C / C++ / MFC

// my_getaddrinfo.cpp : Defines the entry point for the DLL application.
//

#include "stdafx.h"
#include "hook.h"
#include <Ws2tcpip.h>
#include <stdio.h>





HINSTANCE g_hMod = NULL;
DWORD dwIsHook = 0;


void __stdcall UnHook();

int nCount = 0;

BOOL WINAPI DllMain(
    HINSTANCE hinstDLL,  // handle to DLL module
    DWORD fdwReason,     // reason for calling function
    LPVOID lpReserved )  // reserved
{
    // Perform actions based on the reason for calling.
    switch( fdwReason ) 
    { 
	case DLL_PROCESS_ATTACH:
		// Initialize once for each new process.
		// Return FALSE to fail DLL load.
		{
			g_hMod = hinstDLL;
			HookOn();		 
		}
		break;
		
	case DLL_THREAD_ATTACH:
		// Do thread-specific initialization.
		break;
		
	case DLL_THREAD_DETACH:
		// Do thread-specific cleanup.
		break;
		
	case DLL_PROCESS_DETACH:
		{
			//UnHook();
		}
		// Perform any necessary cleanup.
		break;
    }
    return TRUE;  // Successful DLL_PROCESS_ATTACH.
}

void __stdcall InstallHook()
{
	if ( g_hMod != NULL )
	{
		hHook = SetWindowsHookEx(WH_DEBUG, DebugProc, g_hMod/*GetModuleHandle(NULL)*/, 0);
	}
	else
	{
		MessageBox(NULL,"InstallHook","InstallHook",MB_OK);
	}
	
}

void __stdcall UnHook()
{
	//MessageBox(NULL,"UnHook","UnHook",MB_OK);
	UnhookWindowsHookEx(hHook);
}



char *g_szGlo_A = "www.csdn.net";
char *g_Change_A = "www.51.com";

char *g_argc_A = "/history.php";




/***********************************************************************/
/*             比较两个字符串是否相等                                  */
/**********************************************************************/
bool isEqual_A(const char * str1,const char * str2)
{

// 	if (strlen(str1)!=strlen(str2)){//长度不相等则不相等
// 		return false;
// 	}

	//对上面判断语句的汇编实现
	__asm
	{
		push [ebp+0x8]	//str1地址入栈
		call strlen		//调用c函数获取长度
		add esp,4		//堆栈平衡[c调用约定"__cdecl"规定由函数的调用者释放堆栈]
		mov ebx,eax		//存放比较结果,为了避免后面再次调用strlen函数引起返回值覆盖[函数的返回值规范约定保存在eax里面]
		push [ebp+0xc]	//str2地址入栈
		call strlen		//调用c函数获取长度[函数的返回值规范约定保存在eax里面]
		add esp,4		//堆栈平衡[c调用约定"__cdecl"规定由函数的调用者释放堆栈]
		cmp eax,ebx		//比较两个字符串的长度
		jne exit2		//不相等则跳转到 exit2
	}

// 	for (;str1<str1+strlen(str1);str1++,str2++)//循环比较每个字符是否相等,如果某个字符不相等那么整个也不相等
// 	{
// 		if (*str1!=*str2){
// 			return false;
// 		}
// 	}

	//对上面for循环的汇编实现
	__asm
	{

		push [ebp+8]			//str1地址入栈
		call strlen				//调用c函数获取长度
		add esp,4				//堆栈平衡[c调用约定"__cdecl"规定由函数的调用者释放堆栈]
		mov esi,[ebp+8]			//取str1地址到esi寄存器
		mov edx,esi				//复制到edx寄存器
		mov edi,[ebp+0xc]		//取str2地址到edi寄存器
		imul eax,type char		//计算指针偏移量[eax中存放的是strlen的返回值,str1是字符指针,对指针做算术运算时参与运算的值是它所指向的类型的长度]
		add edx,eax				//计算循环上限[str1+strlen(str1)]
beginfor:
		cmp esi,edx				//比较[str1<str1+strlen(str1)]
		jnl endfor				//如果不小于那么结束循环[当然也可以用"大于等于"跳转指令]
		mov bl,byte ptr [esi]	//取str1的一个字符到bl寄存器
		mov cl,byte ptr [edi]	//取str2的一个字符到cl寄存器
		cmp bl,cl				//比较两个字符大小
		jne exit2				//不相等则结束
		add esi,type char		//str1指针向前移动
		add edi,type char		//str2指针向前移动
		jmp beginfor			//跳转到beginfor继续循环
endfor:
		
	}

	__asm
	{

exit1:
		mov eax,1				//返回相等[return true]
		jmp exit3				//结束
exit2:
		mov eax,0				//返回不相等[return false]		
exit3:							//程序结束
	}

}


/////////////////////////W WWWWWWWWWWW
/***********************************************************************/
/*             比较两个字符串是否相等                                  */
/**********************************************************************/
bool isEqual_W(const wchar_t * str1,const wchar_t * str2)
{
	
	// 	if (strlen(str1)!=strlen(str2)){//长度不相等则不相等
	// 		return false;
	// 	}
	
	//对上面判断语句的汇编实现
	__asm
	{
		push [ebp+0x8]	//str1地址入栈
		call wcslen		//调用c函数获取长度
		add esp,4		//堆栈平衡[c调用约定"__cdecl"规定由函数的调用者释放堆栈]
		mov ebx,eax		//存放比较结果,为了避免后面再次调用strlen函数引起返回值覆盖[函数的返回值规范约定保存在eax里面]
		push [ebp+0xc]	//str2地址入栈
		call wcslen		//调用c函数获取长度[函数的返回值规范约定保存在eax里面]
		add esp,4		//堆栈平衡[c调用约定"__cdecl"规定由函数的调用者释放堆栈]
		cmp eax,ebx		//比较两个字符串的长度
		jne exit2		//不相等则跳转到 exit2
	}
	
	// 	for (;str1<str1+strlen(str1);str1++,str2++)//循环比较每个字符是否相等,如果某个字符不相等那么整个也不相等
	// 	{
	// 		if (*str1!=*str2){
	// 			return false;
	// 		}
	// 	}
	
	//对上面for循环的汇编实现
	__asm
	{
		
		push [ebp+8]			//str1地址入栈
		call wcslen				//调用c函数获取长度
		add esp,4				//堆栈平衡[c调用约定"__cdecl"规定由函数的调用者释放堆栈]
		mov esi,[ebp+8]			//取str1地址到esi寄存器
		mov edx,esi				//复制到edx寄存器
		mov edi,[ebp+0xc]		//取str2地址到edi寄存器
		imul eax,type wchar_t		//计算指针偏移量[eax中存放的是strlen的返回值,str1是字符指针,对指针做算术运算时参与运算的值是它所指向的类型的长度]
		add edx,eax				//计算循环上限[str1+strlen(str1)]
beginfor:
		cmp esi,edx				//比较[str1<str1+strlen(str1)]
		jnl endfor				//如果不小于那么结束循环[当然也可以用"大于等于"跳转指令]
		mov bl,byte ptr [esi]	//取str1的一个字符到bl寄存器
		mov cl,byte ptr [edi]	//取str2的一个字符到cl寄存器
		cmp bl,cl				//比较两个字符大小
		jne exit2				//不相等则结束
		add esi,type wchar_t		//str1指针向前移动
		add edi,type wchar_t		//str2指针向前移动
		jmp beginfor			//跳转到beginfor继续循环
endfor:
		
	}
	
	__asm
	{
		
exit1:
	mov eax,1				//返回相等[return true]
	jmp exit3				//结束
exit2:
	mov eax,0				//返回不相等[return false]		
exit3:							//程序结束
	}
	
}


__declspec(naked) HINTERNET __stdcall my_InternetConnect_A(
						  HINTERNET hInternet,
						  LPCTSTR lpszServerName,
						  INTERNET_PORT nServerPort,
						  LPCTSTR lpszUsername,
						  LPCTSTR lpszPassword,
						  DWORD dwService,
						  DWORD dwFlags,
						  DWORD_PTR dwContext
						  )
{

	__asm
	{
		pushad
		push g_szGlo_A
		push [esp+44]
		call isEqual_A
		add esp,8
		test eax,eax
		jne equal
		popad
		jmp lpAddr_A
	}

equal:
	__asm
	{
		popad
		push eax
		mov eax,g_Change_A
		mov [esp+12],eax

		add dwIsHook,1

		pop eax
		jmp lpAddr_A
	}

}


__declspec(naked) HINTERNET my_HttpOpenRequest_A(
						  HINTERNET hConnect,
						  LPCTSTR lpszVerb,
						  LPCTSTR lpszObjectName,
						  LPCTSTR lpszVersion,
						  LPCTSTR lpszReferer,
						  LPCTSTR *lpszAcceptTypes,
						  DWORD dwFlags,
						  DWORD_PTR dwContext
						  )
{
	__asm
	{
		pushad
		cmp dwIsHook,1
		je one
		popad
		jmp lpHTTPAddr_A
	}
one:
	_asm
	{
		popad
		push eax
		sub dwIsHook,1
		mov eax,g_argc_A
		mov [esp+16],eax
		pop eax
		jmp lpHTTPAddr_A
	}
}






void HookOn()
{
	char szBuf[MAX_PATH] = {0};

	DWORD dwOldProtect = 0;
	HMODULE hModule = LoadLibrary("wininet.dll");
	char chE9 = (char)0xe9;

	if ( !hModule )
	{
		goto Exit0;
	}


	my_internetconnectA = (GETADDR_InternetConnectA)GetProcAddress(/*GetModuleHandle("ws2_32.dll")*/hModule, "InternetConnectA"); //得到InternetConnectA的地址
	my_HttpOpenRequestA = (GETADDR_HttpOpenRequestA)GetProcAddress(/*GetModuleHandle("ws2_32.dll")*/hModule, "HttpOpenRequestA"); //得到InternetConnectA的地址


	if ( !VirtualProtect(my_internetconnectA, 5, PAGE_EXECUTE_READWRITE, &dwOldProtect) )
	{
		goto Exit0;
	}





	lpAddr_A = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if ( !lpAddr_A )
	{
		goto Exit0;
	}

	

	RtlMoveMemory(lpAddr_A, my_internetconnectA, 5); //把getaddrinfo前个字节保存到申请的内存空间中
	dwJmpMe_A = (DWORD)my_InternetConnect_A -(DWORD)my_internetconnectA - 5;
	dwJmpOther_A = (DWORD)my_internetconnectA - ((DWORD)lpAddr_A+5) - 5;

	//计算自己到对方的距离
	__asm
	{
		pushad
		mov eax,my_internetconnectA
		mov [eax],0xE9
		add eax,1
		mov ebx,dwJmpMe_A
		mov dword ptr[eax],ebx
		popad
	}
	
	//计算自己到对方的距离
	__asm
	{
		pushad
		mov eax,lpAddr_A
		add eax,5
		mov [eax],0xE9
		add eax,1
		mov ebx,dwJmpOther_A
		add ebx,5
		mov dword ptr[eax],ebx
		popad
	}
	VirtualProtect(my_internetconnectA, 5, dwOldProtect, &dwOldProtect);


	
	
	if ( !VirtualProtect(my_HttpOpenRequestA, 5, PAGE_EXECUTE_READWRITE, &dwOldProtect) )
	{
		goto Exit0;
	}
	
	
	
	
	
	lpHTTPAddr_A = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if ( !lpHTTPAddr_A )
	{
		goto Exit0;
	}
	
	
	
	RtlMoveMemory(lpHTTPAddr_A, my_HttpOpenRequestA, 5); //把getaddrinfo前个字节保存到申请的内存空间中
	dwHTTPJmpMe_A = (DWORD)my_HttpOpenRequest_A -(DWORD)my_HttpOpenRequestA - 5;
	dwHTTPJmpOther_A = (DWORD)my_HttpOpenRequestA - ((DWORD)lpHTTPAddr_A+5) - 5;
	
	//计算自己到对方的距离
	__asm
	{
		pushad
		mov eax,my_HttpOpenRequestA
		mov [eax],0xE9
		add eax,1
		mov ebx,dwHTTPJmpMe_A
		mov dword ptr[eax],ebx
		popad
	}
	
	//计算自己到对方的距离
	__asm
	{
		pushad
		mov eax,lpHTTPAddr_A
		add eax,5
		mov [eax],0xE9
		add eax,1
		mov ebx,dwHTTPJmpOther_A
		add ebx,5
		mov dword ptr[eax],ebx
		popad
	}
	VirtualProtect(my_HttpOpenRequestA, 5, dwOldProtect, &dwOldProtect);


Exit0:

	return;
}

void HookOf()
{

}