From 738f2f72cedf66f99a7543dfd51c337c0b83eee4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E1=9E=90=E0=B2=98=E0=AA=85=E0=B4=9E=EF=AD=84=20=E1=B9=9B?= =?UTF-8?q?=E0=BD=A5=E0=AA=9A?= <42241901+arsium@users.noreply.github.com> Date: Sun, 28 Nov 2021 01:03:13 +0100 Subject: [PATCH] First * added kernel32 routines --- HookLib.cs | 44 +++++++++++++++ HookLib.csproj | 50 ++++++++++++++++++ NativeAPI.cs | 22 ++++++++ Properties/AssemblyInfo.cs | 36 +++++++++++++ ...gnTimeResolveAssemblyReferencesInput.cache | Bin 0 -> 6646 bytes .../HookLib.csproj.AssemblyReference.cache | Bin 0 -> 6 bytes .../HookLib.csproj.CoreCompileInputs.cache | 1 + .../HookLib.csproj.FileListAbsolute.txt | 6 +++ obj/Release/HookLib.dll | Bin 0 -> 6144 bytes obj/Release/HookLib.pdb | Bin 0 -> 24064 bytes 10 files changed, 159 insertions(+) create mode 100644 HookLib.cs create mode 100644 HookLib.csproj create mode 100644 NativeAPI.cs create mode 100644 Properties/AssemblyInfo.cs create mode 100644 obj/Release/DesignTimeResolveAssemblyReferencesInput.cache create mode 100644 obj/Release/HookLib.csproj.AssemblyReference.cache create mode 100644 obj/Release/HookLib.csproj.CoreCompileInputs.cache create mode 100644 obj/Release/HookLib.csproj.FileListAbsolute.txt create mode 100644 obj/Release/HookLib.dll create mode 100644 obj/Release/HookLib.pdb diff --git a/HookLib.cs b/HookLib.cs new file mode 100644 index 0000000..4834e70 --- /dev/null +++ b/HookLib.cs @@ -0,0 +1,44 @@ +using System; + +namespace HookLib +{ + public class HookLib + { + private string LibToHook { get; set; } + private string FunctionToHook { get; set; } + public byte[] NewBytes { get; set; } + private uint SizeOfNewBytes { get; set; } + public bool IsHooked { get; set; } + public byte[] OldBytes { get; set; } + private IntPtr ProcessToHook { get; set; } + + public HookLib(IntPtr ProcessToPatch, string LibName, string FunctionName, byte[] BytesToHook, uint SizeOfBytesToHook) + { + OldBytes = new byte[SizeOfBytesToHook]; //first we need a buffer to restore old function bytes to unhook it + ProcessToHook = ProcessToPatch; + LibToHook = LibName;//the lib ex kernel32 or ntdll + FunctionToHook = FunctionName;//name of the function you want to hook + NewBytes = BytesToHook;//bytes you want to use as replacement of our function address + SizeOfNewBytes = SizeOfBytesToHook;//the size of hooked bytes + } + + public bool HookedFunction() + { + IntPtr AddressOfLib = NativeAPI.GetModuleHandle(LibToHook);//getting lib address in our program + IntPtr FunctionAddress = NativeAPI.GetProcAddress(AddressOfLib, FunctionToHook);//getting function address in our program + NativeAPI.ReadProcessMemory(ProcessToHook, FunctionAddress, OldBytes, SizeOfNewBytes, 0);//read the original bytes from our function address and store them if you want to restore + return IsHooked = NativeAPI.WriteProcessMemory(ProcessToHook, FunctionAddress, NewBytes, SizeOfNewBytes, 0);// here we hooked the function : the address of our function is replace by our code (asm or opcode !) + } + + public bool UnHookedFunction() + { + IntPtr AddressOfLib = NativeAPI.GetModuleHandle(LibToHook);//getting lib address in our program + IntPtr FunctionAddress = NativeAPI.GetProcAddress(AddressOfLib, FunctionToHook);//getting function address in our program + if (NativeAPI.WriteProcessMemory(ProcessToHook, FunctionAddress, OldBytes, SizeOfNewBytes, 0))//here we unhook the function by setting the original bytes from our buffer + IsHooked = false; + else + IsHooked = true; + return IsHooked; + } + } +} diff --git a/HookLib.csproj b/HookLib.csproj new file mode 100644 index 0000000..f382eaa --- /dev/null +++ b/HookLib.csproj @@ -0,0 +1,50 @@ + + + + + Debug + AnyCPU + {89130CAD-DC21-46A6-930F-8898E61F3E0E} + Library + Properties + HookLib + HookLib + v4.5 + 512 + true + + + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + true + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/NativeAPI.cs b/NativeAPI.cs new file mode 100644 index 0000000..4945bd4 --- /dev/null +++ b/NativeAPI.cs @@ -0,0 +1,22 @@ +using System; +using System.Runtime.InteropServices; + +namespace HookLib +{ + internal class NativeAPI + { + private const String KERNEL32 = "kernel32.dll"; + + [DllImport(KERNEL32, SetLastError = true)] + internal static extern IntPtr GetModuleHandle(string lib); + + [DllImport(KERNEL32, SetLastError = true)] + internal static extern IntPtr GetProcAddress(IntPtr Module, string Function); + + [DllImport(KERNEL32, SetLastError = true)] + internal static extern bool WriteProcessMemory(IntPtr ProcessHandle, IntPtr Address, byte[] CodeToInject, uint Size, int NumberOfBytes); + + [DllImport(KERNEL32, SetLastError = true)] + internal static extern bool ReadProcessMemory(IntPtr ProcHandle, IntPtr BaseAddress, byte[] Buffer, uint size, int NumOfBytes); + } +} diff --git a/Properties/AssemblyInfo.cs b/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..8be830d --- /dev/null +++ b/Properties/AssemblyInfo.cs @@ -0,0 +1,36 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// Les informations générales relatives à un assembly dépendent de +// l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations +// associées à un assembly. +[assembly: AssemblyTitle("HookLib")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("HookLib")] +[assembly: AssemblyCopyright("Copyright © 2021")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// L'affectation de la valeur false à ComVisible rend les types invisibles dans cet assembly +// aux composants COM. Si vous devez accéder à un type dans cet assembly à partir de +// COM, affectez la valeur true à l'attribut ComVisible sur ce type. +[assembly: ComVisible(false)] + +// Le GUID suivant est pour l'ID de la typelib si ce projet est exposé à COM +[assembly: Guid("89130cad-dc21-46a6-930f-8898e61f3e0e")] + +// Les informations de version pour un assembly se composent des quatre valeurs suivantes : +// +// Version principale +// Version secondaire +// Numéro de build +// Révision +// +// Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de build et de révision par défaut +// en utilisant '*', comme indiqué ci-dessous : +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache b/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache new file mode 100644 index 0000000000000000000000000000000000000000..06b280195d3e7d674d4dd30491bf0fae7337f6ad GIT binary patch literal 6646 zcmeHMQBNC35VpZwFoYD-ln`iAr;XYqbxwAH0Fih|Y#dMtLbgRKVT-Kq#%9Cat-HGi zxQO4b7AI%>k4nHu#rjcfmB?0>$w#(OMjVk-gmSwVci2?OXg(KyMEo_*00d6 zh$HaU>)FM|a$}{D%h}6Ww#dc^a`iJvZ+-6Agtz5skfQaQWUUrRv&7_<*YdS`h=U(8 z#}OxBzflU@y3^h`)!>m=Y6^Sjh1cNCB6nccVxG-yrlHr9v}&Q@J5EtD7fysc>NQnZ z9oz1I(pD6Xjq`m>$_kTB(BZJMUss@a(1?1DRrYMZx@|+s*1{x-46gf0Z&_O*oYjNVi$x##&$pqbwkw7{SOWr|&U*jZ_Bqm5q zqL?u5qKp|+DBhlxy3FZy8Hw}>lTZ!GZq?k`sDvCcbG&3OXL0&M-ixba{+8wdiI@5Z@t0BRYs3(B`Jro$N~^7K;w+ch?D4=Sj3v zBA9LN{Xtj>Iwyxu_uY2ot{OW~{7)D^IPMg*u;rgbc&=W3zaPH5 zQz`GWb%rSNe$b0Q;8&Ub+W2_#dpz}eSBh976*r9^P?RG$-cv+D1B9n|lPF?YGEQ_f z;HVc}i4#A)qD>KDr7K0GmAo~6L@{@kzqU?#Zv2F;GiRIJ(^MIwlGzq+opa+E>gUfY z*B1fX=f-nv9|RA6fp(_OO6-KFAQcJEjh|8V@{82C&b^Qtr-<&{yjXgzVy$B;fWO%g=>@l0fI!GE&u=k literal 0 HcmV?d00001 diff --git a/obj/Release/HookLib.csproj.AssemblyReference.cache b/obj/Release/HookLib.csproj.AssemblyReference.cache new file mode 100644 index 0000000000000000000000000000000000000000..204fdef644eaa2e6de09b015f5f4588ab58aa14d GIT binary patch literal 6 LcmZQ$WB>vH051Rt literal 0 HcmV?d00001 diff --git a/obj/Release/HookLib.csproj.CoreCompileInputs.cache b/obj/Release/HookLib.csproj.CoreCompileInputs.cache new file mode 100644 index 0000000..4e4934a --- /dev/null +++ b/obj/Release/HookLib.csproj.CoreCompileInputs.cache @@ -0,0 +1 @@ +976ca941126dfbcd99394a0fc6031ee54a4edf42 diff --git a/obj/Release/HookLib.csproj.FileListAbsolute.txt b/obj/Release/HookLib.csproj.FileListAbsolute.txt new file mode 100644 index 0000000..2aaf5fe --- /dev/null +++ b/obj/Release/HookLib.csproj.FileListAbsolute.txt @@ -0,0 +1,6 @@ +F:\Personal\HookFunction\HookLib\bin\Release\HookLib.dll +F:\Personal\HookFunction\HookLib\bin\Release\HookLib.pdb +F:\Personal\HookFunction\HookLib\obj\Release\HookLib.csproj.AssemblyReference.cache +F:\Personal\HookFunction\HookLib\obj\Release\HookLib.csproj.CoreCompileInputs.cache +F:\Personal\HookFunction\HookLib\obj\Release\HookLib.dll +F:\Personal\HookFunction\HookLib\obj\Release\HookLib.pdb diff --git a/obj/Release/HookLib.dll b/obj/Release/HookLib.dll new file mode 100644 index 0000000000000000000000000000000000000000..7988b7b65e1f5e3915bc9465ed93f911ba4465c4 GIT binary patch literal 6144 zcmeHLTWlOx8UE+8<6E-1r*12^<2ZqBQZMTZRnmsm_t=eNJF(-mG$NVZJzh^dyR)5{ zP2;qU9JLgpsA>f~v{H*g)dm#=j&G9y|D4b6fglnA{HaRFG*WP4 zs40YJq&5H=)zoS<5H+y^V;Y-Nn}DBCt15&FgHW{*^tPr{BbvJH8!`zRfq#VYq5MlH zw>GGo+0BkR^*SchR0HJOZwhBDDt$>^8!GxSjTDjG_EIj#m94BqPibLm(B0~4-JlDMrH8Vy8P5O>I?b3QlWs+Qkj^TtjA?43Z&Mn(?*i~fdI#7>zXR@|zW}=!?_lg_`Cj@v zCXZ0qVvFgEO}V_23u?Bp<;z(O@P*c^4U}e z+5oDk4WR3RDrytxMxcti8uTilin<1L5_neYQMS>Iih`Z;NqR|_?Je{^w>#)vwEBWv z|Ju?51{o z!I2SPibbCMT4r}FzH{!#kv=OohYNYg7EYda!^4y-`>a$ARZ6+Qc1zdNPk3%l`2Mxj z<4(SBJ`ny&$7AAwYiK6zlVW`4ntD0nuvN-Cg7%0YOi9E?!9-lBB1~?~Dhi5c!c4zg zEZdIo_K1@3tU%;@13aO!l>kmFb`3WmvXw%?$~t1v0-dLA-(Di?^?gyyI`dO@P-|Kh zdsbc)EpKko%ar9|v4-&ODjsla6>*;-1UM}`AK72*6)XGQ(u`fGAoi=O2ZW#V?DA4& zIBD*2KseS3ru>z@k;Z%_7pzqDyXAS$F3et4RV-Vj`Ncj5Dy6_K3OOdm$=Z$`)M(|> z({anG2$IW9zJ$qnKM=)q)H5B;9ov+uyKKS=a`!Dl;>}qjWBC zz1V)hwhATJ5A2*Di{c!Nlmg+o^DZ}Q6xtvsd1bIGHW~@>i zpW*ov$gJ>UPIigU9(SoSQnU1IvVNIpj|gPadh>Y?_X71@lQ;`VrccJ5pli zfUxpWlJ|+C>&??4&kn>=5#NPB+w#;4!&~mz`-R5$T5o^jCl8TsDoVX(l9B+iZk=S4 z5>&lTZC159rMdpX$-~pvcV9l!JV$~&Dghll%sTPt%7b!9HIkaql2DBX)lgNV8SdbN zS`yM{O9E_zblCtxMQxT$bAy>snv=SM zZ@y@note%KqFWT&x^q`YS0-oW+w-~3j`r@`tlQdmb!BGSckbM^Q{2`u(IAws@w6<@8&f z|B{rP!hY0^_}<$nU&?FBGL{ZZ4ovp0dEy^U#Z&uUANWI|>C`LT(%;bShbM6Rxh2av zEE5qQA!d-3!*2H2VccT^J1mx^%lRxl9(`oWF~2TpQ&KBS{4pA8j`X|UfaC15>{9qN z6@rg;)bGkRxLF?hN}nG~K12rO*AKq`i58Z2k|%^Ha}~L?lm8vu(}TT?cjmaP(z-!T z<9+l9a1h@_llTT6r!nv&z@hM87kW+q>%YTyFFArNVS87|@H<#|{2~FG0k)bZ3m3=` z-mD#5A|tp;X2@lut=wx0S_@JidW!Ob1u+G%vLP>A#nUj`WH9gW*NyK# z=JDq-TZ`=?6a0@<534xx0eJ8!$8nUG#5s%+T)e-J zBEl>>XO{GvMn4Zd7w6T1OEgoh^8cz;7)NF%VA~SnaB8Ai>Oa1K<$B6*-BI)@a1S}t zGR<>@1)7C7;@K~ine-wKq=~CMgNjQK-(NCMi+;it$-{3Eem%@A&Kgk<$2uO3Ay-7k z8s|uIGSf1)+MF!L9Oh;M{arjrD#&M0Gt=e$h`KqKOYN6ubY(u}y7eMzpXZQ8g!7p3 bf9r>^Kf1*X|1*5`&W~=0A4m58%fNpCp@+yk literal 0 HcmV?d00001 diff --git a/obj/Release/HookLib.pdb b/obj/Release/HookLib.pdb new file mode 100644 index 0000000000000000000000000000000000000000..ad2421a7d54c4b057077d908c6366f17e8aca0ca GIT binary patch literal 24064 zcmeHOdvH`&89y5!5GarEDpIO}21+2=Y#xw+D1?Magg|&XV;e>`$z8H0*=4fJbDX-) zP|7G(oN=aFQ4tZ*cC-rPq!lPmJ8jeP54AJ3Gp#dNI}UWFyrh+>6#V_ppx^=YID*Zt8>0o#9A05Y4MDuAVzLuYO%^UWM1^8$EJr%{qaQC4>i2 zF{q1qghCa$zk|U7KRNxe=gbW^+@lt##2mhUkM`Z|_Kh1?o7OCTW%wJp``3xntACdD z)0da6_`$h<{WW+0VwE5Dqdkx02Hwa$IY)@ABkE3${d2+IuG|SrpZM1HF^@m>?BqP{ z0}uad?bD@|AKuvYYSoXkp0-Y%DmeDvl~>>FK3wsOv*+s1|9&vI%E8!&OpX8WJ(J!N zHK$)1S=RM@$D>O=9#Z+zlUELIn4e#D`FHgThKwDIwi^t6%GCIud@*$FH|K_hzEEFy z=v4PN_q5;Nb);q3UuqY3pY1wYdZckM*lIBLVbtp-9gK!*|<_Pc{A%-~pV^|7|OA1>Ch3NHzWw-SNL`$1Bqf%hdYMUH@l#WbTZ- zOpU+0{=YNhm1!-R8viR3XMOSQ>WW>L%bwctw|A%g`_k?s&mTPhpO+(>n+u;Ab)h`d z?RMp5#sb$bT))8ko%i`uyRfmr>WqX#{`SV@;c#2+)=+aa7!JwI%3za;z0DCJ0t*|r z80J= z?euq8+ryo0g{ z?$^@&3DWztOG9TEMvexpNTX?AT__OlSIf4{nN~Ps|1pSEdo1L9>yj?2XsPR{;<3|JrL z;((uqWZT#s8Z*Ly#it|LlqIK8q$hTv*4w2qPQ5sJ&gP|R(Wi)iK4ZSYq$-l-e? z%ARcS)SUuv`dzN)xl{iz;6H8f)W6EwzH}!R1t@d&dyB?8b;DrUGYyuyldz`U&!y0d zHe}PE+5KJ@+-0o}*bP~|_oI>v?U{@F{?Y+9aC6&F;q|kdGuxkyLdXuom-g)XeBcZ>e zfu-NG`->G>x5yzqdIW?i6CO z7?Rrp-YyV%P5nrbpSxk*&PdeikYiCQh7Rps{QfJ)zWiq0iJ3WBe|YBjCd#cBHKG(T z-|Kw7d9_2cQHOI353mwpy^7>7c(V^7CEKG$-aI+7U02YiR^W&+d^1Fz^dG?33rhp4 zYH8_&Ii+52f7%Nn7*9dFIOqCGJdg}^Dw4lYmi-Y@vaK6JNv&0OJczbV0hTz!YuXE& zWW2qXp(kIqj_vZ;bB%4}JC*^@TPz=|6T{2rkGy7HCG!?w)na&+PfRTr_?VMd`M=b1 z$?L@|F>;l!OD#7Cyfefsn^*a^)N;xDu$XJ}DqogbF8oCTuku@|<&w8h_-wh#N2Qhv zUlPm1D44!g_hMi2&J+bUukt~u?togYq${<-!NWX5*_$(_Visa>-jH zN+d7exk1fqd_d$C601afKjIwm zbun6$g9<^@L32U*ARl&pBc=Z3;8i}rWBU-g6tj+a0CHeoF%2_JIzAUIU#0T?26+;{z=RwS#tpj)G2u z-T_?!je~=k4XOb(f_8xRgPsGu209B8@TU_&g`kxn`u*LYI~91>KQ*WL(m1qtAKJ49 zijfq{kY@a(&hOOudbEw@9vx#$WjF<9}$r zPjr0F$k+9CI{vw?SI>bEztrWH*86vzFVOgnIxf=n^E4i8vc289{<}K%a6}||`CH1DF*Sh4s#ge#_>yxT) zDVyAlUWD-Rx5H4eM5f2dnP3;o1pK*tf9E5nucVJ#4&pj!6NtWx{&+WNKj;AHDCjuo zH0V#Dw?OZKE`sPoMqu#hNAf_0ph{2;r~%XnY6V3>G0;BH|07HlGvykH1Mf-N;7t|< zjym6b9|Ih?!7Py&E_&meLW5Ct8UrUiL+kmPt;eho%}Sf^AEi(6XeO%yRGr2&b8V>n(R;R@#0|B{4B+yi?=kL{-Ye5-neE5Xac^ywg+tVi_Rs2Y8$ zUgO|r??m7;zCEYJ1NQ-6Fzws9VnTF0T6qTfGbk)%IV*MGp7K*Neg3pA!q-A7MOjRl zyeb_l8iuLV328T#HovqY-X2~Zi_(g!+EQOdwW&9V zt_e49?XW`8$ehyBva<5Brj{aq<-7$&6QMkRuJK(x%pp?;;C)&#Qbt$IuL#iC3Vocx5ou#!n7J@%s8|e{-uPibME* zA|i?-oz2CqmcPa7Y-$fTx2b|au-%Fj2X5lq5Gkjhu!IjkZU%T;UuoQoqAl@9EBT`f zx=>sfzs0qZQG8WS<^5`B%eKPRviQ`XPcyURkT=868hDf}#ri>zQ zEl^<|=v9c|*53O~rk%tk?L60z+2IYK;(7cbWd2N3fe%y${o`8Sz5i2-a=JkG{?9RAVkwV(91MLY z^)ZUg7_(CXijqfs4?)t{>Q=jKt5y-@C+|EvE2 z9qi}-^k11e|L1w~91zd{XMuP}PylkC|38HM3=r=M_}v*VIHrTro&V>fj(6S