如何hook没有导出功能的Native进程？
我需要解决本机进程的逆向工程问题。 我有非托管 .exe，上面有一些控件（例如 TextBox、Buttons、TextAreas、ComboBoxes）。填写控件上的所有数据后，用户将按“打开”。
实际上它会打开调制解调器端口并发送 AT 命令。我想检查数据的格式以及它将发送到调制解调器 COM 端口的消息。
所以我需要如何对过程进行逆向工程并挂钩函数（最有可能是“打开”调制解调器端口的函数，当用户单击“打开”时，它将被调用）。
建议？？我的方向是正确的，我是否需要挂钩它的功能，然后注入后，我的目标就会实现。
注意：
未检测到 EXPORTED 函数。我为此使用了 CFF/PE Explorer。
问候 乌斯曼
I need to solve a reverse engineering problem of a native process.
I am having unmanaged .exe of having some controls on it ( e.g TextBox, Buttons, TextAreas, ComboBoxes). After filling all the data on controls User will press "Open".
Actually it will open the modem port and will send the AT commands. I want to check the format of the data and the message which it will send to modem COM port.
So some how I need to reverse engineer the process and hook the functions( most probably the function which "Open" the modem port, and when user clicks "Open", it will be called).
Suggestions?? My directions are right and do I need to hook its functions then after injection, my goal will be achieved.
Note:
No EXPORTED function is detected. I used CFF/PE Explorer for that.
Regards
Usman
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我看到两种可能性。一种方法是将显示器连接到 com 端口，然后看看那里会出现什么。这完全避免了代码的 RE，并且通常会更快更容易。
[编辑：有两种形式：一种是硬件——连接到 COM 端口硬件的逻辑分析仪（或类似的东西）。它在串行数据流通过线路时对其进行解码并显示。另一种形式是使用 IAT 挂钩对
WriteFile的调用的软件，并显示打开了哪些文件以及向每个文件写入了哪些数据。 Microsoft Detours 库对此很有帮助。]如果您决定 RE无论如何，您可能需要一个像样的反汇编程序，例如 IDAPro。您可能能够从调用
CreateFile和WriteFile的地方开始找到处理COM端口的部分（假设您'正在处理 Win32，基于“PE”的提及）。您可能会在某个地方有类似“\\.\COM”（或至少是“COM”）的文字字符串，并且您需要找到对使用该字符串的CreateFile的调用（或其副本）。从这里开始，您必须向后查找将实际写入 COM 端口的字符串组合在一起的代码。但很难猜测这会有多复杂。
I see two possibilities. One would be to hook a monitor up to the com port, and just look at what comes out there. This avoids RE of the code at all, and will generally be quite a bit quicker and easier.
[Edit: there are two forms of this: one is hardware -- a logic analyzer (or something on that order) connected to the COM port hardware. It decodes and displays the serial data stream as it goes across the wire. The other form would be software that used the IAT to hook into the call to
WriteFileand showed what files were opened, and what data written to each. The Microsoft Detours library can be helpful for this.]If you decide to RE the code anyway, you'll probably need a decent disassembler such as IDAPro. You'll probably be able to find the parts that deal with the COM ports by starting from places that call
CreateFileandWriteFile(assuming you're dealing with Win32, based on the mention of "PE"). You'll probably have something like "\\.\COM " (or at least "COM ") as a literal string somewhere, and you'll want to find a call toCreateFilethat uses that string (or a copy of it).From there, you'll have to work backwards to find the code that puts together the strings that actually get written to the COM port. Hard to guess how complex that will be though.
OllyDbg 可以帮助你。您还需要一些汇编语言和调用约定的基本知识。当然还有安装拦截器功能的原理（走弯路）。
OllyDbg can help you. You also need some basic knowledge of assembly language and calling conventions. And, of course, the principles of installing interceptor functions (detours).