Table Of Content - GitHub Pages

3y ago
59 Views
2 Downloads
386.92 KB
29 Pages
Last View : 3d ago
Last Download : 5m ago
Upload by : Azalea Piercy
Transcription

Copyrights 2008 Christoph HusseTable Of Content1Unmanaged API Reference . 31.1Local Hooking API. 31.1.1TRACED HOOK HANDLE . 51.1.2LhInstallHook. 51.1.3LhUninstallHook . 71.1.4*LhUninstallAllHooks . 71.1.5LhWaitForPendingRemovals . 71.1.6LhSetInclusiveACL . 81.1.7LhSetExclusiveACL . 91.1.8LhSetGlobalInclusiveACL . 101.1.9LhSetGlobalExclusiveACL . 111.1.10*LhIsThreadIntercepted and **LhIsProcessIntercepted . 111.1.11LhBarrierGetReturnAddress . 121.1.12LhBarrierGetAddressOfReturnAddress . 121.1.13LhBarrierGetCallback . 121.1.14LhBarrierBeginStackTrace . 131.1.15LhBarrierEndStackTrace . 131.1.16MODULE INFORMATION . 131.1.17LhEnumerateModules . 141.1.18LhBarrierPointerToModule . 141

Copyrights 2008 Christoph Husse1.1.19LhBarrierGetCallingModule . 141.1.20LhBarrierCallStackTrace . 151.1.21RtlGetLastError. 151.1.22RtlGetLastErrorString . 161.2Driver related API . 171.2.1RhInstallSupportDriver. 171.2.2RhInstallDriver. 171.2.3**EasyHookQueryInterface . 171.2.4EASYHOOK INTERFACE API v 1 . 181.2.5Preparing the build environment. 191.2.6Service management . 201.3Debugging API . 211.3.1DbgAttachDebugger . 221.3.2DbgGetThreadIdByHandle . 221.3.3DbgGetProcessIdByHandle . 221.3.4DbgHandleToObjectName . 231.4Remote hooking API. 241.4.1RhCreateStealthRemoteThread . 241.4.2RhInjectLibrary . 251.4.3REMOTE ENTRY INFO . 271.4.4RhCreateAndInject . 281.4.5RhIsX64System . 281.4.6RhIsX64Process . 291.4.7RhIsAdministrator . 291.4.8RhWakeUpProcess . 292

Copyrights 2008 Christoph Husse1Unmanaged API ReferencePlease note that this reference only explains the unmanaged API. Refer to the documents “Introductionand Tutorial” and “Managed API Reference” for more information about how to write hooking handlerand to understand the overall code logic.1.1 Local Hooking APIIn the following, methods marked with no asterix are available in user- AND kernel-mode, methodsmarked with one asterix are available in user-mode only and methods marked with two asterix areavailable in kernel-mode only. In general, if a method is available in both modes, it will behave the sameand even share approx. 95% of the source code.The following is an example of how to use the local hooking API in context of a driver; the user-modeversion is very similar.#include "EasyHook.h"#define FORCE(expr) {if(!NT SUCCESS(NtStatus (expr))) goto ERROR ABORT;}static EASYHOOK INTERFACE API v 1Interface;BOOLEAN KeCancelTimer Hook(PKTIMER InTimer){PVOIDBackup;PVOIDCallStack[64];MODULE rPointerToModule(0, 0);Interface.LhBarrierCallStackTrace(CallStack, 64, &Mod);return KeCancelTimer(InTimer);}NTSTATUS RunTestSuite(){HOOK TRACE INFONTSTATUSULONGUNICODE STRINGKTIMERhHook { NULL };NtStatus;ACLEntries[1] {0};SymbolName;Timer;3

Copyrights 2008 Christoph HusseBOOLEANPFILE OBJECTHasInterface SYHOOK INTERFACE v 1,&Interface,&hEasyHookDrv));HasInterface TRUE;RtlInitUnicodeString(&SymbolName, L"KeCancelTimer");/*The following shows how to install and remove local outineAddress(&SymbolName),KeCancelTimer Hook,(PVOID)0x12345678,&hHook));// won't invoke the hook handle because hooks are inactive lTimer(&Timer);// activate the hook for the current , 1, &hHook));// will be redirected into the handler.KeCancelTimer(&Timer);// this won’t unhook the entry point. But the associated handler is nevercalled again.Interface.LhUninstallHook(&hHook);// restores ALL entry points of currently pending removals issued als();ObDereferenceObject(hEasyHookDrv);return STATUS SUCCESS;ERROR okDrv);KdPrint(("\n[Error]: \"%S\" (code: .RtlGetLastError()));}elseKdPrint(("\n[Error]: \"Unable to obtain EasyHook interface.\"4

Copyrights 2008 Christoph Husse(code: %d)\n", NtStatus));return NtStatus;}1.1.1TRACED HOOK HANDLEA traced handle was introduced, to make it easier or possible at all to update managed classes,containing a hook handle, if the native library is unloaded or someone removes such a hook or all hooksfrom unmanaged code. All in all it will make the thing much more stable. So what is a trace handle inparticular?A traced handle is pointer of the type:typedef struct HOOK TRACE INFO{PLOCAL HOOK INFOLink;}HOOK TRACE INFO, *TRACED HOOK HANDLE;You will have to pre-allocate such a structure before you can create a hook with LhInstallHook. Duringhook installation, EasyHook will store an internal pointer in the above structure. You MUST NOT releasethis pre-allocated memory before either the native EasyHook library has been unloaded or you explicitlyremoved the hook with one of the hook removal routines.If now somewhere your hook is removed, even if you don’t know about it, the pointer in your handlecan be set to NULL. The next time you use this zeroed handle, the corresponding method will fail withSTATUS INVALID PARAMETERXxx. Without such a traced handle, EasyHook in contrast woulddereference an invalid pointer and that usually is a bad thing especially in kernel mode.1.1.2LhInstallHookInstalls a hook at the given entry point, redirecting all calls to the given hooking method. The returnedhandle will either be released on library unloading or explicitly through LhUninstallHook() orLhUninstallAllHooks().EASYHOOK NT EXPORT LhInstallHook(void* InEntryPoint,5

Copyrights 2008 Christoph Hussevoid * InHookProc,void * InCallback,TRACED HOOK HANDLE OutHandle);ParametersInEntryPointAn entry point to hook. Not all entry points are hookable. In such a caseSTATUS NOT SUPPORTED will be returned.InHookProcThe method that should be called instead of the given entry point. Please note thatcalling convention, parameter count and return value shall match EXACTLY!InCallbackAn uninterpreted callback later available through LhBarrierGetCallback().OutHandleThe memory portion supplied by *OutHandle is expected to be preallocated by thecaller. This structure is then filled by the method on success and must stay valid forhook-life time. Only if you explicitly call one of the hook uninstallation APIs, you cansafely release the handle memory.Return valuesSTATUS NO MEMORYUnable to allocate memory around the target entry point.STATUS NOT SUPPORTEDThe target entry point contains unsupported instructions.STATUS INSUFFICIENT RESOURCESThe limit of MAX HOOK COUNT simultaneous hooks was reached.6

Copyrights 2008 Christoph Husse1.1.3LhUninstallHookRemoves the given hook. To also release associated resources, you will have to callLhWaitForPendingRemovals(). In any case your hook handler will never be executed again, after callingthis method. Please note that this not mean that you handler is currently not executed anymore EASYHOOK NT EXPORT LhUninstallHook(TRACED HOOK HANDLE InHandle);ParametersInHandleA traced hook handle. If the hook is already removed, this method will still returnSTATUS SUCCESS.1.1.4*LhUninstallAllHooksRemoves ALL hooks (created with EasyHook) in the current process! To also release associatedresources, you will have to call LhWaitForPendingRemovals().EASYHOOK NT EXPORT LhUninstallAllHooks();This method is not available in kernel to prevent concurrent drivers from removing each other’s hooks.1.1.5LhWaitForPendingRemovalsFor stability reasons, all resources associated with a hook have to be released if no thread is currentlyexecuting the handler. Separating this wait loop from the uninstallation method is a great performancegain, because you can release all hooks first (which is quite fast), and then wait for all removalssimultaneously (which is then also quite fast).EASYHOOK NT EXPORT LhWaitForPendingRemovals();7

Copyrights 2008 Christoph Husse1.1.6LhSetInclusiveACLATTENTION: In kernel-mode all ACL methods will always refer to processes instead of threads. Theprototypes in the source code are changed appropriately, of course.Sets an inclusive hook local ACL based on the given thread ID list. Global and local ACLs are alwaysintersected. For example if the global ACL allows a set “G” of threads to be intercepted, and the localACL allows a set “L” of threads to be intercepted, then the intersected set “G L” will be intercepted.The “exclusive” and “inclusive” ACL types don’t have any impact on the computation of the final set.Those are just helpers for you to construct a set of threads.EASYHOOK NT EXPORT LhSetInclusiveACL(ULONG* InThreadIdList,ULONG InThreadCount,TRACED HOOK HANDLE InHandle);ParametersInThreadIdListAn array of thread IDs. If you specific zero for an entry in this array, it will beautomatically replaced with the calling thread ID.InThreadCountThe count of entries listed in the thread ID list. This value must not exceedMAX ACE COUNT!InHandleThe hook handle whose local ACL is going to be set.Return valuesSTATUS INVALID PARAMETER 2The limit of MAX ACE COUNT ACL is violated by the given buffer.8

Copyrights 2008 Christoph Husse1.1.7LhSetExclusiveACLATTENTION: In kernel-mode all ACL methods will always refer to processes instead of threads. Theprototypes in the source code are changed ap

1.1 Local Hooking API In the following, methods marked with no asterix are available in user- AND kernel-mode, methods marked with one asterix are available in user-mode only and methods marked with two asterix are available in kernel-mode only. In general, if a method is available in both modes, it will behave the same

Related Documents:

contents page 2 fuel consumption pages 3-6 fiat 500 pages 7-10 fiat 500c pages 11-13 fiat 500 dolcevita pages 14-16 fiat 500 120th anniversary pages 17-21 fiat 500x pages 22-24 fiat 500x 120th anniversary pages 25-27 fiat 500x s-design pages 28-31 fiat 500l pages 32-35 fiat 500l 120th anniversary pages 36-39 tipo hatchback pages 40-43 tipo station wagon pages 44-47 tipo s-design

Pipe Fittings. pages 32-37. Unpolished Fittings. pages 74-80. Polished Fittings. pages 64-73. European Fittings. pages 81-85. Filters / Strainers. pages 111-117. Custom Fabrications. pages 109. Swivels. pages 140-141. Instrumentation. pages 118-133. Air Fittings. pages 162-170. High Press. Quick Disc. pages 171-179. Check Valves. pages 214-222 .

Blood Typing Lab pages 23-29 binder pages 4-6 Fingerprinting Lab pages 30-31 binder page 7 Blood Spatter Lab pages 32-43 binder pages 8-13 Shoe Impressions pages 44- 45 binder page 14 Pathology pages 46-48 binder pages 15-18 ****DNA pages 49-50 binder pages *****must be done last

History of Bushton Manufacturing and Hawk Tools page 3 Clamping pages 20-23 Bishop CLAMP pages 20-21 BushtonCLAMP page 23 VerticalCLAMP page 22 OrthoCLAMP page 23 RouterSHOP pages 11-13 PanelMASTER pages 24-26 Freeborn Cutters pages 27-30 MultiFUNCTION Planer pages 31-32 Parts pages 33-34 JointABILITY pages 14-15 Router Bits Pages 16-17

GitHub Tutorial for Shared LaTeX Projects Figure 6: Initial history of repository with GitHub for Mac the panel in GitHub for Mac will show the repository now under Cloned Repositories as seen in Figure 5 Next click the arrow pointing right in the repository panel to open the history of the repository.

Students were then exposed to Cloud9 IDE Students learned the basics of Git, and merging Students used Cloud9 IDE to construct an interactive graphical program publish it to the Web using GitHub Pages The overall response was fear and dislike Students perceived GitHub

social emotional learning: table of contents data wall pages ii-iii grade pre-kindergarten pages 1-2 grade kindergarten pages 3-4 grade 1 pages 5-6 grade 2 page 7-10 grade 3 page 11-14 grade 4 page 15-18 grade 5 page 19-22 grade 6 pages 23-26 grade 7 pages 27-30 grade 8 pages 31-34

Welcome pages 2 - 3 Safety pages 4 - 5 Camp Contacts page 6 Why MJCC Day Camp page 7 Camp Info pages 8 - 9 Camps Calendar pages 10 - 11 Age Groups page 12 Our Camps pages 13 - 15 CIT (grades 7 - 10) pages 16 - 17 Details pages 18 - 19 3 Table of Contents