[Win32ss]

- Add support for loading hook modules.

svn path=/trunk/; revision=60539
This commit is contained in:
James Tabor 2013-10-05 19:57:22 +00:00
parent ae0bca8de5
commit f01c97ea16
6 changed files with 59 additions and 12 deletions

View file

@ -49,7 +49,10 @@ typedef struct _HOOKPROC_CALLBACK_ARGUMENTS
WPARAM wParam; WPARAM wParam;
LPARAM lParam; LPARAM lParam;
HOOKPROC Proc; HOOKPROC Proc;
INT Mod;
ULONG_PTR offPfn;
BOOLEAN Ansi; BOOLEAN Ansi;
WCHAR ModuleName[512];
} HOOKPROC_CALLBACK_ARGUMENTS, *PHOOKPROC_CALLBACK_ARGUMENTS; } HOOKPROC_CALLBACK_ARGUMENTS, *PHOOKPROC_CALLBACK_ARGUMENTS;
typedef struct _HOOKPROC_CBT_CREATEWND_EXTRA_ARGUMENTS typedef struct _HOOKPROC_CBT_CREATEWND_EXTRA_ARGUMENTS

View file

@ -448,6 +448,8 @@ co_IntCallHookProc(INT HookId,
WPARAM wParam, WPARAM wParam,
LPARAM lParam, LPARAM lParam,
HOOKPROC Proc, HOOKPROC Proc,
INT Mod,
ULONG_PTR offPfn,
BOOLEAN Ansi, BOOLEAN Ansi,
PUNICODE_STRING ModuleName) PUNICODE_STRING ModuleName)
{ {
@ -575,7 +577,11 @@ co_IntCallHookProc(INT HookId,
Common->wParam = wParam; Common->wParam = wParam;
Common->lParam = lParam; Common->lParam = lParam;
Common->Proc = Proc; Common->Proc = Proc;
Common->Mod = Mod;
Common->offPfn = offPfn;
Common->Ansi = Ansi; Common->Ansi = Ansi;
RtlZeroMemory(&Common->ModuleName, sizeof(Common->ModuleName));
RtlCopyMemory(&Common->ModuleName, ModuleName->Buffer, ModuleName->Length);
Extra = (PCHAR) Common + sizeof(HOOKPROC_CALLBACK_ARGUMENTS); Extra = (PCHAR) Common + sizeof(HOOKPROC_CALLBACK_ARGUMENTS);
switch(HookId) switch(HookId)

View file

@ -29,6 +29,8 @@ co_IntCallHookProc(INT HookId,
WPARAM wParam, WPARAM wParam,
LPARAM lParam, LPARAM lParam,
HOOKPROC Proc, HOOKPROC Proc,
INT Mod,
ULONG_PTR offPfn,
BOOLEAN Ansi, BOOLEAN Ansi,
PUNICODE_STRING ModuleName); PUNICODE_STRING ModuleName);

View file

@ -349,6 +349,8 @@ co_CallHook( INT HookId,
wParam, wParam,
lParam, lParam,
phk->Proc, phk->Proc,
phk->ihmod,
phk->offPfn,
phk->Ansi, phk->Ansi,
&phk->ModuleName); &phk->ModuleName);
@ -373,6 +375,8 @@ co_HOOK_CallHookNext( PHOOK Hook,
wParam, wParam,
lParam, lParam,
Hook->Proc, Hook->Proc,
Hook->ihmod,
Hook->offPfn,
Hook->Ansi, Hook->Ansi,
&Hook->ModuleName); &Hook->ModuleName);
} }
@ -1233,6 +1237,8 @@ co_HOOK_CallHooks( INT HookId,
wParam, wParam,
lParam, lParam,
Hook->Proc, Hook->Proc,
Hook->ihmod,
Hook->offPfn,
Hook->Ansi, Hook->Ansi,
&Hook->ModuleName); &Hook->ModuleName);
if (ClientInfo) if (ClientInfo)
@ -1309,6 +1315,8 @@ co_HOOK_CallHooks( INT HookId,
wParam, wParam,
lParam, lParam,
Hook->Proc, Hook->Proc,
Hook->ihmod,
Hook->offPfn,
Hook->Ansi, Hook->Ansi,
&Hook->ModuleName); &Hook->ModuleName);
} }

View file

@ -2698,6 +2698,8 @@ NtUserMessageCall( HWND hWnd,
((ClientInfo->CI_flags & CI_CURTHPRHOOK) ? 1 : 0), ((ClientInfo->CI_flags & CI_CURTHPRHOOK) ? 1 : 0),
(LPARAM)&CWP, (LPARAM)&CWP,
Hook->Proc, Hook->Proc,
Hook->ihmod,
Hook->offPfn,
Hook->Ansi, Hook->Ansi,
&Hook->ModuleName); &Hook->ModuleName);
} }
@ -2715,6 +2717,8 @@ NtUserMessageCall( HWND hWnd,
((ClientInfo->CI_flags & CI_CURTHPRHOOK) ? 1 : 0), ((ClientInfo->CI_flags & CI_CURTHPRHOOK) ? 1 : 0),
(LPARAM)&CWPR, (LPARAM)&CWPR,
Hook->Proc, Hook->Proc,
Hook->ihmod,
Hook->offPfn,
Hook->Ansi, Hook->Ansi,
&Hook->ModuleName); &Hook->ModuleName);
} }

View file

@ -567,13 +567,34 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
CWPRETSTRUCT *pCWPR; CWPRETSTRUCT *pCWPR;
PRECTL prl; PRECTL prl;
LPCBTACTIVATESTRUCT pcbtas; LPCBTACTIVATESTRUCT pcbtas;
HOOKPROC Proc;
WPARAM wParam = 0; WPARAM wParam = 0;
LPARAM lParam = 0; LPARAM lParam = 0;
LRESULT Result = 0; LRESULT Result = 0;
BOOL Hit = FALSE; BOOL Hit = FALSE;
HMODULE mod = NULL;
Common = (PHOOKPROC_CALLBACK_ARGUMENTS) Arguments; Common = (PHOOKPROC_CALLBACK_ARGUMENTS) Arguments;
Proc = Common->Proc;
// HookProc Justin Case module is from another process.
if (Common->offPfn && Common->Mod)
{
if (!(mod = GetModuleHandleW((LPCWSTR)Common->ModuleName)))
{
TRACE("Reloading Hook Module.\n");
if (!(mod = LoadLibraryExW((LPCWSTR)Common->ModuleName, NULL, LOAD_WITH_ALTERED_SEARCH_PATH)))
{
ERR("Failed to load Hook Module.\n");
}
}
if (mod)
{
TRACE("Loading Hook Module.\n");
Proc = (HOOKPROC)((char *)mod + Common->offPfn);
}
}
switch(Common->HookId) switch(Common->HookId)
{ {
case WH_CBT: case WH_CBT:
@ -613,15 +634,16 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
lParam = Common->lParam; lParam = Common->lParam;
break; break;
default: default:
if (mod) FreeLibrary(mod);
ERR("HCBT_ not supported = %d\n", Common->Code); ERR("HCBT_ not supported = %d\n", Common->Code);
return ZwCallbackReturn(NULL, 0, STATUS_NOT_SUPPORTED); return ZwCallbackReturn(NULL, 0, STATUS_NOT_SUPPORTED);
} }
if (Common->Proc) if (Proc)
{ {
_SEH2_TRY _SEH2_TRY
{ {
Result = Common->Proc(Common->Code, wParam, lParam); Result = Proc(Common->Code, wParam, lParam);
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{ {
@ -631,7 +653,7 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
} }
else else
{ {
ERR("Null Proc! Common = 0x%x, Proc = 0x%x\n",Common,Common->Proc); ERR("Null Proc! Common = 0x%x, Proc = 0x%x\n",Common,Proc);
} }
switch(Common->Code) switch(Common->Code)
{ {
@ -649,19 +671,19 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
//ERR("WH_KEYBOARD_LL: Code %d, wParam %d\n",Common->Code,Common->wParam); //ERR("WH_KEYBOARD_LL: Code %d, wParam %d\n",Common->Code,Common->wParam);
pKeyboardLlData = (PKBDLLHOOKSTRUCT)((PCHAR) Common + Common->lParam); pKeyboardLlData = (PKBDLLHOOKSTRUCT)((PCHAR) Common + Common->lParam);
RtlCopyMemory(&KeyboardLlData, pKeyboardLlData, sizeof(KBDLLHOOKSTRUCT)); RtlCopyMemory(&KeyboardLlData, pKeyboardLlData, sizeof(KBDLLHOOKSTRUCT));
Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) &KeyboardLlData); Result = Proc(Common->Code, Common->wParam, (LPARAM) &KeyboardLlData);
break; break;
case WH_MOUSE_LL: case WH_MOUSE_LL:
//ERR("WH_MOUSE_LL: Code %d, wParam %d\n",Common->Code,Common->wParam); //ERR("WH_MOUSE_LL: Code %d, wParam %d\n",Common->Code,Common->wParam);
pMouseLlData = (PMSLLHOOKSTRUCT)((PCHAR) Common + Common->lParam); pMouseLlData = (PMSLLHOOKSTRUCT)((PCHAR) Common + Common->lParam);
RtlCopyMemory(&MouseLlData, pMouseLlData, sizeof(MSLLHOOKSTRUCT)); RtlCopyMemory(&MouseLlData, pMouseLlData, sizeof(MSLLHOOKSTRUCT));
Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) &MouseLlData); Result = Proc(Common->Code, Common->wParam, (LPARAM) &MouseLlData);
break; break;
case WH_MOUSE: /* SEH support */ case WH_MOUSE: /* SEH support */
pMHook = (PMOUSEHOOKSTRUCT)((PCHAR) Common + Common->lParam); pMHook = (PMOUSEHOOKSTRUCT)((PCHAR) Common + Common->lParam);
_SEH2_TRY _SEH2_TRY
{ {
Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) pMHook); Result = Proc(Common->Code, Common->wParam, (LPARAM) pMHook);
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{ {
@ -683,7 +705,7 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
pCWP->lParam); pCWP->lParam);
pCWP->lParam = (LPARAM)((PCHAR)pCWP + sizeof(CWPSTRUCT)); pCWP->lParam = (LPARAM)((PCHAR)pCWP + sizeof(CWPSTRUCT));
} }
Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) pCWP); Result = Proc(Common->Code, Common->wParam, (LPARAM) pCWP);
HeapFree(GetProcessHeap(), 0, pCWP); HeapFree(GetProcessHeap(), 0, pCWP);
break; break;
case WH_CALLWNDPROCRET: case WH_CALLWNDPROCRET:
@ -697,7 +719,7 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
pCWPR->lParam); pCWPR->lParam);
pCWPR->lParam = (LPARAM)((PCHAR)pCWPR + sizeof(CWPRETSTRUCT)); pCWPR->lParam = (LPARAM)((PCHAR)pCWPR + sizeof(CWPRETSTRUCT));
} }
Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) pCWPR); Result = Proc(Common->Code, Common->wParam, (LPARAM) pCWPR);
HeapFree(GetProcessHeap(), 0, pCWPR); HeapFree(GetProcessHeap(), 0, pCWPR);
break; break;
case WH_MSGFILTER: /* All SEH support */ case WH_MSGFILTER: /* All SEH support */
@ -709,7 +731,7 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
// ERR("pMsg %d pcMsg %d\n",pMsg->message, pcMsg->message); // ERR("pMsg %d pcMsg %d\n",pMsg->message, pcMsg->message);
_SEH2_TRY _SEH2_TRY
{ {
Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) pcMsg); Result = Proc(Common->Code, Common->wParam, (LPARAM) pcMsg);
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{ {
@ -722,12 +744,12 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
break; break;
case WH_KEYBOARD: case WH_KEYBOARD:
case WH_SHELL: case WH_SHELL:
Result = Common->Proc(Common->Code, Common->wParam, Common->lParam); Result = Proc(Common->Code, Common->wParam, Common->lParam);
break; break;
case WH_FOREGROUNDIDLE: /* <-- SEH support */ case WH_FOREGROUNDIDLE: /* <-- SEH support */
_SEH2_TRY _SEH2_TRY
{ {
Result = Common->Proc(Common->Code, Common->wParam, Common->lParam); Result = Proc(Common->Code, Common->wParam, Common->lParam);
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{ {
@ -736,12 +758,14 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
_SEH2_END; _SEH2_END;
break; break;
default: default:
if (mod) FreeLibrary(mod);
return ZwCallbackReturn(NULL, 0, STATUS_NOT_SUPPORTED); return ZwCallbackReturn(NULL, 0, STATUS_NOT_SUPPORTED);
} }
if (Hit) if (Hit)
{ {
ERR("Hook Exception! Id: %d, Code %d, Proc 0x%x\n",Common->HookId,Common->Code,Common->Proc); ERR("Hook Exception! Id: %d, Code %d, Proc 0x%x\n",Common->HookId,Common->Code,Proc);
} }
if (mod) FreeLibrary(mod);
return ZwCallbackReturn(&Result, sizeof(LRESULT), STATUS_SUCCESS); return ZwCallbackReturn(&Result, sizeof(LRESULT), STATUS_SUCCESS);
} }