DLL 注入后拦截 BIG 应用程序执行
我必须在很多地方拦截非常大的应用程序的执行。
我可以使用哪些程序来执行此操作？有什么技术可以解决这个问题？
手动逆向工程和添加钩子可能不是这个问题的最佳解决方案，因为应用程序非常大，应用程序的某些部分可以在一段时间内更新，我认为有一些对于这个问题的工具或良好实践我可以更快地做到这一点，有人知道该怎么做吗？
有人帮助我吗？
I must intercept execution in very big application in many places.
What programs I can use to do this? What techniques exists for this problems?
Manually reverse engineering and adding hooks is maybe not optimal solution for this problem, because application is very big and some part of application can be updated in some time, i think with some tools or good practices for this problem i can do this faster, anyone know how to do?
Anybody help me?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
既然已经介绍了工具部分，那么这里是技术部分。
根据您需要挂钩的内容以及是否有保护，有几种方法：
虚拟化二进制文件中的相对调用/jmp 修补：这是最简单的，但如果可以的话也需要做很多工作不会自动查找对函数的所有引用，由于您的条件，这可能不会在这种情况下工作。
IAT/EAT 挂钩：这用于导入 (IAT) 和导出 (EAT)，如果您的目标是一组已知的导入/导出 API 函数，则非常有用。一个很好的例子可以在此处或此处
热修补：Windows XP SP2 引入了一种称为“热修补”的功能（用于实时系统功能更新），其中所有（WinAPI）功能均以“mov edi,edi”开头，允许将相对跳转修补到每个可热修补功能之上创建的可用空间（也可以做到）。这通常用于对 IAT 进行校验或具有其他有趣形式的保护的程序，可以找到更多信息 此处 和此处 >
Code-Caving：通过在任意代码空间中放置重定向来捕获执行流。请参阅此处，此处 或 此处
VFT/COM 重定向：基本上覆盖对象虚拟函数表中的条目，对于基于 OOP/COM 的应用程序很有用。请参阅此
有很多 3rd 方库，最著名的可能是MS Detours，也可以看看APIHijack 或 迷你钩子引擎。
当然，没有什么可以替代您需要使用像 ollydbg 这样的调试器进行的初始测试，但要了解该方法你将使用的可以大大缩短他们花在闲逛上的时间
seeing as the tools part has been covered, here is something for the techniques.
Depending what it is you need to hook and whether or not there is protection invloved, there are a few methods:
Relative call/jmp patching in the virtualized binary: this is the simplest, but also a lot of work if you can't automatically find all references to a function, this probably won't work in this cause due to your criteria.
IAT/EAT hooking: this is use for imports(IAT) and exports(EAT), great if your targeting a known importted/exported set of API functions. a good example of this can be found here or here
Hot-Patching: Windows XP SP2 introduced something called "hot-patching" (used for realtime system function updates), where all its (the WinAPI) functions start with a 'mov edi,edi', allowing a relative jump to be patched into the free space created above every hot-patchable function(one can do it too). this is generally used for programs that checksum there IAT's or have other funny forms of protection, more info can be found here and here
Code-Caving: capturing execution flow by placing redirections in arbitrary code space. see here, here or here
VFT/COM Redirection: basically overwriting entries in a objects virtual function table, useful for OOP/COM based applications. see this
There are a lot of 3rd party libraries, most famous would probably be MS Detours, one can also look at APIHijack or a mini-hook engine.
Ofcourse nothing can substitute for the initial poking you'll need to do with a debugger like ollydbg, but knowing the method your gonna use can drastically short them amount time time spent poking around
关于您到底需要做什么的一些详细信息（例如，您如何确定在哪里中断）会很好。根据您的情况，Pin 之类的内容可能会起作用。
Some details on what exactly you need to do (e.g. how do you determine where to break) would be nice. Depending on your situation, something like Pin might work.
我建议使用 Deviare API Hook。这是您完成所需任务的最简单方法。它有一些 COM 对象，可用于从不同的进程挂钩应用程序。在您的过程中，您可以获得完整的参数信息，并且可以在任何编程语言中使用它（我使用的是 C#，它的工作方式就像一个魅力）。
如果您需要拦截注册表 API，我建议使用 Deviare 来调试您需要拦截的内容，但随后您必须制作自己的钩子，否则，您会发现性能问题。
I suggest using Deviare API Hook. It's the easiest way you can do what you need. It has some COM objects that you can use to hook an application from a different process. In your process you get full parameter information and you can use it in any programming language (I'm using C# and it works like a charm).
If you need to intercept registry API I suggest using Deviare to debug what you need to intercept but then you will have to make your own hooks, otherwise, you'll find performance issues.
如果您对拦截方法调用感兴趣，可以进行 API Hooking。
或者使用一些反汇编程序，例如 Softice 或 ollydbg 或 win32dasm。
You can do API Hooking if you are interested in intercepting method calls.
Or use some disassembler like softice or ollydbg or win32dasm.