HookDbg

使用远程进程注入调试硬指令实现调试器功能的简单Demo

一、HookDbg前提条件
1.windows在动态链接库的使用时在各个进程中的虚拟地址是相同的，所以调试器中的kernel32.dll地址可以当做要被注入的进程的地址用。
2.有相关的权限，调试器的权限要能打开目标权限，以及分配内存和写入内存。

二、HookDbg的相关步骤
1.提高当前调试器进程权限
2.获取被调试进程的PID(进程ID)
3.使调试器附加到PID对应的活动进程并且调试它

三、HookDbg代码

#include <windows.h>
#include <iostream>
#include <tchar.h>
#include <TlHelp32.h>
using namespace std;
BOOL SeEnableSeDebugPrivilege(HANDLE ProcessHandle, BOOL IsEnable); //提权
BOOL SeGetProcessIdentify(HANDLE* ProcessIdentify, ULONG_PTR ProcessIdentifyLength, const TCHAR* ImageName, ULONG_PTR ImageNameLength);
LPVOID __WriteFile = NULL;
CREATE_PROCESS_DEBUG_INFO __CreateProcessDebugInfo;;
BYTE  __Int3Code = 0xCC;  //软件断点
BYTE __0riginalCode = 0;

BOOL OnCreateProcessDebugEvent(LPDEBUG_EVENT DebugEvent)
{
	// 获取WriteFile() API的地址
	__WriteFile = GetProcAddress(GetModuleHandle(_T("kernel32.dll")), "WriteFile");
	_tprintf(_T("__WriteFile:%p\n"), __WriteFile);
	// API钩子 WriteFile()
	memcpy(&__CreateProcessDebugInfo, &DebugEvent->u.CreateProcessInfo, sizeof(CREATE_PROCESS_DEBUG_INFO));
	ReadProcessMemory(__CreateProcessDebugInfo.hProcess, __WriteFile,
		&__0riginalCode, sizeof(BYTE), NULL);
	DWORD OldProtect = 0;
	VirtualProtectEx(__CreateProcessDebugInfo.hProcess, __WriteFile, 0x1000, PAGE_EXECUTE_READWRITE, &OldProtect);
	WriteProcessMemory(__CreateProcessDebugInfo.hProcess, __WriteFile,
		&__Int3Code, sizeof(BYTE), NULL);
	VirtualProtectEx(__CreateProcessDebugInfo.hProcess, __WriteFile, 0x1000, OldProtect, &OldProtect);
	return TRUE;
}

BOOL OnExceptionDebugEvent(LPDEBUG_EVENT DebugEvent)
{
	CONTEXT Context;
	PBYTE VirtualAddress = NULL;
	ULONG_PTR Buffer = 0;
	ULONG_PTR NumberOfBytesToWrite;
	int i;
	PEXCEPTION_RECORD ExceptionRecord = &DebugEvent->u.Exception.ExceptionRecord;

	if (EXCEPTION_BREAKPOINT == ExceptionRecord->ExceptionCode)
	{
		if (__WriteFile == ExceptionRecord->ExceptionAddress)
		{
			DWORD OldProtect = 0;
			VirtualProtectEx(__CreateProcessDebugInfo.hProcess, __WriteFile, 0x1000, PAGE_EXECUTE_READWRITE, &OldProtect);
			WriteProcessMemory(__CreateProcessDebugInfo.hProcess, __WriteFile,
				&__0riginalCode, sizeof(BYTE), NULL);
			VirtualProtectEx(__CreateProcessDebugInfo.hProcess, __WriteFile, 0x1000, OldProtect, &OldProtect);
			// 获取线程上下文


			// 获取WriteFile的第2，3个参数

#ifdef _WIN64
			Context.ContextFlags = CONTEXT_ALL;
			GetThreadContext(__CreateProcessDebugInfo.hThread, &Context);
			Buffer = Context.Rdx;
			NumberOfBytesToWrite = Context.R8;
	
#else

			Context.ContextFlags = CONTEXT_CONTROL;
			GetThreadContext(__CreateProcessDebugInfo.hThread, &Context);
			ReadProcessMemory(__CreateProcessDebugInfo.hProcess, (LPCVOID)(Context.Esp + 8),
				&Buffer, sizeof(ULONG_PTR), NULL);
			ReadProcessMemory(__CreateProcessDebugInfo.hProcess, (LPCVOID)(Context.Esp + 0xc),
				&NumberOfBytesToWrite, sizeof(DWORD), NULL);

#endif
		
		

			// 分配临时缓冲区
			VirtualAddress = (PBYTE)malloc(NumberOfBytesToWrite + 1);
			memset(VirtualAddress, 0, NumberOfBytesToWrite + 1);
	
			// 复制WriteFile缓冲区到临时缓冲区
			ReadProcessMemory(__CreateProcessDebugInfo.hProcess, (LPCVOID)Buffer,
				VirtualAddress, NumberOfBytesToWrite, NULL);
			printf("\n Original String:%s\n", VirtualAddress);   //这里是ASCII字符数据
	
			//小写字母转大写字母
			for (i = 0; i < NumberOfBytesToWrite; i++)
			{
				if (0x61 <= VirtualAddress[i] && VirtualAddress[i] <= 0x7A)
				{
					VirtualAddress[i] = VirtualAddress[i] - 0x20;
				}
			}


			WriteProcessMemory(__CreateProcessDebugInfo.hProcess, (LPVOID)Buffer,
				VirtualAddress, NumberOfBytesToWrite, NULL);
	
			free(VirtualAddress);

#ifdef _WIN64
			Context.Rip = (ULONG_PTR)__WriteFile;
#else
			Context.Eip = (ULONG_PTR)__WriteFile;
#endif


			SetThreadContext(__CreateProcessDebugInfo.hThread, &Context);
			ContinueDebugEvent(DebugEvent->dwProcessId, DebugEvent->dwThreadId, DBG_CONTINUE);
			Sleep(0);
	
			VirtualProtectEx(__CreateProcessDebugInfo.hProcess, __WriteFile, 0x1000, PAGE_EXECUTE_READWRITE, &OldProtect);
			WriteProcessMemory(__CreateProcessDebugInfo.hProcess, __WriteFile, &__Int3Code,
				sizeof(BYTE), NULL);
			VirtualProtectEx(__CreateProcessDebugInfo.hProcess, __WriteFile, 0x1000, OldProtect, &OldProtect);
			return TRUE;
		}
	}
	return FALSE;

}

void DebugLoop()
{
	DEBUG_EVENT DebugEvent;
	DWORD ContinueStatus;
	while (WaitForDebugEvent(&DebugEvent, INFINITE))
	{
		ContinueStatus = DBG_CONTINUE;
		// 被调试进程生成或附加
		if (CREATE_PROCESS_DEBUG_EVENT == DebugEvent.dwDebugEventCode)
			OnCreateProcessDebugEvent(&DebugEvent);
		// 异常
		else if (EXCEPTION_DEBUG_EVENT == DebugEvent.dwDebugEventCode)
		{
			if (OnExceptionDebugEvent(&DebugEvent))
				continue;
		}
		// 中止
		else if (EXIT_PROCESS_DEBUG_EVENT == DebugEvent.dwDebugEventCode)
			break;
		ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, ContinueStatus);
	}
}

int main(int argc, char* argv[])
{
	SeEnableSeDebugPrivilege(GetCurrentProcess(), TRUE);
	HANDLE ProcessIdentify;
	TCHAR ImageName[MAX_PATH] = { _T("notepad.exe") };

	SeGetProcessIdentify(&ProcessIdentify, sizeof(HANDLE),
		ImageName, MAX_PATH * sizeof(TCHAR));


​	

	// 使调试器附加到一个活动进程并且调试它
	if (!DebugActiveProcess((DWORD)ProcessIdentify)) //激活调试进程
	{
		
		return 1;
	}
	DebugLoop();
	return 0;

}

BOOL SeEnableSeDebugPrivilege(HANDLE ProcessHandle, BOOL IsEnable)
{
	DWORD  LastError;
	HANDLE TokenHandle = 0;

	if (!OpenProcessToken(ProcessHandle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &TokenHandle))
	{
		LastError = GetLastError();
		if (TokenHandle)
			CloseHandle(TokenHandle);
		return LastError;
	}
	TOKEN_PRIVILEGES TokenPrivileges;
	memset(&TokenPrivileges, 0, sizeof(TOKEN_PRIVILEGES));
	LUID v1;
	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &v1))
	{
		LastError = GetLastError();
		CloseHandle(TokenHandle);
		return LastError;
	}
	TokenPrivileges.PrivilegeCount = 1;
	TokenPrivileges.Privileges[0].Luid = v1;
	if (IsEnable)
		TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	else
		TokenPrivileges.Privileges[0].Attributes = 0;
	AdjustTokenPrivileges(TokenHandle, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
	LastError = GetLastError();
	CloseHandle(TokenHandle);
	return LastError;

}
BOOL SeGetProcessIdentify(HANDLE* ProcessIdentify, ULONG_PTR ProcessIdentifyLength, const TCHAR* ImageName, ULONG_PTR ImageNameLength)
{
	BOOL IsOk = FALSE;
	HANDLE SnapshotHandle = INVALID_HANDLE_VALUE;
	PROCESSENTRY32 ProcessEntry32;
	ProcessEntry32.dwSize = sizeof(PROCESSENTRY32);
	int LastError = 0;
	if (IsBadWritePtr(ProcessIdentify, ProcessIdentifyLength) ||
		IsBadReadPtr(ImageName, ImageNameLength))
	{

		LastError = ERROR_INVALID_PARAMETER;
		goto Exit;
	}
	SnapshotHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (SnapshotHandle == INVALID_HANDLE_VALUE)
	{
		LastError = GetLastError();
		return FALSE;
	}
	
	if (!Process32First(SnapshotHandle, &ProcessEntry32))
	{
	
		LastError = GetLastError();
		goto Exit;
	}
	
	do
	{
	
		if (_tcsicmp(ProcessEntry32.szExeFile, ImageName) == 0)
		{
			*ProcessIdentify = (HANDLE)ProcessEntry32.th32ProcessID;
			IsOk = TRUE;
			goto Exit;
		}
	
	} while (Process32Next(SnapshotHandle, &ProcessEntry32));



	LastError = ERROR_MOD_NOT_FOUND;

Exit:

	if (SnapshotHandle != INVALID_HANDLE_VALUE)
	{
		CloseHandle(SnapshotHandle);
	}
	SnapshotHandle = INVALID_HANDLE_VALUE;
	SetLastError(LastError);
	return IsOk;

}