C++/CLI实现inline hook .NET程序

痛定思痛。 2022-06-02 12:40 170阅读 0赞

hook .NET程序的难点在于.NET程序都是JIT临时编译的，函数的地址不确定。我翻了一下MSDN，发现可以用RuntimeMethodHandle的GetFunctionPointer获取编译后的函数地址，于是用C++/CLI调用.NET的反射和GetFunctionPointer就可以实现hook了（用C\#也可以，不过C++做底层的事比较方便）

假设有这样的C\#程序要hook：

namespace TestExe
    {
        /// <summary>
        /// MainWindow.xaml 的交互逻辑
        /// </summary>
        public partial class MainWindow : Window
        {
            public MainWindow()
            {
                InitializeComponent();
            }
    
            private void OnButtonClick(object sender, RoutedEventArgs e)
            {
                TestFunction("test");
            }
    
            private static void TestFunction(string msg)
            {
                MessageBox.Show(msg);
            }
        }
    }

首先可以通过调试或静态分析获得要hook的函数名称

新建一个C++ DLL项目，然后启用CLR支持：

![CLR支持][CLR]

dllmain.cpp：

#include "stdafx.h"
    #include <memory>
    using namespace std;
    using namespace System;
    using namespace Reflection;
    
    
    class InlineHook
    {
    private:
    #pragma pack(push)
    #pragma pack(1)
    #ifndef _WIN64
        class JmpCode
        {
        private:
            const BYTE m_code = 0xE9;
            uintptr_t m_address = 0;
    
        public:
            JmpCode() = default;
    
            JmpCode(uintptr_t srcAddr, uintptr_t dstAddr)
            {
                SetAddress(srcAddr, dstAddr);
            }
    
            void SetAddress(uintptr_t srcAddr, uintptr_t dstAddr)
            {
                m_address = dstAddr - srcAddr - sizeof(JmpCode);
            }
        };
    #else
        struct JmpCode
        {
        private:
            const BYTE m_code[6] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
            uintptr_t m_address = 0;
    
        public:
            JmpCode() = default;
    
            JmpCode(uintptr_t srcAddr, uintptr_t dstAddr)
            {
                SetAddress(srcAddr, dstAddr);
            }
    
            void SetAddress(uintptr_t srcAddr, uintptr_t dstAddr)
            {
                m_address = dstAddr;
            }
        };
    #endif
    #pragma pack(pop)
    
    
        void* const m_originalFunction = nullptr;
        void* const m_hookFunction = nullptr;
        bool m_isEnabled = false;
        BYTE m_oldCode[sizeof(JmpCode)];
    
    public:
        InlineHook(void* originalFunction, void* hookFunction, bool enable = true) :
            m_originalFunction(originalFunction),
            m_hookFunction(hookFunction)
        {
            memcpy(m_oldCode, m_originalFunction, sizeof(m_oldCode));
    
            if (enable)
                Enable();
        }
    
        ~InlineHook()
        {
            Disable();
        }
    
    
        void Enable()
        {
            if (m_isEnabled)
                return;
    
            JmpCode code((uintptr_t)m_originalFunction, (uintptr_t)m_hookFunction);
            DWORD oldProtect, oldProtect2;
            VirtualProtect(m_originalFunction, sizeof(JmpCode), PAGE_EXECUTE_READWRITE, &oldProtect);
            memcpy(m_originalFunction, &code, sizeof(JmpCode));
            VirtualProtect(m_originalFunction, sizeof(JmpCode), oldProtect, &oldProtect2);
    
            m_isEnabled = true;
        }
    
        void Disable()
        {
            if (!m_isEnabled)
                return;
    
            DWORD oldProtect, oldProtect2;
            VirtualProtect(m_originalFunction, sizeof(JmpCode), PAGE_EXECUTE_READWRITE, &oldProtect);
            memcpy(m_originalFunction, m_oldCode, sizeof(JmpCode));
            VirtualProtect(m_originalFunction, sizeof(JmpCode), oldProtect, &oldProtect2);
    
            m_isEnabled = false;
        }
    };
    
    unique_ptr<InlineHook> g_hook;
    
    
    // 调用约定一定要是__clrcall
    void __clrcall MyTestFunction(String^ msg)
    {
        MessageBox(NULL, _T("调用了MyTestFunction"), _T(""), MB_OK);
        Windows::MessageBox::Show("msg = " + msg);
    }
    
    DWORD WINAPI InitHookThread(LPVOID dllMainThread)
    {
        // 等待DllMain（LoadLibrary线程）结束
        WaitForSingleObject(dllMainThread, INFINITE);
        CloseHandle(dllMainThread);
    
        // 反射获取函数指针
        Type^ type = Type::GetType("TestExe.MainWindow, TestExe");
        MethodInfo^ method = type->GetMethod("TestFunction", BindingFlags::NonPublic | BindingFlags::Static);
        void* address = (void*)method->MethodHandle.GetFunctionPointer();
    
        // hook
        g_hook = make_unique<InlineHook>(address, MyTestFunction);
        return 0;
    }
    
    
    #pragma managed(push, off) // 保证native
    BOOL APIENTRY DllMain( HMODULE hModule,
                           DWORD  ul_reason_for_call,
                           LPVOID lpReserved
                         )
    {
        switch (ul_reason_for_call)
        {
        case DLL_PROCESS_ATTACH:
            // 取当前线程句柄
            HANDLE curThread;
            if (!DuplicateHandle(GetCurrentProcess(), GetCurrentThread(), GetCurrentProcess(), &curThread, SYNCHRONIZE, FALSE, 0))
                return FALSE;
            // DllMain中不能运行托管代码，所以要在另一个线程初始化
            CloseHandle(CreateThread(NULL, 0, InitHookThread, curThread, 0, NULL));
            break;
    
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
            break;
        }
        return TRUE;
    }
    #pragma managed(pop)

编译后注入dll到目标进程就可以了，注入的方法参考[我之前的文章][Link 1]，要注意目标程序是32位还是64位的

> 也可以用C\#实现，不过C\#写的dll不能直接注入，解决方法是用C++/CLI写个引导dll，然后在引导dll里用`Assembly::LoadFile`载入C\#写的dll并调用指定函数

## 效果 ##

![效果][SouthEast]

![效果][SouthEast 1]

[CLR]: /images/20220602/a6455c8e283743b1a5bca0177654463c.png
[Link 1]: http://blog.csdn.net/xfgryujk/article/details/50478295
[SouthEast]: /images/20220602/fe4a79e2e0ca46669abc62fb54506ee5.png
[SouthEast 1]: /images/20220602/5d88323b331d45e6a79184b4c2de8735.png