Skip to content

Commit ba63550

Browse files
karol-gruszczykkarol-gruszczyk
committed
Added simple messagebox hooking
1 parent b4caf01 commit ba63550

File tree

9 files changed

+170
-99
lines changed

9 files changed

+170
-99
lines changed

‎Makefile

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,38 @@
1-
# the compiler: gcc for C, g++ for C++
2-
CC=cl.exe
3-
LINK=link.exe
1+
cc = g++
42

5-
# compiler flags:
6-
# -g adds debugging information to the executable file
7-
# -Wall turns on most, but not all, compiler warnings
3+
lflags = -Wall --std=c++11
4+
cflags = $(lflags) -c
85

9-
CFLAGS=-g -Wall --std=c++11
6+
ifeq ($(debug), true)
7+
cdebug = -g
8+
endif
109

11-
TARGET=rootkit.exe
12-
TEST_TARGET=test.exe
1310

1411

15-
all: main.o
16-
$(CC) main.o -o $(TARGET)
12+
all: rootkit test
13+
14+
15+
16+
rootkit_target = rootkit.exe
17+
rootkit_cppsources = src/main.cpp src/hook.cpp
18+
rootkit_cppobjects = $(rootkit_cppsources:.cpp=.o)
19+
20+
rootkit: $(rootkit_cppobjects)
21+
$(cc) $(cdebug) $(lflags) $(rootkit_cppobjects) -o $(rootkit_target)
1722

1823
main.o: main.cpp
19-
$(CC) $(CFLAGS) -c main.cpp
24+
$(cc) $(cdebug) $(cflags) main.cpp
25+
26+
hook.o: hook.cpp hook.h
27+
$(cc) $(cdebug) $(cflags) hook.cpp
28+
29+
2030

31+
test_target=test.exe
2132

2233
test:
23-
$(CC) $(CFLAGS) test.cpp -o $(TEST_TARGET)
34+
$(cc) $(cdebug) $(cflags) src/test.cpp -o $(test_target)
2435

2536

2637
clean:
27-
$(RM) *.o
38+
$(RM) src/*.o

‎main.cpp

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎src/hook.cpp

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#include "hook.h"
2+
3+
Hook* Hook::instance;
4+
5+
Hook* Hook::get_instance()
6+
{
7+
if (!instance)
8+
instance = new Hook();
9+
return instance;
10+
}
11+
12+
void Hook::install_hook(DWORD at_address, DWORD to_address)
13+
{
14+
update_jmp_address(to_address);
15+
16+
DWORD old_protect;
17+
VirtualProtect((LPVOID)at_address, 1024, PAGE_EXECUTE_READWRITE, &old_protect);
18+
memcpy((void*)at_address, x86_code, X86_CODE_LEN);
19+
VirtualProtect((LPVOID)at_address, 1024, old_protect, nullptr);
20+
}
21+
22+
Hook::Hook()
23+
{
24+
// mov <address>
25+
x86_code[0] = 0xb8;
26+
27+
// jmp eax
28+
x86_code[5] = 0xff;
29+
x86_code[6] = 0xe0;
30+
}
31+
32+
Hook::~Hook()
33+
{
34+
if (instance)
35+
delete instance;
36+
}
37+
38+
void Hook::update_jmp_address(DWORD address)
39+
{
40+
x86_code[1] = address & 0xFF;
41+
x86_code[2] = (address >> 8) & 0xFF;
42+
x86_code[3] = (address >> 16) & 0xFF;
43+
x86_code[4] = (address >> 24) & 0xFF;
44+
}

‎src/hook.h

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#pragma once
2+
#include <windows.h>
3+
#define X86_CODE_LEN 7
4+
5+
6+
class Hook
7+
{
8+
public:
9+
static Hook* get_instance();
10+
11+
void install_hook(DWORD at_address, DWORD to_address);
12+
private:
13+
Hook();
14+
~Hook();
15+
16+
static Hook* instance;
17+
BYTE x86_code[X86_CODE_LEN];
18+
19+
void update_jmp_address(DWORD address);
20+
};

‎src/main.cpp

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#include <windows.h>
2+
#include <memory>
3+
#include <iostream>
4+
5+
#include "hook.h"
6+
7+
8+
typedef int (WINAPI *MessageBoxAPtr)(HWND, LPCSTR, LPCSTR, UINT);
9+
10+
int WINAPI OverloadedMessageBoxA(HWND hwnd, LPCSTR text, LPCSTR title, UINT type)
11+
{
12+
std::cout << "test test" << std::endl;
13+
return 0;
14+
}
15+
16+
void test()
17+
{
18+
MessageBoxA(nullptr, "test", "test", 0);
19+
}
20+
21+
int main()
22+
{
23+
test();
24+
DWORD oldFuncPtr = reinterpret_cast<DWORD>(MessageBoxA);
25+
DWORD newFuncPtr = reinterpret_cast<DWORD>(OverloadedMessageBoxA);
26+
Hook::get_instance()->install_hook(oldFuncPtr, newFuncPtr);
27+
test();
28+
system("pause");
29+
return 0;
30+
}

‎test.cpp renamed to ‎src/test.cpp

File renamed without changes.

‎win-rootkit.sln renamed to ‎vs-project/win-rootkit.sln

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11

22
Microsoft Visual Studio Solution File, Format Version 12.00
33
# Visual Studio 2013
4-
VisualStudioVersion = 12.0.21005.1
4+
VisualStudioVersion = 12.0.30501.0
55
MinimumVisualStudioVersion = 10.0.40219.1
6-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "win-rootkit", "win-rootkit.vcxproj", "{47EF6749-75DF-4059-B685-3F4CB34A44C3}"
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "win-rootkit", "win-rootkit.vcxproj", "{3F18A64E-4274-44FA-AE16-3111056E14E2}"
77
EndProject
88
Global
99
GlobalSection(SolutionConfigurationPlatforms) = preSolution
1010
Debug|Win32 = Debug|Win32
1111
Release|Win32 = Release|Win32
1212
EndGlobalSection
1313
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14-
{47EF6749-75DF-4059-B685-3F4CB34A44C3}.Debug|Win32.ActiveCfg = Debug|Win32
15-
{47EF6749-75DF-4059-B685-3F4CB34A44C3}.Debug|Win32.Build.0 = Debug|Win32
16-
{47EF6749-75DF-4059-B685-3F4CB34A44C3}.Release|Win32.ActiveCfg = Release|Win32
17-
{47EF6749-75DF-4059-B685-3F4CB34A44C3}.Release|Win32.Build.0 = Release|Win32
14+
{3F18A64E-4274-44FA-AE16-3111056E14E2}.Debug|Win32.ActiveCfg = Debug|Win32
15+
{3F18A64E-4274-44FA-AE16-3111056E14E2}.Debug|Win32.Build.0 = Debug|Win32
16+
{3F18A64E-4274-44FA-AE16-3111056E14E2}.Release|Win32.ActiveCfg = Release|Win32
17+
{3F18A64E-4274-44FA-AE16-3111056E14E2}.Release|Win32.Build.0 = Release|Win32
1818
EndGlobalSection
1919
GlobalSection(SolutionProperties) = preSolution
2020
HideSolutionNode = FALSE

‎win-rootkit.vcxproj renamed to ‎vs-project/win-rootkit.vcxproj

Lines changed: 38 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -10,20 +10,30 @@
1010
<Platform>Win32</Platform>
1111
</ProjectConfiguration>
1212
</ItemGroup>
13+
<ItemGroup>
14+
<ClInclude Include="..\src\hook.h" />
15+
</ItemGroup>
16+
<ItemGroup>
17+
<ClCompile Include="..\src\hook.cpp" />
18+
<ClCompile Include="..\src\main.cpp" />
19+
</ItemGroup>
1320
<PropertyGroup Label="Globals">
14-
<ProjectGuid>{47EF6749-75DF-4059-B685-3F4CB34A44C3}</ProjectGuid>
15-
<Keyword>MakeFileProj</Keyword>
21+
<ProjectGuid>{3F18A64E-4274-44FA-AE16-3111056E14E2}</ProjectGuid>
22+
<RootNamespace>winrootkit</RootNamespace>
1623
</PropertyGroup>
1724
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
1825
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
19-
<ConfigurationType>Makefile</ConfigurationType>
26+
<ConfigurationType>Application</ConfigurationType>
2027
<UseDebugLibraries>true</UseDebugLibraries>
2128
<PlatformToolset>v120</PlatformToolset>
29+
<CharacterSet>MultiByte</CharacterSet>
2230
</PropertyGroup>
2331
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
24-
<ConfigurationType>Makefile</ConfigurationType>
32+
<ConfigurationType>Application</ConfigurationType>
2533
<UseDebugLibraries>false</UseDebugLibraries>
2634
<PlatformToolset>v120</PlatformToolset>
35+
<WholeProgramOptimization>true</WholeProgramOptimization>
36+
<CharacterSet>MultiByte</CharacterSet>
2737
</PropertyGroup>
2838
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
2939
<ImportGroup Label="ExtensionSettings">
@@ -35,25 +45,31 @@
3545
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
3646
</ImportGroup>
3747
<PropertyGroup Label="UserMacros" />
38-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
39-
<NMakeBuildCommandLine>make</NMakeBuildCommandLine>
40-
<NMakeOutput>rootkit.exe</NMakeOutput>
41-
<NMakePreprocessorDefinitions>WIN32;_DEBUG;$(NMakePreprocessorDefinitions)</NMakePreprocessorDefinitions>
42-
</PropertyGroup>
43-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
44-
<NMakeBuildCommandLine>g++</NMakeBuildCommandLine>
45-
<NMakeOutput>win-rootkit.exe</NMakeOutput>
46-
<NMakePreprocessorDefinitions>WIN32;NDEBUG;$(NMakePreprocessorDefinitions)</NMakePreprocessorDefinitions>
47-
</PropertyGroup>
48-
<ItemDefinitionGroup>
48+
<PropertyGroup />
49+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
50+
<ClCompile>
51+
<WarningLevel>Level3</WarningLevel>
52+
<Optimization>Disabled</Optimization>
53+
<SDLCheck>true</SDLCheck>
54+
</ClCompile>
55+
<Link>
56+
<GenerateDebugInformation>true</GenerateDebugInformation>
57+
</Link>
58+
</ItemDefinitionGroup>
59+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
60+
<ClCompile>
61+
<WarningLevel>Level3</WarningLevel>
62+
<Optimization>MaxSpeed</Optimization>
63+
<FunctionLevelLinking>true</FunctionLevelLinking>
64+
<IntrinsicFunctions>true</IntrinsicFunctions>
65+
<SDLCheck>true</SDLCheck>
66+
</ClCompile>
67+
<Link>
68+
<GenerateDebugInformation>true</GenerateDebugInformation>
69+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
70+
<OptimizeReferences>true</OptimizeReferences>
71+
</Link>
4972
</ItemDefinitionGroup>
50-
<ItemGroup>
51-
<None Include=".gitignore" />
52-
<None Include="Makefile" />
53-
</ItemGroup>
54-
<ItemGroup>
55-
<ClCompile Include="main.cpp" />
56-
</ItemGroup>
5773
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
5874
<ImportGroup Label="ExtensionTargets">
5975
</ImportGroup>

‎win-rootkit.vcxproj.filters renamed to ‎vs-project/win-rootkit.vcxproj.filters

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,15 @@
1515
</Filter>
1616
</ItemGroup>
1717
<ItemGroup>
18-
<None Include=".gitignore" />
19-
<None Include="Makefile">
20-
<Filter>Resource Files</Filter>
21-
</None>
18+
<ClInclude Include="..\src\hook.h">
19+
<Filter>Header Files</Filter>
20+
</ClInclude>
2221
</ItemGroup>
2322
<ItemGroup>
24-
<ClCompile Include="main.cpp">
23+
<ClCompile Include="..\src\hook.cpp">
24+
<Filter>Source Files</Filter>
25+
</ClCompile>
26+
<ClCompile Include="..\src\main.cpp">
2527
<Filter>Source Files</Filter>
2628
</ClCompile>
2729
</ItemGroup>

0 commit comments

Comments
 (0)