使用 C++ 注入到 x64 进程挂钩 x86-DLL 的 x64-DLL 失败；和 EasyHook
使用 C++ 和 EasyHook 注入 x64 进程挂钩 x86-DLL 的 x64-DLL 失败。 如果 Loader、InjectionLibrary 和 InjectionTarget（它在两个版本中都可用，并且我需要将两者都挂钩）是 x86，则它可以工作。 获取导出过程的地址（GetProcAddress 本身）在 x64 上不是问题。 InjectionTarget 在 x64 上也有 HookTarget(Kernel32.dll) 作为依赖项。 LhInstallHook(...) 返回 STATUS_NOT_SUPPORTED ，其中源注释表明这种情况发生在以下情况： “目标入口点包含不受支持的指令。”
由于该源代码适用于 x86 构建，因此我决定不添加它。
我画了一个小图 
A x64-DLL injected into a x64-process hooking a x86-DLL fails using C++ and EasyHook.
It works if Loader, InjectionLibrary and InjectionTarget(it's available in both versions and i need both to be hooked) are x86.
Getting the address of the exported procedure(GetProcAddress itself) isn't a problem at x64.
The InjectionTarget has HookTarget(Kernel32.dll) as a dependency at x64 aswell.
LhInstallHook(...) returns STATUS_NOT_SUPPORTED where the source comments say that happens when:
"The target entry point contains unsupported instructions."
Due to the fact that the source is fine for x86 builds i've decided to not add it.
I've scratched a little diagram
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您不能在 64 位进程中使用 32 位 DLL，事实上，这概括了您不能混合和匹配 x86 和 x64 代码，单个进程要么完全是 x64，要么完全是 x86。这是 x86-64 的基础，您对此无能为力。在Windows控制台中，他们制作一个64位进程和一个32位进程，并使用IPC来控制32位进程加载和处理所有32位shell扩展。如果你勇敢和/或绝望，你可以尝试类似的事情。
编辑：等一下，等一下。当 x86 模式下一切正常时，您能否从基础上更详细地描述一下这个过程？就像，X 从 Y 加载一个函数，我正在做 Z，因为看起来我不明白你在做什么。
您有一个注入目标和一个注入的 DLL，您尝试从中调用第三方纯 x86 DLL 中的过程。所以正常的调用流程是从 InjectionTarget ->注射库 ->钩子目标 ->导出的程序。这对你不起作用，因为 HookTarget 仅是 x86 并且你无法更改它，因此当你为 x64 版本的 InjectionTarget 重新编译 InjectionLibrary for x64 时，它不再起作用，因为你的 x64 InjectionLibrary 正在尝试加载x86 挂钩目标。
解决这个问题的唯一方法是创建一个 x86 进程并使用进程间通信来让它调用 HookTarget 中您想要调用的过程。如果您无法为 x64 重新编译 HookTarget，那么这是唯一的方法。
You cannot use a 32-bit DLL in a 64bit process, and indeed, this generalizes- you cannot mix and match x86 and x64 code, a single process is either entirely x64, or entirely x86. That's fundamental to x86-64 and there's nothing you can do about it. In the Windows control console, they make a 64bit process and a 32bit process and use IPC to control the 32bit process to load and deal with all the 32bit shell extensions. You could try something similar, if you're brave and/or desperate.
Edit: Wait a minute, wait a minute. Could you describe this process a little more at basics when everything works fine in x86 mode? Like, X loads a function from Y, I am doing Z, because it appears that I don't understand what you're doing.
You have an injection target, and an injected DLL, from which you're trying to call procedures in the third-party x86-only DLL. So the normal flow of call goes from InjectionTarget -> InjectionLibrary -> HookTarget -> ExportedProcedure. And this isn't working for you because HookTarget is x86 only and you can't change that, so when you recompile InjectionLibrary for x64 for the x64 version of InjectionTarget, it doesn't work anymore because your x64 InjectionLibrary is trying to load an x86 HookTarget.
The only solution to this problem is to create an x86 process and use inter-process communication to get it to call the procedures in HookTarget that you want called. If you can't re-compile HookTarget for x64, then this is the only way to do it.