL CToolhelp::HeapFirst(PHEAPENTRY32 phe, DWORD dwProcessID,
UINT_PTR dwHeapID) const {
return(Heap32First(phe, dwProcessID, dwHeapID));
}

inline BOOL CToolhelp::HeapNext(PHEAPENTRY32 phe) const {
return(Heap32Next(phe));
}

inline BOOL CToolhelp::IsAHeap(HANDLE hProcess, PVOID pvBlock,
PDWORD pdwFlags) const {
HEAPLIST32 hl = { sizeof(hl) };
for (BOOL fOkHL = HeapListFirst(&hl); fOkHL; fOkHL = HeapListNext(&hl)) {
HEAPENTRY32 he = { sizeof(he) };
BOOL fOkHE = HeapFirst(&he, hl.th32ProcessID, hl.th32HeapID);
for (; fOkHE; fOkHE = HeapNext(&he)) {
MEMORY_BASIC_INFORMATION mbi;
VirtualQueryEx(hProcess, (PVOID) he.dwAddress, &mbi, sizeof(mbi));
if (chINRANGE(mbi.AllocationBase, pvBlock,
(PBYTE) mbi.AllocationBase + mbi.RegionSize)) {
*pdwFlags = hl.dwFlags;
return(TRUE);
}
}
}
return(FALSE);
}

//////////////////////////////// End of File //////////////////////////////////

Jekkay Hu,胡杨

2010-12-18