recreate project as DLL

This commit is contained in:
2017-12-26 15:20:04 +01:00
parent 357d3178aa
commit 51118baca8
14 changed files with 103 additions and 61 deletions

View File

@@ -3,7 +3,7 @@ Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 14 # Visual Studio 14
VisualStudioVersion = 14.0.25420.1 VisualStudioVersion = 14.0.25420.1
MinimumVisualStudioVersion = 10.0.40219.1 MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hook_tests", "hook_tests\hook_tests.vcxproj", "{81248D42-942D-422C-B2B9-E4A94FAAEBAE}" Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "test_cases", "test_cases\test_cases.vcxproj", "{8C444ABC-D25C-4B44-8F27-081B464D9AE4}"
EndProject EndProject
Global Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution GlobalSection(SolutionConfigurationPlatforms) = preSolution
@@ -13,14 +13,14 @@ Global
Release|x86 = Release|x86 Release|x86 = Release|x86
EndGlobalSection EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution GlobalSection(ProjectConfigurationPlatforms) = postSolution
{81248D42-942D-422C-B2B9-E4A94FAAEBAE}.Debug|x64.ActiveCfg = Debug|x64 {8C444ABC-D25C-4B44-8F27-081B464D9AE4}.Debug|x64.ActiveCfg = Debug|x64
{81248D42-942D-422C-B2B9-E4A94FAAEBAE}.Debug|x64.Build.0 = Debug|x64 {8C444ABC-D25C-4B44-8F27-081B464D9AE4}.Debug|x64.Build.0 = Debug|x64
{81248D42-942D-422C-B2B9-E4A94FAAEBAE}.Debug|x86.ActiveCfg = Debug|Win32 {8C444ABC-D25C-4B44-8F27-081B464D9AE4}.Debug|x86.ActiveCfg = Debug|Win32
{81248D42-942D-422C-B2B9-E4A94FAAEBAE}.Debug|x86.Build.0 = Debug|Win32 {8C444ABC-D25C-4B44-8F27-081B464D9AE4}.Debug|x86.Build.0 = Debug|Win32
{81248D42-942D-422C-B2B9-E4A94FAAEBAE}.Release|x64.ActiveCfg = Release|x64 {8C444ABC-D25C-4B44-8F27-081B464D9AE4}.Release|x64.ActiveCfg = Release|x64
{81248D42-942D-422C-B2B9-E4A94FAAEBAE}.Release|x64.Build.0 = Release|x64 {8C444ABC-D25C-4B44-8F27-081B464D9AE4}.Release|x64.Build.0 = Release|x64
{81248D42-942D-422C-B2B9-E4A94FAAEBAE}.Release|x86.ActiveCfg = Release|Win32 {8C444ABC-D25C-4B44-8F27-081B464D9AE4}.Release|x86.ActiveCfg = Release|Win32
{81248D42-942D-422C-B2B9-E4A94FAAEBAE}.Release|x86.Build.0 = Release|Win32 {8C444ABC-D25C-4B44-8F27-081B464D9AE4}.Release|x86.Build.0 = Release|Win32
EndGlobalSection EndGlobalSection
GlobalSection(SolutionProperties) = preSolution GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE HideSolutionNode = FALSE

View File

@@ -6,8 +6,10 @@ engines (on windows) are. I'll try to write various functions, that are hard to
patch and then see how each hooking engine does. patch and then see how each hooking engine does.
I'll test: I'll test:
* [EasyHook]() * [EasyHook](https://easyhook.github.io/)
* [PolyHook]() * [PolyHook](https://github.com/stevemk14ebr/PolyHook)
* [MinHook](https://www.codeproject.com/Articles/44326/MinHook-The-Minimalistic-x-x-API-Hooking-Libra)
* [Mhook](http://codefromthe70s.org/mhook24.aspx)
(I'd like to test detours, but I'm not willing to pay for it. So that isn't (I'd like to test detours, but I'm not willing to pay for it. So that isn't
tested :( ) tested :( )
@@ -19,13 +21,17 @@ some self protection features (or other software on the system provides that,
e.g. Trustee Rapport) e.g. Trustee Rapport)
Evaluating how the hooking engines stack up against that is not the goal here. Evaluating how the hooking engines stack up against that is not the goal here.
This is just about the challenges the function to be hooked itself poses. Neither are non-functional criteria, like how fast it is or how much memory it
needs for each hook. This is just about the challenges the function to be
hooked itself poses.
Namely: Namely:
* Are jumps relocated? * Are jumps relocated?
* What about RIP adressing? * What about RIP adressing?
* If it's a tail recurisve function, does the hooking engine handle it? * If there's a loop at the beginning / if it's a tail recurisve function, does
the hooking engine handle it?
* How good is the dissassembler, how many instructions does it know? * How good is the dissassembler, how many instructions does it know?
* Can it hook already hooked functions?
Test cases Test cases
========== ==========

View File

@@ -6,10 +6,10 @@ extern "C" {
* @param num: the number of which the square root shall be taken * @param num: the number of which the square root shall be taken
* @param res: where the 4 results shall be written * @param res: where the 4 results shall be written
*/ */
void _AVX(float num, void* res); void _declspec(dllexport) _AVX(float num, void* res);
/** /**
* Just a wrapper around RDRAND * Just a wrapper around RDRAND
*/ */
uint32_t _RDRAND(void); uint32_t _declspec(dllexport) _RDRAND(void);
} }

7
test_cases/assemble.ps1 Normal file
View File

@@ -0,0 +1,7 @@
$fasm = "U:\fasm\fasm.exe"
$files = gci -r -File | where {$_.extension -eq ".asm"}
Foreach ($i in $files)
{
Write-Host $i.Name
& $fasm $i.Name
}

View File

@@ -6,12 +6,12 @@ extern "C" {
* @param num * @param num
* @param cnt * @param cnt
*/ */
uint32_t _loop(uint32_t num, uint32_t cnt); uint32_t _declspec(dllexport) _loop(uint32_t num, uint32_t cnt);
/** /**
* Computes factorial * Computes factorial
* *
* @param x * @param x
*/ */
uint32_t _tail_recursion(uint32_t x); uint32_t _declspec(dllexport) _tail_recursion(uint32_t x);
} }

View File

@@ -1,11 +1,19 @@
#include <stdint.h> #include <stdint.h>
#include <iostream> #include <iostream>
#define CATCH_CONFIG_MAIN #define CATCH_CONFIG_RUNNER
#include "catch.hpp" #include "catch.hpp"
#include "simple_tests.h" #include "test_cases.h"
#include "advanced_instructions.h"
#include "backwards.h" /*#pragma comment(lib, "advanced_instructions.obj")
#pragma comment(lib, "simple_tests.obj")
#pragma comment(lib, "backwards.obj")*/
static Catch::Session session;
_declspec(dllexport) void SelfTest() {
session.run();
}
TEST_CASE("Simple functions work as expected, unhooked") { TEST_CASE("Simple functions work as expected, unhooked") {
REQUIRE(_small() == 0); REQUIRE(_small() == 0);

View File

@@ -3,7 +3,7 @@ extern "C" {
/** /**
* A small function, that always returns 0 * A small function, that always returns 0
*/ */
uint64_t _small(void); uint64_t _declspec(dllexport) _small(void);
/** /**
* This function checks if the parameter is even or odd, and then * This function checks if the parameter is even or odd, and then
@@ -14,7 +14,7 @@ extern "C" {
* *
* @param Number to be checked * @param Number to be checked
*/ */
uint64_t _branch(uint64_t); uint64_t _declspec(dllexport) _branch(uint64_t);
/** /**
* Replicates the MSVCRT rand(). * Replicates the MSVCRT rand().
@@ -27,5 +27,5 @@ extern "C" {
* return( ((seed = seed * 214013L * return( ((seed = seed * 214013L
* + 2531011L) >> 16) & 0x7fff ); * + 2531011L) >> 16) & 0x7fff );
*/ */
uint64_t _rip_relative(void); uint64_t _declspec(dllexport) _rip_relative(void);
}; };

6
test_cases/test_cases.h Normal file
View File

@@ -0,0 +1,6 @@
#pragma once
#include "simple_tests.h"
#include "backwards.h"
#include "advanced_instructions.h"
_declspec(dllexport) void SelfTest();

View File

@@ -19,33 +19,33 @@
</ProjectConfiguration> </ProjectConfiguration>
</ItemGroup> </ItemGroup>
<PropertyGroup Label="Globals"> <PropertyGroup Label="Globals">
<ProjectGuid>{81248D42-942D-422C-B2B9-E4A94FAAEBAE}</ProjectGuid> <ProjectGuid>{8C444ABC-D25C-4B44-8F27-081B464D9AE4}</ProjectGuid>
<Keyword>Win32Proj</Keyword> <Keyword>Win32Proj</Keyword>
<RootNamespace>hook_tests</RootNamespace> <RootNamespace>test_cases</RootNamespace>
<WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion> <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
</PropertyGroup> </PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType> <ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries> <UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v140</PlatformToolset> <PlatformToolset>v140</PlatformToolset>
<CharacterSet>Unicode</CharacterSet> <CharacterSet>Unicode</CharacterSet>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType> <ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries> <UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v140</PlatformToolset> <PlatformToolset>v140</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization> <WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet> <CharacterSet>Unicode</CharacterSet>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType> <ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries> <UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v140</PlatformToolset> <PlatformToolset>v140</PlatformToolset>
<CharacterSet>Unicode</CharacterSet> <CharacterSet>Unicode</CharacterSet>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType> <ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries> <UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v140</PlatformToolset> <PlatformToolset>v140</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization> <WholeProgramOptimization>true</WholeProgramOptimization>
@@ -87,11 +87,11 @@
</PrecompiledHeader> </PrecompiledHeader>
<WarningLevel>Level3</WarningLevel> <WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization> <Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;TEST_CASES_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<SDLCheck>true</SDLCheck> <SDLCheck>true</SDLCheck>
</ClCompile> </ClCompile>
<Link> <Link>
<SubSystem>Console</SubSystem> <SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation> <GenerateDebugInformation>true</GenerateDebugInformation>
</Link> </Link>
</ItemDefinitionGroup> </ItemDefinitionGroup>
@@ -101,11 +101,11 @@
</PrecompiledHeader> </PrecompiledHeader>
<WarningLevel>Level3</WarningLevel> <WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization> <Optimization>Disabled</Optimization>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>_DEBUG;_WINDOWS;_USRDLL;TEST_CASES_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<SDLCheck>true</SDLCheck> <SDLCheck>true</SDLCheck>
</ClCompile> </ClCompile>
<Link> <Link>
<SubSystem>Console</SubSystem> <SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation> <GenerateDebugInformation>true</GenerateDebugInformation>
</Link> </Link>
</ItemDefinitionGroup> </ItemDefinitionGroup>
@@ -117,11 +117,11 @@
<Optimization>MaxSpeed</Optimization> <Optimization>MaxSpeed</Optimization>
<FunctionLevelLinking>true</FunctionLevelLinking> <FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions> <IntrinsicFunctions>true</IntrinsicFunctions>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;TEST_CASES_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<SDLCheck>true</SDLCheck> <SDLCheck>true</SDLCheck>
</ClCompile> </ClCompile>
<Link> <Link>
<SubSystem>Console</SubSystem> <SubSystem>Windows</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding> <EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences> <OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation> <GenerateDebugInformation>true</GenerateDebugInformation>
@@ -135,31 +135,40 @@
<Optimization>MaxSpeed</Optimization> <Optimization>MaxSpeed</Optimization>
<FunctionLevelLinking>true</FunctionLevelLinking> <FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions> <IntrinsicFunctions>true</IntrinsicFunctions>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>NDEBUG;_WINDOWS;_USRDLL;TEST_CASES_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<SDLCheck>true</SDLCheck> <SDLCheck>true</SDLCheck>
</ClCompile> </ClCompile>
<Link> <Link>
<SubSystem>Console</SubSystem> <SubSystem>Windows</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding> <EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences> <OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation> <GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>backwards.obj;simple_tests.obj;advanced_instructions.obj;%(AdditionalDependencies)</AdditionalDependencies>
</Link> </Link>
<PreBuildEvent>
<Command>$(MSBuildProjectDirectory)\assemble.ps</Command>
</PreBuildEvent>
<PreBuildEvent>
<Message>Assemble all .asm files using FASM</Message>
</PreBuildEvent>
</ItemDefinitionGroup> </ItemDefinitionGroup>
<ItemGroup>
<None Include="advanced_instructions.asm" />
<None Include="assemble.ps1" />
<None Include="backwards.asm" />
<None Include="README.md" />
<None Include="simple_tests.asm" />
</ItemGroup>
<ItemGroup> <ItemGroup>
<ClInclude Include="advanced_instructions.h" /> <ClInclude Include="advanced_instructions.h" />
<ClInclude Include="backwards.h" /> <ClInclude Include="backwards.h" />
<ClInclude Include="catch.hpp" /> <ClInclude Include="catch.hpp" />
<ClInclude Include="simple_tests.h" /> <ClInclude Include="simple_tests.h" />
<ClInclude Include="test_cases.h" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<ClCompile Include="main.cpp" /> <ClCompile Include="main.cpp" />
</ItemGroup> </ItemGroup>
<ItemGroup>
<None Include="advanced_instructions.asm" />
<None Include="backwards.asm" />
<None Include="README.md" />
<None Include="simple_tests.asm" />
</ItemGroup>
<ItemGroup> <ItemGroup>
<Object Include="advanced_instructions.obj" /> <Object Include="advanced_instructions.obj" />
<Object Include="backwards.obj" /> <Object Include="backwards.obj" />

View File

@@ -15,16 +15,34 @@
</Filter> </Filter>
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<None Include="assemble.ps1">
<Filter>Source Files</Filter>
</None>
<None Include="advanced_instructions.asm">
<Filter>Source Files</Filter>
</None>
<None Include="backwards.asm">
<Filter>Source Files</Filter>
</None>
<None Include="simple_tests.asm">
<Filter>Source Files</Filter>
</None>
<None Include="README.md" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="advanced_instructions.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="backwards.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="catch.hpp"> <ClInclude Include="catch.hpp">
<Filter>Header Files</Filter> <Filter>Header Files</Filter>
</ClInclude> </ClInclude>
<ClInclude Include="simple_tests.h"> <ClInclude Include="simple_tests.h">
<Filter>Header Files</Filter> <Filter>Header Files</Filter>
</ClInclude> </ClInclude>
<ClInclude Include="advanced_instructions.h"> <ClInclude Include="test_cases.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="backwards.h">
<Filter>Header Files</Filter> <Filter>Header Files</Filter>
</ClInclude> </ClInclude>
</ItemGroup> </ItemGroup>
@@ -34,20 +52,8 @@
</ClCompile> </ClCompile>
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<None Include="simple_tests.asm">
<Filter>Source Files</Filter>
</None>
<None Include="README.md" />
<None Include="advanced_instructions.asm">
<Filter>Source Files</Filter>
</None>
<None Include="backwards.asm">
<Filter>Source Files</Filter>
</None>
</ItemGroup>
<ItemGroup>
<Object Include="simple_tests.obj" />
<Object Include="advanced_instructions.obj" /> <Object Include="advanced_instructions.obj" />
<Object Include="backwards.obj" /> <Object Include="backwards.obj" />
<Object Include="simple_tests.obj" />
</ItemGroup> </ItemGroup>
</Project> </Project>