layout: post
title: 研究spy++如何獲取窗口的WndProc回調(diào)地址
categories: Reverse_Engineering
description: 研究spy++如何獲取窗口的WndProc回調(diào)地址
keywords:
url: https://lichao890427.github.io/ https://github.com/lichao890427/

背景

??該題目源于網(wǎng)上一段提問蝇率，提問者問：每個窗口都有其回調(diào)函數(shù)WndProc用于處理消息连舍，然而如果獲取其他進(jìn)程的窗口信息棚唆，通過GetWindowLong僅能獲取到除了WndProc以外的參數(shù)，唯獨WndProc獲取不了初嘹，然而為何Spy++可以柏蘑？是通過HWND對應(yīng)的內(nèi)核結(jié)構(gòu)獲取到的嗎磁椒？（內(nèi)核驅(qū)動我不懂走越，懂得大哥說說）

源碼

??經(jīng)過實驗我發(fā)現(xiàn)確實不能用GetWindowLong獲取到該參數(shù)GWL_WNDPROC，于是我決定研究一下Spy++贩耐，弄了一天終于研究出來了弧腥。分析表明Spy++采取了Windows自帶Hook功能獲取一些特殊窗口參數(shù)，關(guān)鍵代碼在spyxxhk.dll的SpyxxGetMsgProc函數(shù)中潮太。試驗方法是：隨便用spy++查找一個窗口管搪，右鍵查看窗口屬性，看常規(guī)選項卡中“窗口進(jìn)程”的結(jié)果铡买，例如00417912更鲁，之后用WinHex打開Spyxx.exe進(jìn)程的SPYXXHK.DLL模塊，搜索該數(shù)據(jù)奇钞，發(fā)現(xiàn)在6D325C44處澡为，使用IDA附加該進(jìn)程，查看該處地址為一變量景埃，查看引用可知SpyxxGetMsgProc中對其進(jìn)行了修改媒至。接下來看Spyxx.exe對該函數(shù)的調(diào)用，可以分析出如下代碼：

HMODULE spyhkmod;  
HHOOK getmsghook;  
HHOOK callwndprochook;  
HHOOK callwndprocrethook;  
extern HHOOK _ghhkMsgHook;//dll導(dǎo)出變量谷徙，對應(yīng)getmsghook  
extern HHOOK _ghhkCallHook;//dll導(dǎo)出變量拒啰，對應(yīng)callwndprochook  
extern HHOOK _ghhkRetHook;//dll導(dǎo)出變量，對應(yīng)callwndprocrethook  
   
void SetMsgHook(BOOL Enable)  
{  
    if(Enable)//hook  
    {  
        if(!spyhkmod)  
        {  
            spyhkmod=GetModuleHandle(_T("SpyxxHk"));  
            if(!spyhkmod)  
                return;  
        }  
        if(!getmsghook)  
        {  
            getmsghook=SetWindowsHookEx(WH_GETMESSAGE,SpyxxGetMsgProc,spyhkmod,0);  
            if(!getmsghook)  
            {  
                CString text,caption;  
                text.LoadString(113);//Cannot set the WH_GETMESSAGE hook.  Message logging is inoperable.  
                caption.LoadString(1);//Microsoft Spy++  
                MessageBox(NULL,text,caption,MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL);  
                return;  
            }  
            _ghhkMsgHook=getmsghook;  
        }  
        if(!callwndprochook)  
        {  
            callwndprochook=SetWindowsHookEx(WH_CALLWNDPROC,SpyxxCallWndProc,spyhkmod,0);  
            if(!callwndprochook)  
            {  
                CString text,caption;  
                text.LoadString(114);//Cannot set the WH_CALLWNDPROC hook.  Message logging is inoperable.  
                caption.LoadString(1);//Microsoft Spy++  
                MessageBox(NULL,text,caption,MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL);  
                UnhookWindowsHookEx(getmsghook);  
                return;  
            }  
            _ghhkCallHook=callwndprochook;  
        }  
        if(!callwndprocrethook)  
        {  
            callwndprocrethook=SetWindowsHookEx(WH_CALLWNDPROCRET,SpyxxCallWndRetProc,spyhkmod,0);  
            if(!callwndprocrethook)  
            {  
                CString text,caption;  
                text.LoadString(115);//,Cannot set the WH_CALLWNDPROCRET hook.  Message logging is inoperable.  
                caption.LoadString(1);//Microsoft Spy++  
                MessageBox(NULL,text,caption,MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL);  
                UnhookWindowsHookEx(getmsghook);  
                UnhookWindowsHookEx(callwndprochook);  
                return;  
            }  
            _ghhkRetHook=callwndprocrethook;  
        }  
    }  
    else//unhook  
    {  
        if(getmsghook)  
        {  
            UnhookWindowsHookEx(getmsghook);  
            getmsghook=NULL;  
        }  
        if(callwndprochook)  
        {  
            UnhookWindowsHookEx(callwndprochook);  
            callwndprochook=NULL;  
        }  
        //還有一個沒有unhook呢完慧？bug谋旦？  
    }  
}  
   
HWND hWnd;  
HANDLE hWriterMutex,hAccessMutex,hReadEvent,hWrittenEvent,hOtherAccessMutex,hOtherDataEvent;  
void HookMain(void* param)  
{  
    hWriterMutex = CreateMutexW(0, 0, L"Local\\Spy++ Writer Mutex");  
    hAccessMutex = CreateMutexW(0, 0, L"Local\\Spy++ Access Mutex");  
    hReadEvent = CreateEventW(0, 0, 1, L"Local\\Spy++ Read Event");  
    hWrittenEvent = CreateEventW(0, 0, 0, L"Local\\Spy++ Written Event");  
    hOtherAccessMutex = CreateMutexW(0, 0, L"Local\\Spy++ Other Process Access Mutex");  
    hOtherDataEvent = CreateEventW(0, 0, 0, L"Local\\Spy++ Other Process Data Event");  
    PSECURITY_DESCRIPTOR sd=NULL;  
    if(ConvertStringSecurityDescriptorToSecurityDescriptor(  
        _T("D:(A;;GA;;;WD)(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;AN)(A;;GA;;;RC)(A;;GA;;;S-1-15-2-1)"),  
        SDDL_REVISION_1,&sd,NULL))  
    {  
        PACL pDacl;  
        BOOL bDaclPresent;  
        BOOL bDaclDefaulted;  
        if(GetSecurityDescriptorDacl(sd,&bDaclPresent,&pDacl,&bDaclDefaulted))  
        {  
            SetSecurityInfo(hWriterMutex,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);  
            SetSecurityInfo(hAccessMutex,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);  
            SetSecurityInfo(hReadEvent,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);  
            SetSecurityInfo(hWrittenEvent,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);  
            SetSecurityInfo(hOtherAccessMutex,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);  
            SetSecurityInfo(hOtherDataEvent,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);  
        }  
        LocalFree(sd);  
    }  
    if(ConvertStringSecurityDescriptorToSecurityDescriptor(_T("S:(ML;;NW;;;LW)"),SDDL_REVISION_1,&sd,NULL))  
    {  
        PACL pSacl;  
        BOOL bDaclPresent;  
        BOOL bDaclDefaulted;  
        if(GetSecurityDescriptorDacl(sd,&bDaclPresent,&pSacl,&bDaclDefaulted))  
        {  
            SetSecurityInfo(hWriterMutex,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);  
            SetSecurityInfo(hAccessMutex,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);  
            SetSecurityInfo(hReadEvent,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);  
            SetSecurityInfo(hWrittenEvent,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);  
            SetSecurityInfo(hOtherAccessMutex,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);  
            SetSecurityInfo(hOtherDataEvent,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);  
        }  
        LocalFree(sd);  
    }  
    //.........  
    SetMsgHook(TRUE);  
    //........  
}  
void WINAPI CreateHookThread()  
{  
    //.........  
    _beginthread(HookMain,0x10000,hWnd);  
    //.........  
}  
int CSpyApp::InitInstance()  
{  
    //.........  
    CreateHookThread();  
    //.........  
}  
BOOL gfHookEnabled,gfHookDisabled;  
DWORD _gpidSpyxx;  
LRESULT WINAPI SpyxxCallWndProc(int nCode, WPARAM wParam, LPARAM lParam)  
{  
    LRESULT ret=CallNextHookEx(_ghhkCallHook,nCode,wParam,lParam);  
    CWPSTRUCT* cwp=(CWPSTRUCT*)lParam;  
    if(gfHookEnabled && !gfHookDisabled && nCode == HC_ACTION && cwp && cwp->hwnd)  
    {      
         DWORD procid;  
        DWORD id=GetWindowThreadProcessId(cwp->hwnd,&procid);  
        if(procid != _gpidSpyxx && id != _gpidSpyxx && GetCurrentThreadId() != _gpidSpyxx)  
            func(1,0,cwp->hwnd,cwp->message,cwp->wParam,cwp->lParam,0,0,0);  
    }  
    return ret;  
}  
LRESULT WINAPI SpyxxCallWndRetProc(int nCode, WPARAM wParam, LPARAM lParam)  
{  
    LRESULT ret=CallNextHookEx(_ghhkRetHook,nCode,wParam,lParam);  
    CWPRETSTRUCT* cwp=(CWPRETSTRUCT*)lParam;  
    if(gfHookEnabled && !gfHookDisabled && nCode == HC_ACTION && cwp && cwp->hwnd)  
    {      
         DWORD procid;  
        DWORD id=GetWindowThreadProcessId(cwp->hwnd,&procid);  
        if(procid != _gpidSpyxx && id != _gpidSpyxx && GetCurrentThreadId() != _gpidSpyxx)  
            func(2,cwp->lResult,cwp->hwnd,cwp->message,cwp->wParam,cwp->lParam,0,0,0);  
    }  
    return ret;  
}  
UINT gmsgOtherProcessData;  
HWND gopd;//目標(biāo)進(jìn)程窗口句柄，exe在OnIdle例程中修改該處  
DWORD goproc;//目標(biāo)窗口回調(diào)函數(shù)地址  
WNDCLASS WndClass;  
LRESULT WINAPI SpyxxGetMsgProc(int nCode, WPARAM wParam, LPARAM lParam)  
{  
    MSG* msg=(MSG*)lParam;  
    if(nCode == HC_ACTION && (wParam&PM_REMOVE) && msg && msg->hwnd)  
    {  
        if(msg->message == gmsgOtherProcessData)  
        {  
            if(msg->hwnd == gopd && hAccessMutex && !WaitForSingleObject(hAccessMutex,1000))  
            {  
                TCHAR ClassName[128];  
                GetClassName(msg->hwnd,ClassName,128);  
                if(IsWindowUnicode(msg->hwnd))  
                    goproc=GetWindowLongW(msg->hwnd,GWL_WNDPROC);  
                else 
                    goproc=GetWindowLongA(msg->hwnd,GWL_WNDPROC);  
                if(GetClassInfoW(NULL,ClassName,&WndClass))  
                {  
                    if(WndClass.lpszMenuName) {/*...............*/};  
                    if(IsWindowUnicode(msg->hwnd))  
                        WndClass.lpfnWndProc=(WNDPROC)GetClassLongW(msg->hwnd,GCL_WNDPROC);  
                }  
                //..............  
                msg->message=0;  
                msg->wParam=0;  
                msg->lParam=0;  
            }  
        }  
        else if(gfHookEnabled && !gfHookDisabled)  
        {  
            DWORD procid;  
            DWORD id=GetWindowThreadProcessId(msg->hwnd,&procid);  
            if(procid != _gpidSpyxx && id != _gpidSpyxx && GetCurrentThreadId() != _gpidSpyxx)  
                func(0,0,msg->hwnd,msg->message,msg->wParam,msg->lParam,msg->time,msg->pt.x,msg->pt.y);  
        }  
    }  
    return CallNextHookEx(_ghhkMsgHook,nCode,wParam,lParam);  
} 

結(jié)論

??可以分析出，spy++通過windows hook方式注入相關(guān)功能到目標(biāo)進(jìn)程册着，從而實現(xiàn)自己的目的拴孤。Window編寫hook時是要把函數(shù)放在專門的dll中，hook后所有程序都會自動加載該dll