IAT HOOK的检测

悠悠 2022-10-02 13:57 112阅读 0赞

IAT HOOK的检测

<table style="table-layout:fixed;"> 
 <tbody> 
 <tr> 
 <td> 
 <div>
 IAT HOOK的检测 
 在EXE加载前，IAT表中的结构和INT表中的结构内容一致，如果所示，OriginalFirstThunk指向INT中第一个IMAGE_THUNK_DATA，FirstThunk指向IAT中的第一个IMAGE_THUNK_DATA 
 IMAGE_THUNK_DATA中放着指向IMAGE_IMPORT_BY_NAME的指针 
 
 <img height="166" src="http://www.anqn.com/pic/6/a2007-12-3-734753.gif" width="552" alt=""> 
 &nbsp; 
 在程序装载完成之后，IAT中的数据进行了修改，内容改为相应的API函数地址，如图 
 <img height="143" src="http://www.anqn.com/pic/6/a2007-12-3-580925.gif" width="536" alt=""> 
 进行检测时只需要读取IAT表中的数据，便可得到目标进程所调用的API地址 
 原始的地址，LoadLibrary GetProcAddress 经过换算可以得到 
 <img src="http://hiphotos.baidu.com/darkroot/pic/item/a903af2337b1067%C3%97%C3%97%C3%972ed7e.jpg" alt=""> 
 &nbsp; 
 <img src="http://hiphotos.baidu.com/darkroot/pic/item/0c920cdd6c5706c477c6387e.jpg" alt=""> 
 &nbsp; 
 贴上相关的结构体 
 typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD&nbsp;&nbsp; Characteristics;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // 0 for terminating null import descriptor DWORD&nbsp;&nbsp; OriginalFirstThunk;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // RVA to original unbound IAT (PIMAGE_THUNK_DATA) }; DWORD&nbsp;&nbsp; TimeDateStamp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // 0 if not bound, // -1 if bound, and real date\time stamp //&nbsp;&nbsp;&nbsp;&nbsp; in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) // O.W. date/time stamp of DLL bound to (Old BIND) DWORD&nbsp;&nbsp; ForwarderChain;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // -1 if no forwarders DWORD&nbsp;&nbsp; Name; DWORD&nbsp;&nbsp; FirstThunk;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // RVA to IAT (if bound this IAT has actual addresses) } IMAGE_IMPORT_DESCRIPTOR; typedef struct _IMAGE_THUNK_DATA32 { union { PBYTE&nbsp; ForwarderString; PDWORD Function; DWORD Ordinal; PIMAGE_IMPORT_BY_NAME&nbsp; AddressOfData; } u1; } IMAGE_THUNK_DATA32; &nbsp; 
 </div> </td> 
 </tr> 
 </tbody> 
</table>

转载于:https://blog.51cto.com/laokaddk/454659