C++挂钩kernel32.dll中OpenProcess与弯路

Question

我试图钩OpenProcess从的Kernel32.dll，以防止所谓的“注射器”从注入其他dll`s到我的过程的程序：

// ------------------------------------------------------------------- 
HANDLE WINAPI myOpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId) 
{ 
    // 

    if (dwDesiredAccess == PROCESS_ALL_ACCESS || dwDesiredAccess == PROCESS_VM_OPERATION || 
     dwDesiredAccess == PROCESS_VM_READ || dwDesiredAccess == PROCESS_VM_WRITE) 
    { 
     printf("Blcoked Process ID : %d , DesiredAccess : %d ", dwProcessId, dwDesiredAccess); 

     return false; 
    } 

    // 

    return dOpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId); 
} 

什么我需要添加，以“检测”如果有人打开了“注入”的过程？ 我不想“阻止”，我希望“发现”注射并决定要做什么。

Answer 1

该图描述的步骤的喷射器通常做到DLL注入另一种方法。你的程序应该做行为分析来决定是否注射。您需要挂接其他API像VirtualAlloc \ WriteProcessMemory，CreateRemoteThread等

下面显示的方法遵循分析注入流量和 需要时阻止执行。注射器使用了很多技术来注入一个dll，下面的所有方法都不足以支持 。

// 
//HookOpenProcess keep track of opened process handle 
// 
HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID); 

/* 
HookVirtualAlloc Check whether the first param is openprocess handle :: Make the suspicion level 3 
*/ 
LPVOID arg = (LPVOID)VirtualAllocEx(process, NULL, ...); 

/* 
HookWriteProcessMemory Check whether the first param is openprocess handle :: Make the suspicion level 2 
*/ 
int n = WriteProcessMemory(process, .....); 

/* 
HookCreateRemoteThread Check whether the first param is openprocess handle :: Make the suspicion level 1 and block it from execution 
*/ 
HANDLE threadID = CreateRemoteThread(process, .........);