CRT（C++運行庫）初始化遇到了問題，我手動將我的dll動態資料庫（驅動+白名單）映射到另外一個dll的記憶體中，我將一個IAT hook到“CloseHandle”函式，所以游戲會呼叫我的mainCRTStartup（C++初始化函式，這是程式的入口點，然后會呼叫我的main（）函式），如果禁用CRT，入口點會直接跳到main（）函式，編譯后，注入時良好，但是一旦到crt初始化目標行程將在此處（見下圖）崩潰，我決議了dll匯入，hook沒問題，但是crt初始化，直接崩潰，偶爾甚至無法執行
我需要hook的代碼：（全部在內核中運行）
```c
constexpr wchar_t s_RustClientModule[] = L"uplay_r164.dll";
UNICODE_STRING u_RustClientModule = { 0 };
funcs::RtlInitUnicodeString( &u_RustClientModule, s_RustClientModule );
const auto rust_client_exe = game.get_module( &u_RustClientModule, nullptr );
if ( !rust_client_exe )
{
game.detach( );
return STATUS_UNSUCCESSFUL;
}
funcs::DbgPrint( "rust_client_exe: %p\n", rust_client_exe );
utils::sleep( 2000 );
auto import_address = utils::get_imported_function( rust_client_exe, "CloseHandle" );
if ( !import_address )
{
game.detach( );
return STATUS_UNSUCCESSFUL;
}
funcs::DbgPrint( "import_address: %p\n", import_address );
utils::sleep( 2000 );
auto import_ptr_protect = reinterpret_cast< PVOID >( import_address );
auto import_ptr = reinterpret_cast< uintptr_t* >( import_address );
const auto original_import_ptr = *import_ptr;
funcs::DbgPrint( "import_ptr: %p\n", import_ptr );
funcs::DbgPrint( "import_ptr deref: %p\n", *import_ptr );
funcs::DbgPrint( "import_ptr address of: %p\n", &import_ptr );
utils::sleep( 2000 );
SIZE_T size = sizeof( uintptr_t );
ULONG old_access;
ULONG old_access2;
if ( !NT_SUCCESS( funcs::ZwProtectVirtualMemory( NtCurrentProcess( ), &import_ptr_protect, &size, PAGE_READWRITE, &old_access ) ) )
{
funcs::DbgPrint( "failed protect 1" );
utils::sleep( 2000 );
game.detach( );
return STATUS_UNSUCCESSFUL;
}
RtlCopyMemory( import_ptr, &entry_point, sizeof( entry_point ) );
utils::sleep( 50 );
if ( !NT_SUCCESS( funcs::ZwProtectVirtualMemory( NtCurrentProcess( ), &import_ptr_protect, &size, old_access, &old_access2 ) ) )
{
funcs::DbgPrint( "failed protect 2" );
utils::sleep( 2000 );
game.detach( );
return STATUS_UNSUCCESSFUL;
}
funcs::DbgPrint( "finished hook" );
utils::sleep( 2000 );```
到底哪里出了問題？
轉載請註明出處，本文鏈接：https://www.uj5u.com/net/77765.html
標籤：VC.NET