欢迎来到天天文库
浏览记录
ID:42608038
大小:465.00 KB
页数:28页
时间:2019-09-18
《与HOOK相关的API》由会员上传分享,免费在线阅读,更多相关内容在教育资源-天天文库。
1、·IntroductionInterceptingWin32APIcallshasalwaysbeenachallengingsubjectamongmostoftheWindowsdevelopersandIhavetoadmit,it'sbeenoneofmyfavoritetopics.ThetermHookingrepresentsafundamentaltechniqueofgettingcontroloveraparticularpieceofcodeexecution.Itprovidesanstraightforwardmechanismthatcaneasilya
2、ltertheoperatingsystem'sbehavioraswellas3rdpartyproducts,withouthavingtheirsourcecodeavailable.ManymodernsystemsdrawtheattentiontotheirabilitytoutilizeexistingWindowsapplicationsbyemployingspyingtechniques.Akeymotivationforhooking,isnotonlytocontributetoadvancedfunctionalities,butalsotoinjectu
3、ser-suppliedcodefordebuggingpurposes.Unlikesomerelatively"old"operatingsystemslikeDOSandWindows3.xx,thepresentWindowsOSasNT/2Kand9xprovidesophisticatedmechanismstoseparateaddressspacesofeachprocess.Thisarchitectureoffersarealmemoryprotection,thusnoapplicationisabletocorrupttheaddressspaceofano
4、therprocessorintheworsecaseeventocrashtheoperatingsystemitself.Thisfactmakesalotharderthedevelopmentofsystem-awarehooks.Mymotivationforwritingthisarticlewastheneedforareallysimplehookingframework,thatwillofferaneasytouseinterfaceandabilitytocapturedifferentAPIs.Itintendstorevealsomeofthetricks
5、thatcanhelpyoutowriteyourownspyingsystem.ItsuggestsasinglesolutionhowtobuildasetforhookingWin32APIfunctionsonNT/2Kaswellas98/Me(shortlynamedinthearticle9x)familyWindows.ForthesakeofsimplicityIdecidednottoaddasupportdoUNICODE.However,withsomeminormodificationsofthecodeyoucouldeasilyaccomplishth
6、istask.Spyingofapplicationsprovidesmanyadvantages:1.APIfunction'smonitoringTheabilitytocontrolAPIfunctioncallsisextremelyhelpfulandenablesdeveloperstotrackdownspecific"invisible"actionsthatoccurduringtheAPIcall.Itcontributestocomprehensivevalidationofparametersaswellasreportsproblemsthatusuall
7、yremainoverlookedbehindthescene.Forinstancesometimes,itmightbeveryhelpfultomonitormemoryrelatedAPIfunctionsforcatchingresourceleaks.2.DebuggingandreverseengineeringBesidesthestandardmethodsfordebuggingAPIhookinghasadeservedreputationfor
此文档下载收益归作者所有