dcsimg
CodeGuru Home VC++ / MFC / C++ .NET / C# Visual Basic VB Forums Developer.com
Results 1 to 2 of 2

Thread: How call original function after unhook it?

  1. #1
    Join Date
    Apr 2014
    Posts
    61

    Question How call original function after unhook it?

    I'm hooking the LdrLoadDll() function and have success. Now i want make a small change on code, to when not is a specific dll load, call original function..

    I tried the following implementation but the application crashes when call original function.
    • First i unhook the api
    • After, i attribs to a variable the prototype of LdrLoadDll() the original function and call it

    Why this is failing?

    See:

    Code:
    #include "stdafx.h"
    #include <Windows.h>
    #include <shlwapi.h>
    #include <strsafe.h>
    #include <winternl.h>
    #include <iostream>
    #include <stdio.h>
    
    #pragma comment(lib, "shlwapi.lib")
    
    using namespace std;
    
    bool CheckSubstring(string firstString, string secondString){
    
    	if (secondString.size() > firstString.size())
    		return false;
    
    	for (int i = 0; i < firstString.size(); i++){
    		int j = 0;
    
    		if (firstString[i] == secondString[j]){
    			int k = i;
    			while (firstString[i] == secondString[j] && j < secondString.size()){
    				j++;
    				i++;
    			}
    			if (j == secondString.size())
    				return true;
    			else
    				i = k;
    		}
    	}
    
    	return false;
    }
    
    LPBYTE original = 0;
    DWORD oldFuncAdr = 0;
    
    void HookLdrLoadDll();
    void UnHookLdrLoadDll();
    typedef NTSTATUS(NTAPI *pLdrLoadDll)(PWCHAR, ULONG, PUNICODE_STRING, PHANDLE);
    
    #define STATUS_ACCESS_DENIED 0xC0000022L
    
    NTSTATUS NTAPI FakeLdrLoadDll(PWCHAR PathToFile, ULONG Flags, PUNICODE_STRING ModuleFileName, PHANDLE ModuleHandle)
    {
    	//==================================================
    	
              UnHookLdrLoadDll();
              pLdrLoadDll fnLdrLoadDll = (pLdrLoadDll)oldFuncAdr;
    	
    	//==================================================
    
            size_t   i;
    	char *pMBBuffer = (char *)malloc(BUFFER_SIZE);
    	wchar_t*pWCBuffer = PathFindFileNameW(ModuleFileName->Buffer);
    
    	wcstombs_s(&i, pMBBuffer, (size_t)BUFFER_SIZE, pWCBuffer, (size_t)BUFFER_SIZE);
    
        if (CheckSubstring(pMBBuffer, "aaa") ||
            CheckSubstring(pMBBuffer, "bbb") ||
            CheckSubstring(pMBBuffer, "ccc") ||
            CheckSubstring(pMBBuffer, "ddd") ||
            CheckSubstring(pMBBuffer, "eee") ||
            CheckSubstring(pMBBuffer, "fff"))
        {
            HookLdrLoadDll();
    		
    	if (pMBBuffer)
            {
    	    free(pMBBuffer);
            }
    		
            return STATUS_ACCESS_DENIED;
        }
    	
            if (pMBBuffer)
            {
    	    free(pMBBuffer);
    	}
    
      //=======================================================================
    		
         return fnLdrLoadDll(PathToFile, Flags, ModuleFileName, ModuleHandle);
    	
      //=======================================================================
    }
    
    void HookLdrLoadDll()
    {
        HMODULE hModule = NULL;
        NTSTATUS newFuncAdr = (NTSTATUS)FakeLdrLoadDll;
        DWORD continueAdr = 0;
        DWORD jmpAdr = 0;
        LPBYTE pOldFuncAdr = 0;
        LPBYTE pJmpAdr = 0;
        DWORD oldProtect;
        DWORD i = 0;
    
        hModule = LoadLibrary(TEXT("ntdll.dll"));
    
        oldFuncAdr = (DWORD)GetProcAddress(hModule, "LdrLoadDll");
    
        jmpAdr = newFuncAdr - oldFuncAdr - 5;
    
        pOldFuncAdr = (LPBYTE)oldFuncAdr;
    
        pJmpAdr = (LPBYTE)(&jmpAdr);
    
        if (!VirtualProtect(pOldFuncAdr, 5, PAGE_EXECUTE_READWRITE, &oldProtect))
        {
            return;
        }
    
        original = pOldFuncAdr;
    
        for (i = 0; i < 5; i++)
        {
            original[i] = pOldFuncAdr[i];
        }
    
        pOldFuncAdr[0] = (BYTE)0xE9;
        for (i = 0; i < 5; i++)
        {
            pOldFuncAdr[i + 1] = pJmpAdr[i];
        }
    
        if (!VirtualProtect(pOldFuncAdr, 5, oldProtect, &oldProtect))
        {
            return;
        }
    }
    
    void UnHookLdrLoadDll()
    {
        LPBYTE pOldFuncAdr = 0;
        DWORD i = 0;
        DWORD oldProtect;
    
        pOldFuncAdr = (LPBYTE)oldFuncAdr;
        VirtualProtect(pOldFuncAdr,
            5,
            PAGE_EXECUTE_READWRITE,
            &oldProtect);
    
        for (i = 0; i < 5; i++)
        {
            pOldFuncAdr[i] = original[i];
        }
        VirtualProtect(pOldFuncAdr,
            5,
            oldProtect,
            &oldProtect);
    }
    Last edited by FL4SHC0D3R; February 3rd, 2019 at 08:20 AM.

  2. #2
    Arjay's Avatar
    Arjay is offline Moderator / MS MVP Power Poster
    Join Date
    Aug 2004
    Posts
    12,920

    Re: How call original function after unhook it?

    What line is the error? What is the error?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  


Windows Mobile Development Center


Click Here to Expand Forum to Full Width




On-Demand Webinars (sponsored)