Hook LoadLibrary call from managed code

后端 未结 4 1705
[愿得一人]
[愿得一人] 2021-01-01 03:56

We would like to hook calls to LoadLibrary in order to download assemblies that are not found. We have a handler for ResolveAssembly that handles the managed assemblies, bu

相关标签:
4条回答
  • 2021-01-01 04:39

    Should work, but try using detours (or the free N-CodeHook) instead.
    Detours is almost the de-facto way of instrumenting Win32 binaries.

    0 讨论(0)
  • 2021-01-01 04:44

    We resolved the specified issue via a call to VirtualProtect() prior to calling WriteProcessMemory() and then call it again afterwards to restore the protection levels. This temporarily removes the read-only protection for the memory where the IAT resides. This works well for us and resolves the issue for when LoadLibrary() is called.

    Now if I can just figure out why LoadLibrary() is not called when an unmanaged assembly links against a lib (not a static lib)...

    By the way, Detour and N-Code Hook both look like nice products and are most likely the way I should go, but I would like to avoid adding a 3rd party assembly if possible.

    0 讨论(0)
  • 2021-01-01 04:59

    I have successfully hooked from Managed code. However, I did it by injecting an unmanaged DLL into the remote process and have it rewrite the import table in DllMain. You may want to consider this method.

    Here is my hooking function:

    //structure of a function to hook
    struct HookedFunction {
    public:
        LPTSTR moduleName;
        LPTSTR functionName;
        LPVOID newfunc;
        LPVOID* oldfunc;
    };
    
    BOOL Hook(HMODULE Module, struct HookedFunction Function) {
        //parse dos header
        IMAGE_DOS_HEADER* dos_header = (IMAGE_DOS_HEADER*)Module;
        if (dos_header->e_magic != IMAGE_DOS_SIGNATURE) return 0; //not a dos program
    
        //parse nt header
        IMAGE_NT_HEADERS* nt_header = (IMAGE_NT_HEADERS*)(dos_header->e_lfanew + (SIZE_T)Module);
        if (nt_header->Signature != IMAGE_NT_SIGNATURE) return 0; //not a windows program
    
        //optional header (pretty much not optional)
        IMAGE_OPTIONAL_HEADER optional_header = nt_header->OptionalHeader;
        if (optional_header.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC) return 0; //no optional header
    
        IMAGE_IMPORT_DESCRIPTOR* idt_address = (IMAGE_IMPORT_DESCRIPTOR*)(optional_header.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress + (SIZE_T)Module);
        if (!optional_header.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size) return 0; //no import table
    
        //enumerate the import dlls
        BOOL hooked = false;
        for(IMAGE_IMPORT_DESCRIPTOR* i = idt_address; i->Name != NULL; i++)
            //check the import filename
            if (!_stricmp(Function.moduleName, (char*)(i->Name + (SIZE_T)Module)))
                //enumerate imported functions for this dll
                for (int j = 0; *(j + (LPVOID*)(i->FirstThunk + (SIZE_T)Module)) != NULL; j++)
                    //check if the function matches the function we are looking for
                    if (!_stricmp(Function.functionName, (char*)(*(j + (SIZE_T*)(i->OriginalFirstThunk + (SIZE_T)Module)) + (SIZE_T)Module + 2) )) {
                        //replace the function
                        LPVOID* memloc = j + (LPVOID*)(i->FirstThunk + (SIZE_T)Module);
                        if (*memloc != Function.newfunc) { //not already hooked
                            DWORD oldrights;
                            DWORD newrights = PAGE_READWRITE;
                            VirtualProtect(memloc, sizeof(LPVOID), newrights, &oldrights);
                            if (Function.oldfunc && !*Function.oldfunc)
                                *Function.oldfunc = *memloc;
                            *memloc = Function.newfunc;
                            VirtualProtect(memloc, sizeof(LPVOID), oldrights, &newrights);
                        }
                        hooked = true;
                    }
    
        return hooked;
    }
    
    0 讨论(0)
  • The best way would be to hook LoadLibrary/LoadLibraryEx, do the download if needed, and pass the downloaded file down the chain. However, I'd be worried about blocking the GUI during that download.

    0 讨论(0)
提交回复
热议问题