|
|
楼主 |
发表于 2010-8-18 08:43:04
|
显示全部楼层
直接恢复自身进程的Inline Hook也可以：
- Option Explicit
- Private Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
- Private Declare Function TerminateProcess Lib "kernel32.dll" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
- Private Declare Function VirtualProtect _
- Lib "kernel32.dll" (ByRef lpAddress As Any, _
- ByVal dwSize As Long, _
- ByVal flNewProtect As Long, _
- ByRef lpflOldProtect As Long) As Long
- Private Declare Function MapViewOfFile _
- Lib "kernel32.dll" (ByVal hFileMappingObject As Long, _
- ByVal dwDesiredAccess As Long, _
- ByVal dwFileOffsetHigh As Long, _
- ByVal dwFileOffsetLow As Long, _
- ByVal dwNumberOfBytesToMap As Long) As Long
- Private Declare Sub CopyMemory _
- Lib "kernel32.dll" _
- Alias "RtlMoveMemory" (ByRef Destination As Any, _
- ByRef Source As Any, _
- ByVal Length As Long)
- Private Declare Function UnmapViewOfFile _
- Lib "kernel32.dll" (ByRef lpBaseAddress As Any) As Long
- Private Declare Function CloseHandle _
- Lib "kernel32.dll" (ByVal hObject As Long) As Long
- Private Declare Function LoadLibrary _
- Lib "kernel32.dll" _
- Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long
- Private Declare Function GetProcAddress _
- Lib "kernel32.dll" (ByVal hModule As Long, _
- ByVal lpProcName As String) As Long
- Private Declare Function CreateFile _
- Lib "kernel32.dll" _
- Alias "CreateFileA" (ByVal lpFileName As String, _
- ByVal dwDesiredAccess As Long, _
- ByVal dwShareMode As Long, _
- ByRef lpSecurityAttributes As Long, _
- ByVal dwCreationDisposition As Long, _
- ByVal dwFlagsAndAttributes As Long, _
- ByVal hTemplateFile As Long) As Long
- Private Declare Function CreateFileMapping _
- Lib "kernel32.dll" _
- Alias "CreateFileMappingA" (ByVal hFile As Long, _
- ByRef lpFileMappigAttributes As Long, _
- ByVal flProtect As Long, _
- ByVal dwMaximumSizeHigh As Long, _
- ByVal dwMaximumSizeLow As Long, _
- ByVal lpName As String) As Long
- Private Declare Function GetFileSize _
- Lib "kernel32.dll" (ByVal hFile As Long, _
- ByRef lpFileSizeHigh As Long) As Long
- Private Type SECURITY_ATTRIBUTES
- nLength As Long
- lpSecurityDescriptor As Long
- bInheritHandle As Long
- End Type
- Const FILE_ATTRIBUTE_NORMAL As Long = &H80
- Const SECTION_MAP_READ As Long = &H4
- Const FILE_MAP_READ As Long = SECTION_MAP_READ
- Const FILE_SHARE_READ As Long = &H1
- Const GENERIC_READ As Long = &H80000000
- Const OPEN_EXISTING As Long = 3
- Const PAGE_EXECUTE_READWRITE As Long = &H40
- Const PAGE_READONLY As Long = &H2
- Const SEC_IMAGE As Long = &H1000000
- Const INVALID_HANDLE_VALUE As Long = (-1)
- Public Function RemoveFWHook(szDllPath As String, szFuncName As String) As Boolean
- Dim hModule As Long, lpFunc As Long, lpBase As Long, dwRVA As Long, hFile As Long
- Dim dwSize As Long, hMapFile As Long, lpBaseMap As Long, lpRealFunc As Long, dwOldProtect As Long
- Dim bRes As Boolean
- lpBase = LoadLibrary(szDllPath)
- lpFunc = GetProcAddress(ByVal lpBase, szFuncName)
- If lpFunc = False Then
- RemoveFWHook = False
- End If
- dwRVA = lpFunc - lpBase
- hFile = CreateFile(szDllPath, GENERIC_READ, FILE_SHARE_READ, ByVal 0&, OPEN_EXISTING, _
- FILE_ATTRIBUTE_NORMAL, 0)
- If hFile = INVALID_HANDLE_VALUE Then
- RemoveFWHook = False
- End If
- dwSize = GetFileSize(hFile, 0)
- hMapFile = CreateFileMapping(hFile, ByVal 0&, PAGE_READONLY Or SEC_IMAGE, 0, dwSize, 0)
- lpBaseMap = MapViewOfFile(hMapFile, FILE_MAP_READ, 0, 0, dwSize)
- lpRealFunc = lpBaseMap + dwRVA
- bRes = True
- If (VirtualProtect(ByVal lpFunc, 10, PAGE_EXECUTE_READWRITE, dwOldProtect)) Then
- CopyMemory ByVal lpFunc, ByVal lpRealFunc, 10
- Else
- bRes = False
- End If
- UnmapViewOfFile lpBaseMap
- CloseHandle (hMapFile)
- CloseHandle (hFile)
- RemoveFWHook = bRes
- End Function
- Private Sub Command1_Click()
- MsgBox RemoveFWHook(Environ$("windir") & "\system32\ntdll.dll", "NtOpenProcess"), , "Is Removed"
- Call TerminateProcess(OpenProcess(1, 0, CLng(Text1.Text)), 0)
- End Sub
|
|
发表于 2010-8-18 00:36:30
发表于 2010-8-18 09:08:58
