0

I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on:

typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*);

static tGetFunc pOrgGetFunc = NULL, pGetFunc = NULL;

HRESULT __stdcall hkGetFunc(IWbemClassObject* pThis, LPCWSTR wszName, LONG lFlags, VARIANT* pVal, 
CIMTYPE* pType, long* plFlavor)
{

     HRESULT hResult = pGetFunc(pThis, wszName, 0, pVal, 0, 0);  

     if (wcscmp(wszName, L"Name") == 0)
     {
         VariantClear(pVal);
         pVal->vt = VT_BSTR;
         pVal->bstrVal = SysAllocString(L"AMD");

     }
     else
     if (wcscmp(wszName, L"NumberOfCores") == 0)
     {
         VariantClear(pVal);
         pVal->vt = VT_BSTR;
         pVal->bstrVal = SysAllocString(L"4");

     }

}

 void Initialize(HMODULE hSelf)
{

   HMODULE hFastprox = NULL;

   while (!hFastprox)
   {
       hFastprox = GetModuleHandleA("fastprox.dll");

       if (!hFastprox)
        Sleep(10);
   }

  if (hFastprox)
  {
    pOrgGetFunc = (tGetFunc)GetProcAddress(hFastprox, "? 
               Get@CWbemObject@@UEAAJPEBGJPEAUtagVARIANT@@PEAJ2@Z");

    if (pOrgGetFunc)
    {
        MH_CreateHook(pOrgGetFunc, &hkGetFunc, (LPVOID*)&pGetFunc);

        MH_EnableHook(pOrgGetFunc);
    }
  }
}

Now, There are different Win32(ex: Win32_bios,Win32_baseboard) WMI classes.

How can I change the Name property in a specific class, like Name in Win32_Processor only?

What if the Fastprox.dll function changes to IWbemClassObject::Next method instead of IWbemClassObject::Get method? Changing the Get function to Next function (?Next@CWbemObject@@UAGJJPAPAGPAUtagVARIANT@@PAJ2@Z) would be enough?

Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.