| Autor |
Nachricht |
| < Hooking NtCreateProcess/NtCreateProcessEx |
|
 Verfasst am:
Di Aug 08, 2006 23:55
|
|
|
Anmeldungsdatum: 20.07.2006
Beiträge: 11
Wohnort: Poland
|
|
I heard that hooking NtCreateProcess/NtCreateProcessEx catch each process. So, I have written library:
| Delphi-Code: |
library HookProcessCreation; {$IMAGEBASE $57000000} uses Windows, SysUtils, JWaWinBase, JwaWinNT, JwaWinType, uallDisasm, uallDisasmEx, uallHook, uallKernel, uallProcess, uallUtil; var newNtCreateProcess: function(ProcessHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; InheritFromProcessHandle: HANDLE; InheritHandles: ByteBool; SectionHandle: HANDLE; DebugPort: HANDLE; ExceptionPort: HANDLE): NTSTATUS; stdcall; origNtCreateProcess: function(ProcessHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; InheritFromProcessHandle: HANDLE; InheritHandles: ByteBool; SectionHandle: HANDLE; DebugPort: HANDLE; ExceptionPort: HANDLE): NTSTATUS; stdcall; newNtCreateProcessEx: function(ProcessHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; InheritFromProcessHandle: HANDLE; InheritHandles: ByteBool; SectionHandle: HANDLE; DebugPort: HANDLE; ExceptionPort: HANDLE): NTSTATUS; stdcall; origNtCreateProcessEx: function(ProcessHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; InheritFromProcessHandle: HANDLE; InheritHandles: ByteBool; SectionHandle: HANDLE; DebugPort: HANDLE; ExceptionPort: HANDLE): NTSTATUS; stdcall; function NtCreateProcessCallbackProc(ProcessHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; InheritFromProcessHandle: HANDLE; InheritHandles: ByteBool; SectionHandle: HANDLE; DebugPort: HANDLE; ExceptionPort: HANDLE): NTSTATUS; stdcall; begin Result := newNtCreateProcess(ProcessHandle, DesiredAccess, ObjectAttributes, InheritFromProcessHandle, InheritHandles, SectionHandle, DebugPort, ExceptionPort); MessageBox(0,'Hooked','Hooked',MB_OK); end; function NtCreateProcessExCallbackProc(ProcessHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; InheritFromProcessHandle: HANDLE; InheritHandles: ByteBool; SectionHandle: HANDLE; DebugPort: HANDLE; ExceptionPort: HANDLE): NTSTATUS; stdcall; begin Result := newNtCreateProcess(ProcessHandle, DesiredAccess, ObjectAttributes, InheritFromProcessHandle, InheritHandles, SectionHandle, DebugPort, ExceptionPort); MessageBox(0,'Hooked','Hooked',MB_OK); end; begin @origNtCreateProcess := GetProcAddress(LoadLibrary('ntdll.dll'),'NtCreateProcess'); uallHook.HookCodeNt(@origNtCreateProcess,@NtCreateProcessCallbackProc,@newNtCreateProcess); @origNtCreateProcessEx := GetProcAddress(LoadLibrary('ntdll.dll'),'NtCreateProcessEx'); uallHook.HookCodeNt(@origNtCreateProcessEx,@NtCreateProcessExCallbackProc,@newNtCreateProcessEx); end.
|
JwaNt from uses is here: http://rapidshare.de/files/28701687/JwaNt.rar.html
After iniection into explorer.exe it works fine but... it cant catch processes which starting up from cmd and cant catch process taskmgr.exe (CTRL+ALT+DEL). Any suggestions?
//Mod by BenBE: Replaced Code by Delphi Tags |
|
|
|
 |
|
| Verfasst am:
Fr Aug 11, 2006 15:18
|
|
|
Hauptcoder
Anmeldungsdatum: 21.08.2004
Beiträge: 838
Wohnort: Jahnsdorf (Chemnitz)
|
|
Unlike on Windows 9x where every DLL above 80000000h is visible to all processes you have to inject your hook DLL into every process that might call NtCreateProcess (direct or indirect). Thus injecting the DLL in only one process does not change the code in other processes scopes thus leaving the handling of the function there just as if nothing was done with it.
To install a global hook as you wish to you need to load your library into all processes. Please note that there are two ways to do this:
1. Use uall's functions for DLL Injection (to do this on-the-fly
2. Use NTs automatic DLL loading feature using the registry (App Init settings)
_________________
Das Problem ist die Entscheidung!
|
|
|
|
|
|
| Verfasst am:
Fr Aug 11, 2006 23:40
|
|
|
Anmeldungsdatum: 20.07.2006
Beiträge: 11
Wohnort: Poland
|
|
I use uall's functions for DLL Injection:
| Code: |
dwProcessID := uallProcess.FindProcess('explorer.exe');
uallHook.InjectLibrary(dwProcessID,PChar(uallUtil.GetExeDirectory+'HookProcessCreation.dll'));
|
And still dont work...  |
|
|
|
|
|
|
Alle Zeiten sind GMT + 1 Stunde |
|
Du kannst keine Beiträge in dieses Forum schreiben.
Du kannst auf Beiträge in diesem Forum nicht antworten.
Du kannst deine Beiträge in diesem Forum nicht bearbeiten.
Du kannst deine Beiträge in diesem Forum nicht löschen.
Du kannst an Umfragen in diesem Forum nicht mitmachen.
|
|
