3

I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours method, how can I overcome this problem? I searched for an exe that uses dynamic loading via pe-bear and the import directory seems to be empty, I guess that's why my hooking process is not working. Is there any way to expose the export directory in applications that use dynamic loading?

Thank you in advance for your help...

//implant.exe the code I mentioned above, which I reviewed with pe-bear
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "helpers.h"
#include<stdio.h>

#pragma comment(linker, "/entry:WinMain")


typedef BOOL (WINAPI * CreateProcessA_t)(
  LPCSTR                lpApplicationName,
  LPSTR                 lpCommandLine,
  LPSECURITY_ATTRIBUTES lpProcessAttributes,
  LPSECURITY_ATTRIBUTES lpThreadAttributes,
  BOOL                  bInheritHandles,
  DWORD                 dwCreationFlags,
  LPVOID                lpEnvironment,
  LPCSTR                lpCurrentDirectory,
  LPSTARTUPINFOA        lpStartupInfo,
  LPPROCESS_INFORMATION lpProcessInformation
);

typedef DWORD (WINAPI * WaitForSingleObject_t)(
  HANDLE hHandle,
  DWORD  dwMilliseconds
);

typedef BOOL (WINAPI * CloseHandle_t)(
  HANDLE hObject
);

//int main(void) {
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, 
    LPSTR lpCmdLine, int nCmdShow) {

    STARTUPINFO si;
    PROCESS_INFORMATION pi;

    ZeroMemory( &si, sizeof(si) );
    si.cb = sizeof(si);
    ZeroMemory( &pi, sizeof(pi) );
  
    CreateProcessA_t pCreateProcessA = (CreateProcessA_t) hlpGetProcAddress(hlpGetModuleHandle(L"KERNEL32.DLL"), "CreateProcessA");
    WaitForSingleObject_t pWaitForSingleObject = (WaitForSingleObject_t) hlpGetProcAddress(hlpGetModuleHandle(L"KERNEL32.DLL"), "WaitForSingleObject");
    CloseHandle_t pCloseHandle = (CloseHandle_t) hlpGetProcAddress(hlpGetModuleHandle(L"KERNEL32.DLL"), "CloseHandle");

    if (!pCreateProcessA( NULL,   // No module name
                    "c:\\Windows\\System32\\notepad.exe",
                    NULL,           // Process handle not inheritable
                    NULL,           // Thread handle not inheritable
                    FALSE,          // Set handle inheritance to FALSE
                    0,              // No creation flags
                    NULL,           // Use parent's environment block
                    NULL,           // Use parent's starting directory 
                    &si,            // Pointer to STARTUPINFO structure
                    &pi )           // Pointer to PROCESS_INFORMATION structure
            ) {
        //printf( "CreateProcess failed (%d).\n", GetLastError() );
        return -1;
    }

    pWaitForSingleObject( pi.hProcess, INFINITE );
    
    // Close process and thread handles. 
    pCloseHandle( pi.hProcess );
    pCloseHandle( pi.hThread );

    return 0;
}
2
  • 1
    Have you checked for Frida performs hooking? In Frida you simply use the Module.findExportByName(..) function to get an address of an exported function and the you ca hook it.
    – Robert
    Commented Apr 4, 2023 at 8:18
  • 1
    @Robert I tried this but without success, I will add the code above. I am able to catch the CreateProcessA, WaitForSingleObject, CloseHandle functions, but not the GetProcAddress and GetModuleHandle functions. I guess this is because both functions are imported from helpers.h.
    – DertliSelo
    Commented Apr 5, 2023 at 0:18

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.