admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
hakril-PythonForWindows/docs/build/html/iat_hook.html
T
hakril 8fa8cf9be1 Regenerating documentation for 1.0.4
2025-08-14 10:37:06 +02:00

259 lines
20 KiB
HTML
Raw Permalink Blame History

<!DOCTYPE html>
<html lang="en" data-content_root="./">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>15. IAT hooking &#8212; PythonForWindows 1.0.4 documentation</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="_static/classic.css?v=def86cc0" />
<link rel="stylesheet" type="text/css" href="_static/css/mbasic.css?v=957880af" />
<script src="_static/documentation_options.js?v=71272d9f"></script>
<script src="_static/doctools.js?v=9a2dae69"></script>
<script src="_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="16. Early Work In Progress" href="wip.html" />
<link rel="prev" title="14.7. Interfaces" href="interfaces_generated.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="wip.html" title="16. Early Work In Progress"
accesskey="N">next</a> |</li>
<li class="right" >
<a href="interfaces_generated.html" title="14.7. Interfaces"
accesskey="P">previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.4 documentation</a> &#187;</li>
<li class="nav-item nav-item-this"><a href=""><span class="section-number">15. </span>IAT hooking</a></li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="iat-hooking">
<h1><span class="section-number">15. </span>IAT hooking<a class="headerlink" href="#iat-hooking" title="Link to this heading"></a></h1>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-iat-hook"><span class="std std-ref">IAT hooking</span></a></p>
</div>
<section id="putting-an-iat-hook">
<h2><span class="section-number">15.1. </span>Putting an IAT hook<a class="headerlink" href="#putting-an-iat-hook" title="Link to this heading"></a></h2>
<p>To setup your IAT hook you just need:</p>
<blockquote>
<div><ul class="simple">
<li><p>A callback that respect the <a class="reference internal" href="#hook-protocol"><span class="std std-ref">Hook protocol</span></a></p></li>
<li><p>The <a class="reference internal" href="process.html#windows.pe_parse.IATEntry" title="windows.pe_parse.IATEntry"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.pe_parse.IATEntry</span></code></a> to hook</p></li>
</ul>
</div></blockquote>
<p>You just need to use the function <a class="reference internal" href="process.html#windows.pe_parse.IATEntry.set_hook" title="windows.pe_parse.IATEntry.set_hook"><code class="xref py py-func docutils literal notranslate"><span class="pre">windows.pe_parse.IATEntry.set_hook()</span></code></a></p>
<p>Putting a hook:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">from</span> <span class="nn">windows.hooks</span> <span class="kn">import</span> <span class="o">*</span>
<span class="nd">@CreateFileACallback</span>
<span class="k">def</span> <span class="nf">createfile_callback</span><span class="p">(</span><span class="n">lpFileName</span><span class="p">,</span> <span class="n">dwDesiredAccess</span><span class="p">,</span> <span class="n">dwShareMode</span><span class="p">,</span> <span class="n">lpSecurityAttributes</span><span class="p">,</span> <span class="n">dwCreationDisposition</span><span class="p">,</span> <span class="n">dwFlagsAndAttributes</span><span class="p">,</span> <span class="n">hTemplateFile</span><span class="p">,</span> <span class="n">real_function</span><span class="p">):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Trying to open </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lpFileName</span><span class="p">))</span>
<span class="k">if</span> <span class="s2">&quot;secret&quot;</span> <span class="ow">in</span> <span class="n">lpFileName</span><span class="p">:</span>
<span class="k">return</span> <span class="mh">0xffffffff</span>
<span class="k">return</span> <span class="n">real_function</span><span class="p">()</span>
<span class="n">my_exe</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
<span class="n">imp</span> <span class="o">=</span> <span class="n">my_exe</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">imports</span>
<span class="n">iat_create_file</span> <span class="o">=</span> <span class="p">[</span><span class="n">entry</span> <span class="k">for</span> <span class="n">entry</span> <span class="ow">in</span> <span class="n">imp</span><span class="p">[</span><span class="s1">&#39;kernel32.dll&#39;</span><span class="p">]</span> <span class="k">if</span> <span class="n">entry</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">&quot;CreateFileA&quot;</span><span class="p">]</span>
<span class="n">iat_create_file</span><span class="o">.</span><span class="n">set_hook</span><span class="p">(</span><span class="n">createfile_callback</span><span class="p">)</span>
</pre></div>
</div>
</section>
<section id="hook-protocol">
<span id="id1"></span><h2><span class="section-number">15.2. </span>Hook protocol<a class="headerlink" href="#hook-protocol" title="Link to this heading"></a></h2>
<section id="callback-arguments">
<h3><span class="section-number">15.2.1. </span>Callback arguments<a class="headerlink" href="#callback-arguments" title="Link to this heading"></a></h3>
<p>A hook callback must have the same number of argument as the hooked API, PLUS a last argument <code class="docutils literal notranslate"><span class="pre">real_function</span></code>.</p>
<p>The <code class="docutils literal notranslate"><span class="pre">real_function</span></code> argument is a callable that represent the hooked API, it can be called in two ways:</p>
<blockquote>
<div><ul class="simple">
<li><p>Without argument, the call will be done with the argument originaly passed to your callback. This allows simple redirection to the real API.</p></li>
<li><p>With arguments it will simply call the API with these.</p></li>
</ul>
</div></blockquote>
<p>Example:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">createfile_callback</span><span class="p">(</span><span class="n">lpFileName</span><span class="p">,</span> <span class="n">dwDesiredAccess</span><span class="p">,</span> <span class="n">dwShareMode</span><span class="p">,</span> <span class="n">lpSecurityAttributes</span><span class="p">,</span> <span class="n">dwCreationDisposition</span><span class="p">,</span> <span class="n">dwFlagsAndAttributes</span><span class="p">,</span> <span class="n">hTemplateFile</span><span class="p">,</span> <span class="n">real_function</span><span class="p">):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Trying to open </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lpFileName</span><span class="p">))</span>
<span class="k">if</span> <span class="s2">&quot;secret&quot;</span> <span class="ow">in</span> <span class="n">lpFileName</span><span class="p">:</span>
<span class="k">return</span> <span class="mh">0xffffffff</span>
<span class="c1"># Perform the real call</span>
<span class="k">return</span> <span class="n">real_function</span><span class="p">()</span>
</pre></div>
</div>
<p>A hook callback must also embed some <a class="reference internal" href="#type-information"><span class="std std-ref">Type Information</span></a></p>
</section>
<section id="callback-type-information">
<span id="type-information"></span><h3><span class="section-number">15.2.2. </span>Callback type information<a class="headerlink" href="#callback-type-information" title="Link to this heading"></a></h3>
<p>In order make the magic behind hook callback, <code class="xref py py-mod docutils literal notranslate"><span class="pre">ctypes</span></code> needs to have type information about the API parameters.</p>
<p>There is (again) two ways to give those informations to your hook callback. Both techniques use a decorator to setup type information to the callback.</p>
<blockquote>
<div><ul>
<li><p>Giving the type manualy using the decorator <a class="reference internal" href="#windows.hooks.Callback" title="windows.hooks.Callback"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.hooks.Callback</span></code></a>:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">windows.hooks</span> <span class="kn">import</span> <span class="o">*</span>
<span class="c1"># First type is return type, others are parameters types</span>
<span class="nd">@Callback</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_ulong</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">exit_callback</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="n">real_function</span><span class="p">):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Try to quit with </span><span class="si">{0}</span><span class="s2"> | </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="nb">type</span><span class="p">(</span><span class="n">x</span><span class="p">)))</span>
<span class="k">if</span> <span class="n">x</span> <span class="o">==</span> <span class="mi">3</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;TRYING TO REAL EXIT&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">real_function</span><span class="p">(</span><span class="mi">1234</span><span class="p">)</span>
<span class="k">return</span> <span class="mh">0x4242424243444546</span>
</pre></div>
</div>
</li>
<li><p>Using the <cite>Callback</cite> decorator generated from known functions:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">windows.hooks</span> <span class="kn">import</span> <span class="o">*</span>
<span class="c1"># Decorator name is always API_NAME + &quot;CallBack&quot;</span>
<span class="nd">@CreateFileACallback</span>
<span class="k">def</span> <span class="nf">createfile_callback</span><span class="p">(</span><span class="n">lpFileName</span><span class="p">,</span> <span class="n">dwDesiredAccess</span><span class="p">,</span> <span class="n">dwShareMode</span><span class="p">,</span> <span class="n">lpSecurityAttributes</span><span class="p">,</span> <span class="n">dwCreationDisposition</span><span class="p">,</span> <span class="n">dwFlagsAndAttributes</span><span class="p">,</span> <span class="n">hTemplateFile</span><span class="p">,</span> <span class="n">real_function</span><span class="p">):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Trying to open </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lpFileName</span><span class="p">))</span>
<span class="k">if</span> <span class="s2">&quot;secret&quot;</span> <span class="ow">in</span> <span class="n">lpFileName</span><span class="p">:</span>
<span class="k">return</span> <span class="mh">0xffffffff</span>
<span class="k">return</span> <span class="n">real_function</span><span class="p">()</span>
</pre></div>
</div>
</li>
</ul>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See the list of known functions</p>
</div>
</div></blockquote>
</section>
</section>
<section id="module-windows.hooks">
<span id="windows-hooks"></span><h2><span class="section-number">15.3. </span><a class="reference internal" href="#module-windows.hooks" title="windows.hooks"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.hooks</span></code></a><a class="headerlink" href="#module-windows.hooks" title="Link to this heading"></a></h2>
<dl class="py class">
<dt class="sig sig-object py" id="windows.hooks.Callback">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.hooks.</span></span><span class="sig-name descname"><span class="pre">Callback</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="o"><span class="pre">*</span></span><span class="n"><span class="pre">types</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/hooks.html#Callback"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.hooks.Callback" title="Link to this definition"></a></dt>
<dd><p>Give type information to hook callback</p>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.hooks.IATHook">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.hooks.</span></span><span class="sig-name descname"><span class="pre">IATHook</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">IAT_entry</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">callback</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">types</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/hooks.html#IATHook"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.hooks.IATHook" title="Link to this definition"></a></dt>
<dd><p>Look at my hook &lt;3</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.hooks.IATHook.disable">
<span class="sig-name descname"><span class="pre">disable</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/hooks.html#IATHook.disable"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.hooks.IATHook.disable" title="Link to this definition"></a></dt>
<dd><p>Disable the IAT hook</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.hooks.IATHook.enable">
<span class="sig-name descname"><span class="pre">enable</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/hooks.html#IATHook.enable"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.hooks.IATHook.enable" title="Link to this definition"></a></dt>
<dd><p>Enable the IAT hook: you MUST keep a reference to the IATHook while the hook is enabled</p>
</dd></dl>
</dd></dl>
</section>
</section>
<div class="clearer"></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<div>
<h3><a href="index.html">Table of Contents</a></h3>
<ul>
<li><a class="reference internal" href="#">15. IAT hooking</a><ul>
<li><a class="reference internal" href="#putting-an-iat-hook">15.1. Putting an IAT hook</a></li>
<li><a class="reference internal" href="#hook-protocol">15.2. Hook protocol</a><ul>
<li><a class="reference internal" href="#callback-arguments">15.2.1. Callback arguments</a></li>
<li><a class="reference internal" href="#callback-type-information">15.2.2. Callback type information</a></li>
</ul>
</li>
<li><a class="reference internal" href="#module-windows.hooks">15.3. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.hooks</span></code></a><ul>
<li><a class="reference internal" href="#windows.hooks.Callback"><code class="docutils literal notranslate"><span class="pre">Callback</span></code></a></li>
<li><a class="reference internal" href="#windows.hooks.IATHook"><code class="docutils literal notranslate"><span class="pre">IATHook</span></code></a><ul>
<li><a class="reference internal" href="#windows.hooks.IATHook.disable"><code class="docutils literal notranslate"><span class="pre">disable()</span></code></a></li>
<li><a class="reference internal" href="#windows.hooks.IATHook.enable"><code class="docutils literal notranslate"><span class="pre">enable()</span></code></a></li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</div>
<div>
<h4>Previous topic</h4>
<p class="topless"><a href="interfaces_generated.html"
title="previous chapter"><span class="section-number">14.7. </span>Interfaces</a></p>
</div>
<div>
<h4>Next topic</h4>
<p class="topless"><a href="wip.html"
title="next chapter"><span class="section-number">16. </span>Early Work In Progress</a></p>
</div>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="_sources/iat_hook.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="wip.html" title="16. Early Work In Progress"
>next</a> |</li>
<li class="right" >
<a href="interfaces_generated.html" title="14.7. Interfaces"
>previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.4 documentation</a> &#187;</li>
<li class="nav-item nav-item-this"><a href=""><span class="section-number">15. </span>IAT hooking</a></li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015-2020, Clement Rouault.
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.3.7.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink