基于VEH&调试寄存器实现无痕HOOK(5)

作者 | 榴莲

编辑 | 楌橪

 

WindowsVEHVectoredExceptionHandler使VEHHOOKVEHSEHHOOKVEH西ESPHOOKHOOKHOOK,

使int 3 0xCCHOOK

CRC32int3 VEHHOOK

HOOK

Intel

DR0 - DR3线CPU线

DR4DR5CR4DE1DR4DR5#UDDR4DR5DR6DR7

DR7

R/W0 - R/W3  DR0-DR3访

00

01

10CR4DEI/O

11访

LEN0 - LEN3  DR0-DR3

001

012

108

114

R/W000

L0-L3  DR0-DR310

G0-G3  DR0-DR310CPU

LEGE CPU486

GD访GD1CPUDR

DR6

B0-B3 DR0-DR3B01R/W0 len0 DR0

BD DR7GDCPUDRBD1#DB

BS  EFLAGSTF1

BT  TSSTTSST1

HOOKMessageBoxAHOOK

Windows 10 20H219042.1288Visual Studio 2017DLL

1.

2Windows->DLL

3#include pch.h,#include <Windows.h>framework.hpch.hpch.cpp

4

4.1 

4.2 Spectre

4.3 

5.   breakDLL

6.使AddVectoredExceptionHandlerVEHVEHAddVectoredExceptionHandlerVEH0VEH0VEHAddVectoredExceptionHandler

6.1AddVectoredExceptionHandlerF12

6.2F12

6.3typedef

6.4DLL_PROCESS_ATTACH

6.   MessageBoxA

 

7.   HOOK

8.   线HOOK线

9.   DLL_PROCESS_ATTACHHOOK

10.  线线SetThreadHook线HOOK

11.  HOOKHOOK

12.HOOK

EIP + 2x86

0xCC8B8BFFmov edi,edi,

12.  HOOKHOOKHOOK

13.

14.

15.HOOK

15.1

15.2使

 

HOOK

HOOK