c++ - 绕过DLL中的DrawString不起作用

我正在尝试绕道行驶。

首先，我有一个ForHook.cpp，它使用gdiplus DrawString打印“ Hello”。

VOID OnPaint(HDC hdc)
{
    Graphics graphics(hdc);
    FontFamily  fontFamily(L"Times New Roman");
    Font        font(&fontFamily, 24, FontStyleRegular, UnitPixel);
    PointF      pointF(30.0f, 10.0f);
    SolidBrush  solidBrush(Color(255, 0, 0, 255));
    graphics.DrawString(L"Hello", -1, &font, pointF, &solidBrush);
}

我在ForHook.cpp中编写了绕行代码，它拦截了DrawString命令，将“ Haha”写入窗口而不是“ Hello”。而且有效。
用于替换gdiplus DrawString的代码：

class CDetour {
public:
    static Gdiplus::Status(CDetour::*pDrawString)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b);
    Gdiplus::Status MyDrawString(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b);
};
Gdiplus::Status CDetour::MyDrawString(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b)
{
    WCHAR* a = L"Haha!";
    return (this->*pDrawString)(a, len, f, org, b);
}

Gdiplus::Status(CDetour::* CDetour::pDrawString)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b) = (Gdiplus::Status(CDetour::*)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b))&Graphics::DrawString;

绕行代码：

Gdiplus::Status(CDetour::* pMyDrawString)(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b) = &CDetour::MyDrawString;
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
DetourTransactionCommit();

然后，我将它们移动到dll，并在ForHook.cpp中加载dll。
在我以前绕行代码的地方：

LoadLibrary(TEXT("Mydll.dll"));

绕行代码放在DllMain下：

case DLL_PROCESS_ATTACH:
    //detours
    MessageBox(0, L"Process Attach", L"Info", MB_OK);
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
    if (DetourTransactionCommit() == NO_ERROR)
    {

        //WCHAR buffer[15];
        //_ultow_s(GetCurrentThreadId(), buffer, 15, 10);
        MessageBox(0, L"Dll successfully injected.", L"Info", MB_OK);
        //MessageBox(0, buffer, L"Info", MB_OK);
    }
    break;

当dll分离时，我使用detourdetach：

case DLL_PROCESS_DETACH:
    MessageBox(0, L"Process Detach", L"Info", MB_OK);
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourDetach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
    DetourTransactionCommit();
    break;

由于在ForHook.cpp中不会调用绕行API，因此我也删除了#include <detours.h>和#pragma comment(lib, "detours.lib)。

棘手的是，该dll已附加，我通过使用Listdlls.exe进行了验证。该dll在ForHook.exe进程ID下。但是程序仍然打印“ Hello”而不是“ Haha”。

为什么不起作用？我该如何改变呢？

dllmain.cpp：

// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
#include <detours.h>
#include <gdiplus.h>
#include <windows.h>
#include <objidl.h>

using namespace Gdiplus;
#pragma comment (lib,"Gdiplus.lib")
#pragma comment(lib,"detours.lib")

//class __declspec(dllexport) CDetour
class CDetour
{

public:
    static Gdiplus::Status(CDetour::*pDrawString)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b);
    Gdiplus::Status  MyDrawString(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b);

};

Gdiplus::Status CDetour::MyDrawString(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b)
{
    WCHAR* a = L"Haha!";
    return (this->*pDrawString)(a, len, f, org, b);
}

DWORD GetMainThreadId(DWORD dwPid)
{
    LPVOID lpTid;

    _asm
    {
        mov eax, fs:[18h]
            add eax, 36
            mov[lpTid], eax
    }

    HANDLE hProcess = OpenProcess(PROCESS_VM_READ, FALSE, dwPid);
    if (hProcess == NULL)
        return NULL;

    DWORD dwTid;
    if (ReadProcessMemory(hProcess, lpTid, &dwTid, sizeof(dwTid), NULL) == FALSE)
    {
        CloseHandle(hProcess);
        return NULL;
    }

    CloseHandle(hProcess);

    return dwTid;
}

Gdiplus::Status(CDetour::* CDetour::pDrawString)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b) = (Gdiplus::Status(CDetour::*)(const WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b))&Graphics::DrawString;


BOOL APIENTRY DllMain( HMODULE hModule,
                   DWORD  ul_reason_for_call,
                   LPVOID lpReserved
                 )
{
    //MessageBox(0, TEXT("Why?"), TEXT("Info"), MB_OK);

    Gdiplus::Status(CDetour:: *pMyDrawString)(WCHAR* s, INT len, const Gdiplus::Font *f, const Gdiplus::PointF& org, const Gdiplus::Brush* b) = &CDetour::MyDrawString;
    //WCHAR buf[15];
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        //MessageBox(0, L"Process Attach", L"Info", MB_OK);
        //_ultow_s(GetMainThreadId(GetCurrentProcessId()), buf, 15, 10);
        //MessageBox(0, buf, L"Info", MB_OK);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
        if (DetourTransactionCommit() == NO_ERROR)
        {

            WCHAR buffer[15];
            _ultow_s(GetCurrentThreadId(), buffer, 15, 10);
            //MessageBox(0, L"Dll successfully injected.", L"Info", MB_OK);
            MessageBox(0, buffer, L"Info", MB_OK);
        }
        break;
    case DLL_THREAD_ATTACH:
        //detours
        //MessageBox(0, L"Thread Attach", L"Info", MB_OK);
        //_ultow_s(GetMainThreadId(GetCurrentProcessId()), buf, 15, 10);
        //MessageBox(0, buf, L"Info", MB_OK);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
        if (DetourTransactionCommit() == NO_ERROR)
        {

            WCHAR buffer[15];
            _ultow_s(GetCurrentThreadId(), buffer, 15, 10);
            //MessageBox(0, L"Dll successfully injected.", L"Info", MB_OK);
            MessageBox(0, buffer, L"Info", MB_OK);
        }
        break;
    case DLL_THREAD_DETACH:
        //MessageBox(0, L"Thread Detach", L"Info", MB_OK);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
        DetourTransactionCommit();
        break;
    case DLL_PROCESS_DETACH:
        //MessageBox(0, L"Proccess Detach", L"Info", MB_OK);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)(CDetour::pDrawString), *(PBYTE*)&pMyDrawString);
        DetourTransactionCommit();
        break;
    }

    return TRUE;
}

最佳答案

首先，您要尝试避免在DllMain（）中执行任何操作。其次，您可能实际上想在DLL_THREAD_ATTACH中调用它时，在PROCESS Attach中进行设置。如果在代码中放置了某种视觉标记，您会发现Windows在加载DLL时会做一些奇怪的事情。您将看到一个ProcessAttach，（好吧，好的...），然后您将看到一个ThreadAttach（）...好...但是，您将看到一个ThreadDetatch（），当您的应用程序关闭时，您会看到会获得PROCESS_DETATCH，但不会获得THREAD_DETATCH ...

您在PROCESS_ATTACH中设置的线程信息很可能不是实际在执行工作的线程...将代码移至THREAD_ATTACH，这可能会起作用。就DLL而言，代码很可能使用TLS，这是另一种可怕的技术。