{"id":1278,"date":"2013-05-29T12:09:00","date_gmt":"2013-05-29T04:09:00","guid":{"rendered":"http:\/\/blog.dynox.cn\/?p=1278"},"modified":"2013-05-29T15:48:20","modified_gmt":"2013-05-29T07:48:20","slug":"%e7%94%b1hook%e5%bc%95%e8%b5%b7%e7%9a%84xp-explorer%e5%b4%a9%e6%ba%83","status":"publish","type":"post","link":"https:\/\/blog.dynox.cn\/?p=1278","title":{"rendered":"\u7531Hook\u5f15\u8d77\u7684XP Explorer\u5d29\u6e83"},"content":{"rendered":"

\u6709\u7528\u6237\u53cd\u5e94XP\u7cfb\u7edf\u4e0a\u4e00\u62d6\u52a8\u684c\u9762\u4e0a\u7684\u56fe\u6807\u5373\u4f1a\u5bfc\u81f4\u684c\u9762\u91cd\u542f\uff0c\u9a8c\u8bc1\u540e\uff0c\u8bc1\u5b9e\u548c360\u5b89\u5168\u7684\u5347\u7ea7\u6709\u5173\uff0c360\u5b89\u51689.0\u53ca\u540e\u7eed\u7248\u672c\u548c\u6211\u4eec\u7684\u8f6f\u4ef6\u6709\u51b2\u7a81\u3002<\/font><\/p>

360\u5b89\u5168\u672c\u8eab\u592a\u6fc0\u8fdb\uff0c\u4f5c\u4e3a\u4e00\u6b3e\u5b89\u5168\u53ca\u9632\u6bd2\u8f6f\u4ef6\u6765\u8bf4\uff0c\u6fc0\u8fdb\u5e76\u4e0d\u662f\u4ec0\u4e48\u597d\u4e8b\uff0c\u8fd9\u4e5f\u662f\u6211\u4e0d\u559c\u6b22\u7528360\u5b89\u5168\u8f6f\u4ef6\u7684\u539f\u56e0\u4e4b\u4e00\u3002<\/font>\u4f46\u662f\u5728\u4e8b\u60c5\u672a\u67e5\u51fa\u539f\u56e0\u4e4b\u524d\uff0c\u4e0d\u80fd\u968f\u4fbf\u602a\u7f6a360\uff0c\u6bd5\u7adf\u5728\u4e8c\u8005\u4e0d\u5171\u5b58\u65f6\uff0c\u5747\u4e0d\u4f1a\u6709\u684c\u9762\u5d29\u6e83\u7684\u4e8b\u60c5\u53d1\u751f\u3002<\/font><\/p>

\u5148\u901a\u8fc7\u6392\u9664\u6cd5\uff0c\u53d1\u73b0\u51b2\u7a81\u53d1\u751f\u5728Hook\u4e0a\uff0c\u800c\u4e14\u662f\u5728\u7279\u5b9a\u7684\u54cd\u5e94\u62d6\u62fd\u4e8b\u4ef6\u7684API\u7684Hook\u4e0a\uff1a<\/font><\/p>

    ole32.dll: DoDragDrop<\/p>

\u95ee\u9898\u5b9a\u4f4d\u4e4b\u540e\u7167\u7406\u5e94\u8be5\u5f88\u76f4\u63a5\u4e86\uff0c\u4f46\u5206\u6790\u65b0\u7684DoDragDrop\u7684\u5b9e\u73b0\u53ca\u76f8\u5173\u4ee3\u7801\uff0c\u5e76\u6ca1\u6709\u53d1\u73b0\u660e\u663e\u95ee\u9898\u3002<\/font><\/p>

\u6211\u4eec\u7684\u4ee3\u7801\u5728\u4e00\u4e2aDLL\u6587\u4ef6\u4e2d\uff0c\u5e76\u6839\u636e\u9700\u8981\u6ce8\u5165\u88abHook\u7684\u8fdb\u7a0b\uff0c\u6b64\u6848\u4e2d\u4fbf\u662fExplorer.exe\u3002\u8c03\u8bd5\u8d77\u6765\u7a0d\u6709\u4e9b\u5468\u6298\uff0c\u4f46\u4e5f\u4e0d\u7b97\u592a\u9ebb\u70e6\u3002<\/font>\u5bf9\u6b64\u7c7b\u7684\u5e94\u7528\u5c42\u8c03\u8bd5\u95ee\u9898\uff0c\u7528VS (Visual Studio)\u8fdc\u7a0b\u8c03\u8bd5\u6700\u65b9\u4fbf\u3002\u8fdc\u7a0battach\u5230\u76ee\u6807XP\u7cfb\u7edf\u4e0a\u7684explorer.exe\u8fdb\u7a0b\uff0c\u7136\u540e\u89e6\u53d1\u5d29\u6e83\u4e8b\u4ef6\uff0cVS\u76f4\u63a5\u54cd\u5e94\uff0c\u663e\u793a\u95ee\u9898\u51fa\u5728\u4e00\u6761\u5f88\u6b63\u5e38\u7684\u538b\u6808\uff08push\uff09\u64cd\u4f5c\u4e0a\uff0c\u518d\u67e5\u770b\u5806\u6808\u6307\u9488\uff0c\u679c\u7136\u5df2\u7ecf\u8017\u5c3d\uff0cesp\u6240\u6307\u5185\u5b58\u4e3a\u975e\u6cd5\u5730\u5740\uff08\u7a7a\u9875\uff09\u3002<\/font><\/p>

\u521d\u6b65\u63e3\u6d4b\u53ef\u80fd\u662f\u5806\u6808\u4e0d\u591f\u6240\u81f4\uff0cexplorer.exe\u9ed8\u8ba4\u7684size of stack reserve\u662f0x400000\uff0c\u53734M\u5b57\u8282\u3002\u4e3a\u4e86\u9a8c\u8bc1\u662f\u4e0d\u662f\u5806\u6808\u7684\u95ee\u9898\uff0c\u76f4\u63a5\u5c06\u4fee\u6539explorer.exe\u7684PE\u6587\u4ef6\u5934\uff0c\u5c06reserved stack size\u6539\u6210\u4e8664M\uff080x4000000\uff09\u3002<\/font><\/p>

\u518d\u6d4b\u8bd5\u65f6\uff0cexplorer.exe\u5728\u62d6\u52a8\u684c\u9762\u56fe\u6807\u65f6\u8fd8\u662f\u4f1a\u5d29\u6e83\uff0c\u53ea\u662f\u4f1a\u7b49\u4e0a\u4e00\u4f1a\uff0c\u4e0d\u50cf\u4e4b\u524d\u4e00\u62d6\u52a8\u4fbf\u7acb\u5373\u5d29\u6e83\uff0c\u770b\u6765\u95ee\u9898\u5e76\u4e0d\u662f\u5806\u53e0\u4e0d\u591f\u6240\u81f4\u3002<\/font><\/p>

\u901a\u8fc7VS\u4e2d\u65ad\uff0c\u53d1\u73b0Call stack\u4e2d\u5168\u662fiNetSafe.dll (360\u5b89\u5168\u7684\u4e00\u4e2a\u6a21\u5757)\uff0c\u7531\u6b64\u65ad\u5b9a\u51fa\u73b0\u4e86\u5d4c\u5957\u8c03\u7528\uff0c\u6b7b\u5faa\u73af\u3002<\/font><\/p>

\u540e\u9762\u7ee7\u7eed\u8ddf\u8e2a\u4ee3\u7801\u7684\u8c03\u7528\u8fc7\u7a0b\u53d1\u73b0\u4e86\u8fd9\u6837\u4e00\u4e2a\u6709\u8da3\u7684\u4e8b\uff0c<\/font>\u5148\u5c06\u76f8\u5173\u4ee3\u7801\u5217\u51fa\u6765\uff1a<\/font><\/p>

ole32.dll\u5730\u5740\u7a7a\u95f4 \u3010774E0000 - 7761E000\u3011:
<\/strong>_DoDragDrop@16:
775D0DC0 E9 0B DA 13 EE       jmp         6570E7D0
775D0DC5 83 EC 4C                sub         esp,4Ch
\u3002\u3002\u3002\u3002\u3002\u3002<\/p>

iNetSafe.dll\u7684\u5730\u5740\u7a7a\u95f4 \u301065700000 - 65737000\u3011\uff1a<\/strong>
6570E7D0 E9 AB 3A 1E 9B       jmp         CDragDropObj::NewDoDrapDrop (8F2280h) 
6570E7D5 57                           push        edi 
\u3002\u3002\u3002\u3002\u3002\u3002
6570E7F5 8B 4C 24 18          mov         ecx,dword ptr [esp+18h] 
6570E7F9 8B 54 24 14          mov         edx,dword ptr [esp+14h] 
6570E7FD 51                         push        ecx 
6570E7FE 8B 4C 24 14          mov         ecx,dword ptr [esp+14h] 
6570E802 52                   push        edx 
6570E803 51                   push        ecx 
6570E804 56                   push        esi 
6570E805 FF D0                call        eax                     [eax: 6FFE00A0]
6570E807 5F                   pop         edi 
6570E808 5E                   pop         esi 
6570E809 C2 10 00             ret         10h 
6570E80C 8B C7                mov         eax,edi 
6570E80E 5F                   pop         edi 
6570E80F 5E                   pop         esi 
6570E810 C2 10 00             ret         10h <\/p>

360 iNetSafe.dll \u6240\u7ef4\u62a4\u7684Hook\u5730\u5740\u4fe1\u606f\uff1a<\/strong>
6FFE00A0 E9 DB 21 91 90       jmp         CDragDropObj::NewDoDrapDrop (8F2280h) 
6FFE00A5 E9 1B 0D 5F 07       jmp         _DoDragDrop@16+5 (775D0DC5h)  <\/p>

MyHook32.dll\u5730\u5740\u7a7a\u95f4 \u3010008F0000 - 00C5F000\u3011:<\/strong>
CDragDropObj::NewDoDrapDrop:
008F2280 55                   push        ebp 
008F2281 8B EC                mov         ebp,esp 
008F2283 8B 0D 38 70 C1 00    mov         ecx,dword ptr [\u2026::m_OldDoDragDrop 0C17038h] 
                                                                  0C17038h:0EC9002C  ECX = 0EC9002C 
008F2289 33 C0                xor         eax,eax 
008F228B 85 C9                test        ecx,ecx 
008F228D 74 03                je          CDragDropObj::NewDoDrapDrop+12h (8F2292h) 
008F228F 5D                   pop         ebp 
008F2290 FF E1                jmp         ecx                              [ecx = 0EC9002C]
008F2292 5D                   pop         ebp 
008F2293 C2 10 00             ret         10h  <\/p>

MyHook32.dll: \u539f\u5730\u5740\u53ca\u4ee3\u7801<\/strong>
0EC9002C 56                         push        esi 
0EC9002D 8B 74 24 08          mov         esi,dword ptr [esp+8] 
0EC90031 E9 9F E7 A7 56      jmp         6570E7D5  <\/p>

\u6d41\u7a0b\u5206\u6790\uff1a<\/strong><\/font><\/p>

\u5f53Explorer\u8c03\u7528_DoDragDrop()\u51fd\u6570\u65f6\uff0c\u5c06\u8df3\u8f6c\u5230iNetSafe\u7684DoDragDrop\u5b9e\u73b0\uff0c\u5730\u5740\u4e3a6570E7D0\u3002iNetSafe\u7684DoDragDrop\u51fd\u6570\u53c8\u88abMyHook32 Hook\u4e86\uff0c\u6240\u4ee5\u8fd8\u8981\u7ee7\u7eed\u8df3\u81f3\u5730\u5740008F2280\u3002MyHook32\u6267\u884c\u5b8c\u8fd8\u4f1a\u8df3\u8f6c\u81f3\u88abHook\u524d\u7684_DoDragDrop\u51fd\u6570\uff0c\u5730\u5740\u5b58\u653e\u4e8e0EC90032\u5904\uff0c\u8df3\u8f6c\u5730\u5740\u4e3a\uff1a6570E7D5\uff0c\u5373iNetSafe\u7684DoDragDrop\u51fd\u6570\u5165\u53e3\u52a0\u4e0a5\u4e2a\u5b57\u8282\u7684\u504f\u79fb\u3002\u540c\u7406\uff0ciNetSafe\u7684DoDragDrop\u51fd\u6570\u4e5f\u8981\u8c03\u7528\u5b83\u6240Hook\u7684\u539fDoDragDrop\u5730\u5740\uff0c\u6b64\u5730\u5740\u7684\u8df3\u8f6c\u6307\u4ee4\u5b58\u653e\u4e8e6FFE00A0\u5904\u3002\u4f46\u5947\u602a\u7684\u662f\uff0c\u4f4d\u7f6e6FFE00A0\u6240\u5b58\u653e\u7684\u5730\u5740\u7adf\u6307\u5411MyHoo32\u7684<\/font>
NewDoDrapDrop\uff08\u53738F2280\uff09\uff0c\u6240\u4ee5\u4efb\u4f55\u5bf9_DoDragDrop\u7684\u8c03\u7528\uff0c\u5c06\u4f1a\u9677\u5165\u4e00\u4e2a\u5d4c\u5957\u7684\u6b7b\u5faa\u73af\u91cc\u518d\u4e5f\u51fa\u4e0d\u6765\u4e86\uff0c\u76f4\u5230\u5806\u6808\u88ab\u8017\u5c3d\u3002<\/font><\/p>

\u4ece\u4e0a\u9762\u4ee3\u7801\u4e0a\u6765\u770b\uff0ciNetSafe\u5728\u524d\uff0cMyHook32\u5728\u540e\uff0c\u6240\u4ee5iNetSafe\u4e8e6FFE00A0\u4e2d\u6240\u4fdd\u5b58\u7684\u539f_DoDragDrop\u5730\u5740\u4e0d\u5e94\u8be5\u662fMyHook32\u7684\uff0c\u800c\u5e94\u8be5\u662fole32\u7684_DoDragDrop\u624d\u662f\u3002<\/font><\/p>

\u4f46\u6839\u636eExplorer.exe\u8fdb\u7a0b\u7684\u52a0\u8f7d\u6a21\u5757\u8868\uff0cMyHook32.dll\u7684\u52a0\u8f7dorder\u4e3a40\uff0c\u800ciNetSafe\u5219\u4e3a103\uff0c\u660e\u663e\u662fMyHook32.dll\u5148\u88ab\u52a0\u8f7d\uff0c\u6240\u4ee5Hook\u7684\u987a\u5e8f\u660e\u663e\u8fdd\u80cc\u4e0a\u9762\u7684\u5206\u6790\u3002<\/font><\/p>

\u81f3\u6b64\uff0c\u65b9\u60f3\u5230\u95ee\u9898\u53ef\u80fd\u51fa\u5728MyHook32\u7684Anti-UnHook\u68c0\u67e5\u673a\u5236\u4e0a\u3002MyHook32\u5728\u4e00\u4e2a\u7ebf\u7a0b\u91cc\u9762\u4f1a\u5b9e\u65f6\u68c0\u6d4b\u88abHook\u7684\u51fd\u6570\u5165\u53e3\u4ee3\u7801\uff0c\u5982\u679c\u4e0d\u662fMyHook32\u81ea\u5df1\u7684\uff0c\u5219\u4f1a\u518d\u6b21\u5c1d\u8bd5Hook\uff0c\u56e0\u4e3a360\u7684Hook\uff0c\u4fbf\u5bfc\u81f4\u4e86MyHook32\u7684\u518dHook\uff0c\u6240\u4ee5\u7ed3\u679c\u4fbf\u5bfc\u81f4\u4e86\u5d4c\u5957Hook\u7684\u4e4c\u9f99\u3002<\/font><\/p>

\u95ee\u9898\u5df2\u7ecf\u660e\u786e\uff0c\u5e76\u4e0d\u662f360\u7684\u95ee\u9898\uff0c\u800c\u662f\u51fa\u5728\u6211\u4eec\u81ea\u5df1\u7684\u7a0b\u5e8f\u4e0a\uff0c\u5b9e\u5728\u4e0d\u5e94\u8be5\u5148\u5165\u4e3a\u4e3b\u7684\u602a\u7f6a360\uff0c\u5c3d\u7ba1\u5176\u4e2d\u8fd8\u662f\u6709\u4e0d\u5c11\u611f\u60c5\u56e0\u7d20\u3002<\/font><\/p>

\u8c03\u8bd5\u7ec8\u4e8e\u7ed3\u675f\uff0c\u5269\u4e0b\u7684\u7684\u4e8b\u60c5\u4fbf\u662f\u601d\u8003\u51fa\u4e00\u4e2a\u4e07\u5168\u7684Anti-UnHook\u673a\u5236\u4e86\u3002<\/font><\/p>

\u4e0b\u56fe\u4e3aExplorer.exe\u6240\u52a0\u8f7d\u7684\u6a21\u5757(\u622a\u5c4f\u81eaVS2010)\uff1a<\/font><\/p>

\"HookModules-01\"<\/a>\"HookModules-02\"<\/a>\"HookModules-03\"<\/a><\/p>

\u6ce8\uff1a\u6709\u51e0\u4e2aDLL\u7684\u56fe\u6807\u4e0a\u5747\u6709\u7ea2\u53f9\u53f7\uff0c\u8868\u793a\u662f\u6b64DLL\u88ab\u52a0\u8f7d\u5230\u7684\u865a\u62df\u5730\u5740\u7a7a\u95f4\u5e76\u4e0d\u662f\u6b64DLL\u6240\u6307\u5b9a\u7684\u5730\u5740\u7a7a\u95f4\u3002\u5982MyHook32.dll\uff08\u6b64\u7248\u672c\u4e3aDEBUG\u7248\u672c\uff0c\u6545\u4f53\u79ef\u53ca\u5360\u7528\u7684\u5730\u5740\u8303\u56f4\u4e5f\u6bd4\u8f83\u5927\uff09\u5176\u9ed8\u8ba4\u7684\u865a\u62df\u5730\u5740\u4e3a10000000 - 1036EFFF\uff0c\u800c\u5b9e\u9645\u4e0a\u5374\u88ab\u52a0\u8f7d\u81f3008F0000 - 00C5F000\u3002\u5bf9\u4e8eDLL\u6587\u4ef6\u7684\u52a0\u8f7d\u53ca\u4eceVista\u4e4b\u540e\u6240\u652f\u6301\u7684ASLR(Address Space Layout Randomization)\uff0c\u4ee5\u540e\u6709\u673a\u4f1a\u518d\u5355\u72ec\u4ecb\u7ecd\u3002<\/font><\/p><\/div>","protected":false},"excerpt":{"rendered":"

\u6709\u7528\u6237\u53cd\u5e94XP\u7cfb\u7edf\u4e0a\u4e00\u62d6\u52a8\u684c\u9762\u4e0a\u7684\u56fe\u6807\u5373\u4f1a\u5bfc\u81f4\u684c\u9762\u91cd\u542f\uff0c\u9a8c\u8bc1\u540e\uff0c\u8bc1\u5b9e\u548c360\u5b89\u5168\u7684\u5347\u7ea7\u6709\u5173\uff0c360\u5b89\u51689.0\u53ca […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[9],"tags":[511,513,512,164,509,510],"views":3915,"_links":{"self":[{"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=\/wp\/v2\/posts\/1278"}],"collection":[{"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1278"}],"version-history":[{"count":5,"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=\/wp\/v2\/posts\/1278\/revisions"}],"predecessor-version":[{"id":1283,"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=\/wp\/v2\/posts\/1278\/revisions\/1283"}],"wp:attachment":[{"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.dynox.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}