#include <windows.h>
#include <Shobjidl.h>
#include "madCHook_helper.h"
typedef HRESULT (WINAPI *PF_CoCreateInstance)(REFCLSID rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, REFIID riid, LPVOID *ppv);
PF_CoCreateInstance Hooked_CoCreateInstance_Next = NULL;
HRESULT Hooked_COMCopyItems(IFileOperation* This, __RPC__in_opt IUnknown *punkItems, __RPC__in_opt IShellItem *psiDestinationFolder)
{
OutputDebugStringW(L"testdll: Hooked_COMCopyItems hooked\n");
return S_OK;
}
HRESULT WINAPI Hooked_CoCreateInstance(REFCLSID rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, REFIID riid, LPVOID *ppv)
{
HRESULT hr = Hooked_CoCreateInstance_Next(rclsid, pUnkOuter, dwClsContext, riid, ppv);
if (SUCCEEDED(hr) &&
(*ppv) != NULL &&
::IsEqualCLSID(rclsid, CLSID_FileOperation) &&
::IsEqualIID(riid, IID_IFileOperation))
{
OutputDebugStringW(L"testdll: CoCreateInstance OK");
IFileOperation*pObject = static_cast<IFileOperation*>(*ppv);
LPVOID* pVTable = (*(LPVOID**)pObject); // the v table of the object
LPVOID pCopyItems = pVTable[17];
LPVOID next_CopyItems = NULL;
if(HookCode((LPVOID)pCopyItems,(PVOID)Hooked_COMCopyItems,(LPVOID*)&next_CopyItems) && next_CopyItems)
{
OutputDebugStringW(L"testdll: HookCode OK");
}
}
return hr;
}
/***********************************************************************
// DllMain
//
// Entry point
***********************************************************************/
BOOL APIENTRY DllMain(
HMODULE hModule, //A handle to the DLL module. The value is the base address of the DLL.
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
UNREFERENCED_PARAMETER(lpReserved);
if (DLL_PROCESS_ATTACH == ul_reason_for_call)
{
::DisableThreadLibraryCalls(hModule);
InitializeMadCHook();
OutputDebugStringW(L"testdll loaded");
if (HookAPI("ole32.dll", "CoCreateInstance", Hooked_CoCreateInstance, (PVOID*)&Hooked_CoCreateInstance_Next))
OutputDebugStringW(L"testdll: HookAPI OK");
else
OutputDebugStringW(L"testdll: HookAPI failed");
return TRUE;
}
else if (DLL_PROCESS_DETACH == ul_reason_for_call)
{
FinalizeMadCHook();
OutputDebugStringW(L"testdll unloaded");
return TRUE;
}
else
{
return TRUE;
}
}/* DllMain */
[11152] testdll loaded
[11152] testdll: HookAPI OK
[11152] testdll: CoCreateInstance OK
[11152] testdll: HookCode OK
[11152] testdll: Hooked_COMCopyItems hooked
program InjectExplorer;
uses Windows, madCodeHook;
var ph : THandle;
begin
EnableAllPrivileges;
ph := OpenProcess(PROCESS_ALL_ACCESS, false, 3404);
if ph <> 0 then
if MessageBox(0, 'inject?', 'question', MB_YESNO) = IDYES then
InjectLibrary('Test.dll', ph)
else
UninjectLibrary('Test.dll', ph);
end.
#include <windows.h>
#include <Shobjidl.h>
#include "madCHook_helper.h"
typedef HRESULT (WINAPI *PF_CoCreateInstance)(REFCLSID rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, REFIID riid, LPVOID *ppv);
PF_CoCreateInstance Hooked_CoCreateInstance_Next = NULL;
HRESULT Hooked_COMRenameItem(IFileOperation * This, IShellItem *psiDestinationFolder, LPCWSTR pszNewName, IFileOperationProgressSink *pfopsItem)
{
OutputDebugStringW(L"testdll: Hooked_COMRenameItem hooked\n");
return S_OK;
}
HRESULT Hooked_COMCopyItems(IFileOperation* This, __RPC__in_opt IUnknown *punkItems, __RPC__in_opt IShellItem *psiDestinationFolder)
{
OutputDebugStringW(L"testdll: Hooked_COMCopyItems hooked\n");
return S_OK;
}
HRESULT WINAPI Hooked_CoCreateInstance(REFCLSID rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, REFIID riid, LPVOID *ppv)
{
HRESULT hr = Hooked_CoCreateInstance_Next(rclsid, pUnkOuter, dwClsContext, riid, ppv);
if (SUCCEEDED(hr) &&
(*ppv) != NULL &&
::IsEqualCLSID(rclsid, CLSID_FileOperation) &&
::IsEqualIID(riid, IID_IFileOperation))
{
OutputDebugStringW(L"testdll: Hooked_CoCreateInstance IFileOperation hooked\n");
IFileOperation*pObject = static_cast<IFileOperation*>(*ppv);
LPVOID* pVTable = (*(LPVOID**)pObject); // the v table of the object
[color=#BF4000]{
LPVOID pRenameItem = pVTable[12];
LPVOID next_RenameItem = NULL;
if(HookCode((LPVOID)pRenameItem,(PVOID)Hooked_COMRenameItem,(LPVOID*)&next_RenameItem) && next_RenameItem)
{
OutputDebugStringW(L"testdll: Hook COMRenameItem OK");
}
}
{
LPVOID pCopyItems = pVTable[17];
LPVOID next_CopyItems = NULL;
if(HookCode((LPVOID)pCopyItems,(PVOID)Hooked_COMCopyItems,(LPVOID*)&next_CopyItems) && next_CopyItems)
{
OutputDebugStringW(L"testdll: Hook COMCopyItems OK");
}
}[/color]
}
return hr;
}
#include <windows.h>
#include <Shobjidl.h>
#include "madCHook_helper.h"
typedef HRESULT (WINAPI *PF_CoCreateInstance)(REFCLSID rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, REFIID riid, LPVOID *ppv);
PF_CoCreateInstance Hooked_CoCreateInstance_Next = NULL;
HRESULT Hooked_COMRenameItem(IFileOperation * This, IShellItem *psiDestinationFolder, LPCWSTR pszNewName, IFileOperationProgressSink *pfopsItem)
{
OutputDebugStringW(L"testdll: Hooked_COMRenameItem hooked\n");
return S_OK;
}
HRESULT Hooked_COMCopyItems(IFileOperation* This, __RPC__in_opt IUnknown *punkItems, __RPC__in_opt IShellItem *psiDestinationFolder)
{
OutputDebugStringW(L"testdll: Hooked_COMCopyItems hooked\n");
return S_OK;
}
HRESULT WINAPI Hooked_CoCreateInstance(REFCLSID rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, REFIID riid, LPVOID *ppv)
{
HRESULT hr = Hooked_CoCreateInstance_Next(rclsid, pUnkOuter, dwClsContext, riid, ppv);
if (SUCCEEDED(hr) &&
(*ppv) != NULL &&
::IsEqualCLSID(rclsid, CLSID_FileOperation) &&
::IsEqualIID(riid, IID_IFileOperation))
{
OutputDebugStringW(L"testdll: Hooked_CoCreateInstance IFileOperation hooked\n");
IFileOperation*pObject = static_cast<IFileOperation*>(*ppv);
LPVOID* pVTable = (*(LPVOID**)pObject); // the v table of the object
{
LPVOID pRenameItem = pVTable[12];
LPVOID next_RenameItem = NULL;
if(HookCode((LPVOID)pRenameItem,(PVOID)Hooked_COMRenameItem,(LPVOID*)&next_RenameItem) && next_RenameItem)
{
OutputDebugStringW(L"testdll: Hook COMRenameItem OK");
}
}
//attention:
//if this bracket is removed, two functions are called
//while if not, function 'Hooked_COMCopyItems' is not called
{
LPVOID pCopyItems = pVTable[17];
LPVOID next_CopyItems = NULL;
if(HookCode((LPVOID)pCopyItems,(PVOID)Hooked_COMCopyItems,(LPVOID*)&next_CopyItems) && next_CopyItems)
{
OutputDebugStringW(L"testdll: Hook COMCopyItems OK");
}
}
}
return hr;
}
/***********************************************************************
// DllMain
//
// Entry point
***********************************************************************/
BOOL APIENTRY DllMain(
HMODULE hModule, //A handle to the DLL module. The value is the base address of the DLL.
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
UNREFERENCED_PARAMETER(lpReserved);
if (DLL_PROCESS_ATTACH == ul_reason_for_call)
{
OutputDebugStringW(L"testdll loaded");
::DisableThreadLibraryCalls(hModule);
InitializeMadCHook();
if (HookAPI("ole32", "CoCreateInstance", Hooked_CoCreateInstance, (PVOID*)&Hooked_CoCreateInstance_Next))
{
OutputDebugStringW(L"testdll: Hook CoCreateInstance OK");
}
else
{
OutputDebugStringW(L"testdll: Hook CoCreateInstance failed");
}
return TRUE;
}
else if (DLL_PROCESS_DETACH == ul_reason_for_call)
{
FinalizeMadCHook();
OutputDebugStringW(L"testdll unloaded");
return TRUE;
}
else
{
return TRUE;
}
}/* DllMain */
Users browsing this forum: No registered users and 2 guests