IAT挂钩实现和检测

• IAT - Import Address Table ,导入地址列表。这里保存着各个导入的函数加载后的地址，它是动态的，随着Dll的加载的位置不同而不同。
• PE - Portable Execute 可执行的程序结构。在PE结构中有个数据目录(Data Directory) 内部保存导入表的数据。格式大概如下:
  dll-数据 1
  函数数据1
  函数数据2
  函数数据3
  …
  dll-数据 2
  …
• 我们根据PE的格式找到函数的已经定位的位置，然后修改这个位置，就能用自己的函数替换这个函数。（再此之前保留好原来的函数）
• 下面以win32 的程序为例，代码如下

#include <windows.h>
#include <stdio.h>
void* test()
{
    void* a = MessageBoxA;
    return a;
}
VOID* g_lpMsgBox = NULL;
typedef int(WINAPI *LpMsgBox)(HWND wnd, char* msg, char* title, UINT btn);

int WINAPI MyMessageBox(HWND wnd, char* msg, char* title, UINT btn)
{
    char buf[256] = {0};
    strcpy(buf, msg);
    strcat(buf, "+mybox");
    ((LpMsgBox)g_lpMsgBox)(wnd, buf, title, btn);
    return 0;
}

BOOL checkIATHook()
{
    PIMAGE_DOS_HEADER dos_header = GetModuleHandle(NULL);
    PIMAGE_NT_HEADERS nt_headers = (LPBYTE)dos_header + dos_header->e_lfanew;
    DWORD import_rva = nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    LPBYTE import_va = (LPBYTE)dos_header + import_rva;
    PIMAGE_IMPORT_DESCRIPTOR imp_desc = import_va;
    while (1){
        if (imp_desc->Name)
        {
            char* name = (LPBYTE)dos_header + imp_desc->Name;
            HMODULE imp_dll = GetModuleHandleA(name);

            PIMAGE_THUNK_DATA thunk = (LPBYTE)dos_header + imp_desc->FirstThunk;
            PIMAGE_THUNK_DATA thunk1 = (LPBYTE)dos_header + imp_desc->OriginalFirstThunk;
            for (;;)
            {
                if (thunk->u1.ForwarderString == 0)
                {
                    break;
                }
                //序号导入
                if (thunk->u1.ForwarderString & IMAGE_ORDINAL_FLAG)
                {
                    //
                    __asm nop;
                }
                else
                {
                    //名称导入
                    PIMAGE_IMPORT_BY_NAME fnName = (LPBYTE)dos_header + thunk1->u1.AddressOfData;
                    DWORD proc_addr = GetProcAddress(imp_dll, fnName->Name);
                    if (thunk->u1.Function != proc_addr)
                    {
                        printf("%s be hooked : 0x%x\n", fnName->Name, thunk->u1.Function);
                    }
                    __asm nop;
                }
                thunk += 1;
                thunk1 += 1;
            }
            imp_desc += 1;
        }
        else
        {
            break;
        }
    }
    return TRUE;
}
void hookMessageBoxA()
{
    PIMAGE_DOS_HEADER dos_header = GetModuleHandle(NULL);
    PIMAGE_NT_HEADERS nt_headers = (LPBYTE)dos_header + dos_header->e_lfanew;
    DWORD import_rva = nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    LPBYTE import_va = (LPBYTE)dos_header + import_rva;
    PIMAGE_IMPORT_DESCRIPTOR imp_desc = import_va;
    while (1){
        if (imp_desc->Name)
        {
            char* name = (LPBYTE)dos_header + imp_desc->Name;
            if (stricmp(name, "user32.dll") == 0)
            {
                PIMAGE_THUNK_DATA thunk = (LPBYTE)dos_header + imp_desc->FirstThunk;
                PIMAGE_THUNK_DATA thunk1 = (LPBYTE)dos_header + imp_desc->OriginalFirstThunk;
                for (;;)
                {
                    if (thunk->u1.ForwarderString == 0)
                    {
                        break;
                    }
                    if (thunk->u1.ForwarderString&IMAGE_ORDINAL_FLAG)
                    {
                        //
                        __asm nop;
                    }
                    else
                    {
                        PIMAGE_IMPORT_BY_NAME fnName = (LPBYTE)dos_header + thunk1->u1.AddressOfData;
                        if (strcmp(fnName->Name, "MessageBoxA")==0)
                        {
                            g_lpMsgBox = thunk->u1.Function;
                            DWORD prFlag;
                            BOOL b = VirtualProtect(&imp_desc->FirstThunk, 4, PAGE_EXECUTE_READWRITE, &prFlag);
                            if (b)
                            {
                                *(DWORD*)thunk = MyMessageBox;
                            }
                            VirtualProtect(&imp_desc->FirstThunk, 4, prFlag, &prFlag);
                        }
                        return;
                        __asm nop;
                    }
                    thunk += 1;
                }
            }
            imp_desc += 1;
        }
        else
        {
            break;
        }
    }

}
int main(int argc, char** argv)
{
    test();
    hookMessageBoxA();
    checkIATHook();
    MessageBoxA(NULL, "msg", "haha", MB_OK);

    return 0;
}