过所有R3层HOOK的DLL重载

那个谁

过所有R3层HOOK的DLL重载
#include <stdio.h>
#include <Windows.h>
#include <winnt.h>
#include <myfunc.h>
//2012/2/15  BY 金在中 QQ88009720
//Perfect MemoryLoader
//If you use this code freely  ,You can pass all the ring3 API hook;
typedef void *HMEMORYLOADER;
HMEMORYLOADER MemoryLoadLibrary(const void *);
FARPROC MemoryGetProcAddress(HMEMORYLOADER, const char *);
void MemoryFreeLibrary(HMEMORYLOADER);
typedef int (__stdcall *PmessageboxA)(HWND hWnd, LPCSTR lpText,LPCSTR lpCaption,UINT uType);
#define POINTER_TYPE DWORD
typedef struct {
PIMAGE_NT_HEADERS headers;
unsigned char *codeBase;
HMODULE *modules;
int numModules;
int initialized;
} MEMORYMODULE, *PMEMORYMODULE;
typedef BOOL (WINAPI *DllEntryProc)(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);
#define GET_HEADER_DICTIONARY(module, idx) &(module)->headers->OptionalHeader.DataDirectory[idx]
static void
CopySections(const unsigned char *data, PIMAGE_NT_HEADERS old_headers, PMEMORYMODULE module)
{
int i, size;
unsigned char *codeBase = module->codeBase;
unsigned char *dest;
PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(module->headers);
for (i=0; i<module->headers->FileHeader.NumberOfSections; i++, section++) {
  if (section->SizeOfRawData == 0) {
   size = old_headers->OptionalHeader.SectionAlignment;
   if (size > 0) {
    dest = (unsigned char *)VirtualAlloc(codeBase + section->VirtualAddress,
     size,
     MEM_COMMIT,
     PAGE_READWRITE);
    section->Misc.PhysicalAddress = (POINTER_TYPE)dest;
    memset(dest, 0, size);
   }
   continue;
  }
  dest = (unsigned char *)VirtualAlloc(codeBase + section->VirtualAddress,
   section->SizeOfRawData,
   MEM_COMMIT,
   PAGE_READWRITE);
  memcpy(dest, data + section->ointerToRawData, section->SizeOfRawData);
  section->Misc.PhysicalAddress = (POINTER_TYPE)dest;
}
}
static int ProtectionFlags[2][2][2] = {
{
  {PAGE_NOACCESS, PAGE_WRITECOPY},
  {PAGE_READONLY, PAGE_READWRITE},
}, {
  {PAGE_EXECUTE, PAGE_EXECUTE_WRITECOPY},
  {PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE},
},
};
static void
FinalizeSections(PMEMORYMODULE module)
{
int i;
PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(module->headers);
#define imageOffset 0
for (i=0; i<module->headers->FileHeader.NumberOfSections; i++, section++) {
  DWORD protect, oldProtect, size;
  int executable = (section->Characteristics & IMAGE_SCN_MEM_EXECUTE) != 0;
  int readable =   (section->Characteristics & IMAGE_SCN_MEM_READ) != 0;
  int writeable =  (section->Characteristics & IMAGE_SCN_MEM_WRITE) != 0;
  if (section->Characteristics & IMAGE_SCN_MEM_DISCARDABLE) {
   VirtualFree((LPVOID)((POINTER_TYPE)section->Misc.PhysicalAddress | imageOffset), section->SizeOfRawData, MEM_DECOMMIT);
   continue;
  }
  protect = ProtectionFlags[executable][readable][writeable];
  if (section->Characteristics & IMAGE_SCN_MEM_NOT_CACHED) {
   protect |= PAGE_NOCACHE;
  }
  size = section->SizeOfRawData;
  if (size == 0) {
   if (section->Characteristics & IMAGE_SCN_CNT_INITIALIZED_DATA) {
    size = module->headers->OptionalHeader.SizeOfInitializedData;
   } else if (section->Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA) {
    size = module->headers->OptionalHeader.SizeOfUninitializedData;
   }
  }
  if (size > 0) {
   if (VirtualProtect((LPVOID)((POINTER_TYPE)section->Misc.PhysicalAddress | imageOffset), size, protect, &oldProtect) == 0);
     }
}
}
static void
PerformBaseRelocation(PMEMORYMODULE module, SIZE_T delta)
{
DWORD i;
unsigned char *codeBase = module->codeBase;
PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(module, IMAGE_DIRECTORY_ENTRY_BASERELOC);
if (directory->Size > 0) {
  PIMAGE_BASE_RELOCATION relocation = (PIMAGE_BASE_RELOCATION) (codeBase + directory->VirtualAddress);
  for (; relocation->VirtualAddress > 0; ) {
   unsigned char *dest = codeBase + relocation->VirtualAddress;
   unsigned short *relInfo = (unsigned short *)((unsigned char *)relocation + IMAGE_SIZEOF_BASE_RELOCATION);
   for (i=0; i<((relocation->SizeOfBlock-IMAGE_SIZEOF_BASE_RELOCATION) / 2); i++, relInfo++) {
    DWORD *patchAddrHL;
    int type, offset;
    type = *relInfo >> 12;
    offset = *relInfo & 0xfff;
    switch (type)
    {
    case IMAGE_REL_BASED_ABSOLUTE:
     break;
    case IMAGE_REL_BASED_HIGHLOW:
     patchAddrHL = (DWORD *) (dest + offset);
     *patchAddrHL += (DWORD)delta;
     break;
    default:
     break;
    }
   }
   relocation = (PIMAGE_BASE_RELOCATION) (((char *) relocation) + relocation->SizeOfBlock);
  }
}
}
static int
BuildImportTable(PMEMORYMODULE module)
{
int result=1;
unsigned char *codeBase = module->codeBase;
PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(module, IMAGE_DIRECTORY_ENTRY_IMPORT);
if (directory->Size > 0) {
  PIMAGE_IMPORT_DESCRIPTOR importDesc = (PIMAGE_IMPORT_DESCRIPTOR) (codeBase + directory->VirtualAddress);
  for (; !IsBadReadPtr(importDesc, sizeof(IMAGE_IMPORT_DESCRIPTOR)) && importDesc->Name; importDesc++) {
   POINTER_TYPE *thunkRef;
   FARPROC *funcRef;
   HMODULE handle = LoadLibraryA((LPCSTR) (codeBase + importDesc->Name));
   if (handle == INVALID_HANDLE_VALUE)
   {
    result = 0;
    break;
   }
   module->modules = (HMODULE *)realloc(module->modules, (module->numModules+1)*(sizeof(HMODULE)));
   if (module->modules == NULL) {
    result = 0;
    break;
   }
   module->modules[module->numModules++] = handle;
   if (importDesc->OriginalFirstThunk) {
    thunkRef = (POINTER_TYPE *) (codeBase + importDesc->OriginalFirstThunk);
    funcRef = (FARPROC *) (codeBase + importDesc->FirstThunk);
   } else {
    thunkRef = (POINTER_TYPE *) (codeBase + importDesc->FirstThunk);
    funcRef = (FARPROC *) (codeBase + importDesc->FirstThunk);
   }
   for (; *thunkRef; thunkRef++, funcRef++) {
    if (IMAGE_SNAP_BY_ORDINAL(*thunkRef)) {
     *funcRef = (FARPROC)GetProcAddress(handle, (LPCSTR)IMAGE_ORDINAL(*thunkRef));
    } else {
     PIMAGE_IMPORT_BY_NAME thunkData = (PIMAGE_IMPORT_BY_NAME) (codeBase + (*thunkRef));
     *funcRef = (FARPROC)GetProcAddress(handle, (LPCSTR)&thunkData->Name);
    }
    if (*funcRef == 0) {
     result = 0;
     break;
    }
   }
   if (!result) {
    break;
   }
  }
}
return result;
}
HMEMORYLOADER MemoryLoadLibrary(const void *data)
{
PMEMORYMODULE result;
PIMAGE_DOS_HEADER dos_header;
PIMAGE_NT_HEADERS old_header;
unsigned char *code, *headers;
SIZE_T locationDelta;
DllEntryProc DllEntry;
BOOL successfull;
dos_header = (PIMAGE_DOS_HEADER)data;
if (dos_header->e_magic != IMAGE_DOS_SIGNATURE)
{
  return NULL;
}
old_header = (PIMAGE_NT_HEADERS)&((const unsigned char *)(data))[dos_header->e_lfanew];
if (old_header->Signature != IMAGE_NT_SIGNATURE)
{
  return NULL;
}
code = (unsigned char *)VirtualAlloc((LPVOID)(old_header->OptionalHeader.ImageBase),
  old_header->OptionalHeader.SizeOfImage,
  MEM_RESERVE,
  PAGE_READWRITE);
if (code == NULL) {
  code = (unsigned char *)VirtualAlloc(NULL,
   old_header->OptionalHeader.SizeOfImage,
   MEM_RESERVE,
   PAGE_READWRITE);
  if (code == NULL)
  {
   return NULL;
  }
}
result = (PMEMORYMODULE)HeapAlloc(GetProcessHeap(), 0, sizeof(MEMORYMODULE));
result->codeBase = code;
result->numModules = 0;
result->modules = NULL;
result->initialized = 0;
VirtualAlloc(code,
  old_header->OptionalHeader.SizeOfImage,
  MEM_COMMIT,
  PAGE_READWRITE);
headers = (unsigned char *)VirtualAlloc(code,
  old_header->OptionalHeader.SizeOfHeaders,
  MEM_COMMIT,
  PAGE_READWRITE);
memcpy(headers, dos_header, dos_header->e_lfanew + old_header->OptionalHeader.SizeOfHeaders);
result->headers = (PIMAGE_NT_HEADERS)&((const unsigned char *)(headers))[dos_header->e_lfanew];
result->headers->OptionalHeader.ImageBase = (POINTER_TYPE)code;
CopySections((const unsigned char *)data, old_header, result);
locationDelta = (SIZE_T)(code - old_header->OptionalHeader.ImageBase);
if (locationDelta != 0) {
  PerformBaseRelocation(result, locationDelta);
}
if (!BuildImportTable(result)) {
  goto error;
}
FinalizeSections(result);
if (result->headers->OptionalHeader.AddressOfEntryPoint != 0) {
  DllEntry = (DllEntryProc) (code + result->headers->OptionalHeader.AddressOfEntryPoint);
  if (DllEntry == 0)
  {
   goto error;
  }
  successfull = (*DllEntry)((HINSTANCE)code, DLL_PROCESS_ATTACH, 0);
  if (!successfull)
  {
   goto error;
  }
  result->initialized = 1;
}
return (HMEMORYLOADER)result;
error:
MemoryFreeLibrary(result);
return NULL;
}
FARPROC MemoryGetProcAddress(HMEMORYLOADER module, const char *name)
{
unsigned char *codeBase = ((PMEMORYMODULE)module)->codeBase;
int idx=-1;
DWORD i, *nameRef;
WORD *ordinal;
PIMAGE_EXPORT_DIRECTORY exports;
PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY((PMEMORYMODULE)module, IMAGE_DIRECTORY_ENTRY_EXPORT);
if (directory->Size == 0) {
  return NULL;
}
exports = (PIMAGE_EXPORT_DIRECTORY) (codeBase + directory->VirtualAddress);
if (exports->NumberOfNames == 0 || exports->NumberOfFunctions == 0) {
  return NULL;
}
nameRef = (DWORD *) (codeBase + exports->AddressOfNames);
ordinal = (WORD *) (codeBase + exports->AddressOfNameOrdinals);
for (i=0; i<exports->NumberOfNames; i++, nameRef++, ordinal++) {
  if (_stricmp(name, (const char *) (codeBase + (*nameRef))) == 0) {
   idx = *ordinal;
   break;
  }
}
if (idx == -1) {
  return NULL;
}
if ((DWORD)idx > exports->NumberOfFunctions) {
  return NULL;
}
return (FARPROC) (codeBase + (*(DWORD *) (codeBase + exports->AddressOfFunctions + (idx*4))));
}
void MemoryFreeLibrary(HMEMORYLOADER mod)
{
int i;
PMEMORYMODULE module = (PMEMORYMODULE)mod;
if (module != NULL) {
  if (module->initialized != 0) {
   DllEntryProc DllEntry = (DllEntryProc) (module->codeBase + module->headers->OptionalHeader.AddressOfEntryPoint);
   (*DllEntry)((HINSTANCE)module->codeBase, DLL_PROCESS_DETACH, 0);
   module->initialized = 0;
  }
  if (module->modules != NULL) {
   for (i=0; i<module->numModules; i++) {
    if (module->modules != INVALID_HANDLE_VALUE) {
     FreeLibrary(module->modules);
    }
   }
   free(module->modules);
  }
  if (module->codeBase != NULL) {
   VirtualFree(module->codeBase, 0, MEM_RELEASE);
  }
  HeapFree(GetProcessHeap(), 0, module);
}
}

int main(int argc, char* argv[])
{
MessageBoxA(0,"原始的MessageBoxA","hi ! i&#39;m the natural MessageBoxA ",0);
FILE *fp;
unsigned char *data=NULL;
size_t size;
HMEMORYLOADER module;
fopen_s(&fp,"C:\\WINDOWS\\system32\\user32.dll","rb");
if (fp == NULL)
{
  free(data);
  return 0;
}
fseek(fp, 0, SEEK_END);
size = ftell(fp);
data = (BYTE *)malloc(size);
fseek(fp, 0, SEEK_SET);
fread(data, 1, size, fp);
fclose(fp);
module = MemoryLoadLibrary(data);
if (module == NULL)
{
  free(data);
  return 0;
}
  PmessageboxA  MyMessageboxA;
  MyMessageboxA = (PmessageboxA)MemoryGetProcAddress(module, "MessageBoxA");
  MyMessageboxA(0,"内存中的MessageBoxA","hi ! i&#39;m the Memory MessageBoxA ",0);
  //MemoryFreeLibrary(module);一般不做释放 由于系统分页和变量没有回收 所以释放会内存出错
  //另外注意系统DLL不允许单独内存加载重定位 也就是说你如果内存加载系统DLL则必须内存中存在此系统DLL才能二次重定位加载调用成功
getchar();
return 0;
}