快捷键        含义
     Ctrl+F2       重新开始调试
     F7            单步步入
     F8            单步步过
     Ctrl+F9       函数内部运行直到retn, 跳出函数
     Ctrl+G        移动到指定位置, 用来查看代码或内存
     F4            执行到光标位置
     ;             添加注释
     :             添加标签
     F2            设置或取消断点
     F9            运行(若设置了断点, 则停到断点处)
     *             显示当前eip(命令指针)位置
     -             显示上一个光标位置
     Enter         若光标处有call/jmp等指令, 则跟踪并显示相关地址
     Ctrl+F7       反复执行Step Into(画面显示)
     Ctrl+F8       反复执行Step Over(画面显示)
     Ctrl+F11      反复执行Step Into(画面不显示)
     Ctrl+F12      反复执行Step Over(画面不显示)

Byte    b       = 0x12
Word    w       = 0x1234
Dword   dw      = 0x12345678
char    str[]   = "abcde"

Name    Size    Big Endian          Little Endian
b       1       [12]                [12]
w       2       [12][34]            [34][12]
dw      4       [12][34][56][78]    [78][56][34][12]
str     6       'a''b''c''d''e'     'a''b''c''d''e'

    push    ebp         ; 函数开始(使用ebp前先保存)
    mov     ebp, esp    ; 把esp的值送到ebp中
    ...                 ; 函数体, 无论esp如何改变, ebp不变
    ...                 ; 以安全地访问局部变量, 参数
    mov     esp, ebp    ; 将函数起始地址返回esp
    pop     ebp         ; 返回前弹出之前保存的ebp
    retn                ; 函数终止

push    argn
push    arg(n-1)
...
push    arg1
calls   func

return_type     _stdcall    function_name(arg1, arg2, ...)

push    ebp
mov     ebp, esp
...
mov     esp, ebp
pop     ebp
retn    xxx     ; 用retn N指令完成栈的清理
                ; cdecl方式中该处为retn指令

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER

typedef struct _IMAGE_NT_HEADERS {
    DWORD                     Signature;        // PE Signature
    IMAGE_FILE_HEADER         FileHeader;
    IMAGE_OPTIONAL_HEADER32   OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

类别          访问权限
code          执行, 读取权限
data          非执行, 读写权限
resource      非执行, 读取权限

#define     IMAGE_SIZEOF_SHORT_NAME     8
typedef struct _IMAGE_SECTION_HEADER {
    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
    union   {
        DWORD   PhysicalAddress;
        DWORD   VirtualSize;
    } Misc;
    DWORD   VirtualAddress;
    DWORD   SizeOfRawData;
    DWORD   PointerToRawData;
    DWORD   PointToRelocations;
    DWORD   PointerToLinenumbers;
    WORD    NumberOfRelocations;
    WORD    NumberOfLinenumbers;
    DWORD   Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER

typedef struct _IMAGE_IMPORT_DESCRIPTOR {
    __C89_NAMELESS union {
        DWORD   Characteristics;    // 0 for terminating null import descriptor
        DWORD   OriginalFirstThunk; // INT(Import Name Table) address (RVA)
    } DUMMYUNIONNAME;
    DWORD       TimeDateStamp;
    DWORD       ForwarderChain;     // -1 if no forwarders
    DWORD       Name;               // library name string address(RVA)
    DWORD       FirstThunk;         // IAT address (RVA)
} IMAGE_IMPORT_DESCRIPTOR;

typedef struct _IMAGE_IMPORT_BY_NAME {
    WORD        Hint;               // ordinal
    BYTE        Name[1];            // function name string 
                                    // In fact it is a variable string ending 
                                    // with 0
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;

typedef struct _IMAGE_EXPORT_DIRECTORY {
    DWORD   Characteristics;        // 未使用, 总为0 

    DWORD   TimeDateStamp;          // 文件创建时间戳
    WORD    MajorVersion;           // 未使用, 总为0 

    WORD    MinorVersion;           // 未使用, 总为0
    DWORD   Name;                   // 指向一个代表此DLL名字的ASCII字符串的RVA
    DWORD   Base;                   // 函数的起始序号
    DWORD   NumberOfFunctions;      // 导出函数的总数
    DWORD   NumberOfNames;          // 以名称方式导出的函数的总数
    DWORD   AddressOfFunctions;     // 指向导出函数地址数组的RVA
                                    // 有NumberOfFunctions个元素
    DWORD   AddressOfNames;         // 指向导出函数名字数组的RVA
                                    // 有NumberOfNames个元素
    DWORD   AddressOfNameOrdinals;  // 指向导出函数序号数组的RVA
                                    // 有NumberOfNames个元素
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

// HookMain.cpp

#include    "stdio.h"
#include    "conio.h"
#include    "windows.h"

#define     DEF_DLL_NAME    "KeyHook.dll"
#define     DEF_HOOKSTART   "HookStart"
#define     DEF_HOOKSTOP    "HookStop"

typedef     void(*PFN_HOOKSTART)();
typedef     void(*PFN_HOOKSTOP)();

int main()
{
    HMODULE       hDll = NULL;
    PFN_HOOKSTART HookStart = NULL;
    PFN_HOOKSTOP  HookStop = NULL;
    char          ch = 0;
    
    // 加载KeyHook.dll
    hDll = LoadLibraryA(DEF_DLL_NAME);

    // 获取导出函数地址
    HookStart = (PFN_HOOKSTART)GetProcAddress(hDll, DEF_HOOKSTART);
    HookStop = (PFN_HOOKSTOP)GetProcAddress(hDll, DEF_HOOKSTOP);

    // 开始钩取
    HookStart();

    // 等待直到用户输入"q"
    printf("press 'q' to quit!\n");
    while (_getch() != 'q');
    
    // 终止钩取
    HookStop();

    // 卸载KeyHook.dll
    FreeLibrary(hDll);
    return 0;
}
```

//myhack.cpp

#include    "windows.h"
#include    "tchar.h"
#include    "stdlib.h"
#include    "Urlmon.h"

#pragma     comment(lib, "Urlmon.lib")

#define     DEF_URL         (L"http://www.baidu.com")
#define     DEF_FILE_NAME   (L"baidu.html")

HMODULE     g_hMod = NULL;

DWORD __stdcall ThreadProc(LPVOID lParam) {
    TCHAR   szPath[_MAX_PATH] = { 0, };
    if (!GetModuleFileName(g_hMod, szPath, MAX_PATH))
        return FALSE;

    TCHAR   *p = _tcsrchr(szPath, '\\');
    if (!p)
        return FALSE;

    _tcscpy_s(p + 1, _MAX_PATH, DEF_FILE_NAME);

    URLDownloadToFile(NULL, DEF_URL, szPath, 0, NULL);

    return 0;
}

BOOL __stdcall DllMain(HINSTANCE hinstDLL,
    DWORD     fdwReason,
    LPVOID    lpvReserved
) {
    HANDLE      hThread = NULL;

    g_hMod = (HMODULE)hinstDLL;

    switch (fdwReason) {
    case DLL_PROCESS_ATTACH:
        OutputDebugString(L"myhack.dll Injection!!!");
        hThread = CreateThread(NULL, 0, ThreadProc, NULL, 0, NULL);
        CloseHandle(hThread);
        break;
    }
    return TRUE;
}
// Dll被加载(DLL_PROCESS_ATTACH)时, 先输出一个调试字符串
// 然后创建线程调用函数(ThreadProc)
// 在ThreadProc()函数中调用URLDownloadToFile() API来下载指定网站的html文件
-----------------------------------------------------------------------------


-----------------------------------------------------------------------------
// InjectDll.cpp

#include "windows.h"  
#include "stdio.h"  
  
BOOL InjectDll(DWORD dwPID, PCHAR szDllPath)
{  
    HMODULE         hMod            = NULL;  
    HANDLE          hProcess        = NULL;  
    HANDLE          hThread         = NULL;  
    LPVOID          pRemoteBuf      = 0;  
    DWORD           dwSize          = 0;  
    LPTHREAD_START_ROUTINE pThreadProc;
 
  
    // #1. 使用dwPID获取目标进程句柄
    if ( !(hProcess = OpenProcess(PROCESS_ALL_ACCESS,   // dwDesiredAccess  
                                  FALSE,                // bInheritHandle  
                                  dwPID)) )             // dwProcessId  
    {  
        printf("OpenProcess() fail : err_code = %d\n", GetLastError());  
        return FALSE;  
    }  
  
    // #2. 在目标进程内存中分配szDllName大小的内存
    dwSize = sizeof(char) * (strlen(szDllPath)+1);  
    if( !(pRemoteBuf = VirtualAllocEx(hProcess,             // hProcess  
                                      NULL,                 // lpAddress  
                                      dwSize,               // dwSize  
                                      MEM_COMMIT,           // flAllocationType  
                                      PAGE_READWRITE)) )    // flProtect  
    {  
        printf("VirtualAllocEx() fail : err_code = %d\n", GetLastError());  
        return FALSE;  
    }  
  
    // #3. 将dll路径写入分配的内存
    if( !WriteProcessMemory(hProcess,                       // hProcess  
                            pRemoteBuf,                     // lpBaseAddress  
                            (LPVOID)szDllPath,              // lpBuffer  
                            dwSize,                         // nSize  
                            NULL) )                         // [out] lpNumberOfBytesWritten  
    {  
        printf("WriteProcessMemory() fail : err_code = %d\n", GetLastError());  
        return FALSE;  
    }  
  
    // #4. 获取LoadLibraryA() API的地址
    hMod = GetModuleHandleA("kernel32.dll");
    pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(
        hMod, "LoadLibraryA");

    // #5. 在进程中运行线程
    if( !(hThread = CreateRemoteThread(hProcess,            // hProcess  
                                       NULL,                // lpThreadAttributes  
                                       0,                   // dwStackSize  
                                       pThreadProc,         // dwStackSize  
                                       pRemoteBuf,          // lpParameter  
                                       0,                   // dwCreationFlags  
                                       NULL)) )             // lpThreadId  
    {  
        printf("CreateRemoteThread() fail : err_code = %d\n", GetLastError());  
        return FALSE;  
    }  
  
    WaitForSingleObject(hThread, INFINITE);   
  
    CloseHandle(hThread);  
    CloseHandle(hProcess);  
  
    return TRUE;  
}  
  
  
int main(int argc, char *argv[]) {
    if (argc != 3) {
        printf("USAGE : %s pid dll_path\n", argv[0]);
        return 1;
    }

    // inject dll
    if (InjectDll((DWORD)atol(argv[1]), argv[2]))
        printf("InjectDll(\"%s\") success!\n", argv[2]);
    else
        printf("InjectDll(\"%s\") failed!\n", argv[2]);
    return 0;
}

// main()函数的主要功能是检测输入程序的参数, 
// 然后调用InjectDll()函数
// 
// InjectDll()函数是用来实施dll注入的核心函数
// 其功能是命令目标进程自行调用LoadLibrary("*.dll") API
// 
// hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID)):
// 调用OpenProcess() API, 借助参数dwPID获取目标进程的句柄
// (PROCESS_ALL_ACCESS权限), 之后, 就可以使用获取的句柄(hProcess)
// 控制对应进程
// 
// pRemoteBuf = VirtualAllocEx(hProcess, NULL, dwSize, 
//                      MEM_COMMIT, PAGE_READWRITE)):
// 需要把即将加载的dll文件的路径(字符串)告知目标进程
// 因为任何内存空间都无法进行写入操作, 所以先用VirtualAllocEx() API
// 在目标进程的内存空间中分配一块缓冲区
// 
// WriteProcessMemory(hProcess, pRemoteBuf, 
//                  (LPVOID)szDllPath, dwSize, NULL):
// 使用WriteProcessMemory() API将dll路径字符串写入分配所得的缓冲区
// (pRemoteBuf)地址, 这样, 要注入的dll文件的路径就被写入目标进程
// 
// hMod = GetModuleHandleA("kernel32.dll");
// pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(
//      hMod, "LoadLibraryA"):
// 调用LoadLibrary() API前要先获取其地址
// 该段代码获取的是InjectDll.exe进程中的kernel32.dll地址
// 由于系统dll都有自身固有的ImageBase, 不会发生重定位问题
// 所以进程InjectDll.exe中的kernel32.dll地址和目标进程中的地址是一样的
// 
// hThread = CreateRemoteThread(hProcess, NULL, 0, 
//          pThreadProc, pRemoteBuf, 0, NULL):
// 最后向目标进程发送命令, 让其调用LoadLibraryA() API来加载指定的dll文件
// 然而Windows并未提供执行这样命令的API, 于是另辟蹊径用CreateRemoteThread() API
// HANDLE WINAPI CreateRemoteThread(
// __in  HANDLE                 hProcess,  // 目标进程句柄
// __in  LPSECURITY_ATRIBUTES   lpThreadAttributes,
// __in  SIZE_T                 dwStackSize,
// __in  LPTHREAD_START_ROUTINE lpStartSize,// 线程函数地址
// __in  LPVOID                 lpParameter,// 线程参数地址
// __in  DWORD                  dwCreationFlags,
// __out LPDWORD                lpThreadId
// );
// 因为线程函数ThreadProc()和LoadLibrary()函数都有一个4字节的参数, 一个4字节的返回
// 所以用创建远程线程的API时, 将线程函数地址替换为LoadLibrary()地址
// 将线程参数地址替换为dll文件路径字符串所在地址
// 就可以驱使目标进程加载指定的dll文件

// EjectDll.cpp :

#include    "windows.h"
#include    "tlhelp32.h"

#define     DEF_PROC_NAME   (L"notepad.exe")
#define     DEF_DLL_NAME    (L"myhacker.dll")

DWORD FindProcID(LPCTSTR szProcessName) {
    DWORD   dwPID = 0xffffffff;
    HANDLE  hSnapShot = INVALID_HANDLE_VALUE;
    PROCESSENTRY32 pe;

    // 获取系统快照(SnapShot)
    pe.dwSize = sizeof(PROCESSENTRY32);
    hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);

    // 查找进程
    Process32First(hSnapShot, &pe);
    do {
        if (!_tcsicmp(szProcessName, (LPCTSTR)pe.szExeFile)) {
            dwPID = pe.th32ProcessID;
            break;
        }
    } while (Process32Next(hSnapShot, &pe));

    CloseHandle(hSnapShot);

    return dwPID;
}

BOOL SetPrivilege(LPCTSTR lpszPrivilege, BOOL bEnablePrivilege) {
    TOKEN_PRIVILEGES tp;
    HANDLE           hToken;
    LUID             luid;
    
    if (!OpenProcessToken(GetCurrentProcess(),
        TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
        &hToken)) {
        _tprintf(L"OpenProcessToke error: %u\n", GetLastError());
        return FALSE;
    }

    if (!LookupPrivilegeValue(NULL, // lookup privilege on local system
        lpszPrivilege,              // privilege to lookup
        &luid                       // receives LUID of privilege
    )) {
        _tprintf(L"LookupPrivilegeValue error: %u\n", GetLastError());
        return FALSE;
    }

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    if (bEnablePrivilege)
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        tp.Privileges[0].Attributes = 0;

    // Enable the privilege or disable all privileges.
    if (!AdjustTokenPrivileges(hToken, FALSE,
        &tp, sizeof(TOKEN_PRIVILEGES),
        (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) {
        _tprintf(L"AdjustTokenPrivileges error: %u\n", GetLastError());
        return FALSE;
    }

    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED) {
        _tprintf(L"The token does not have the specified privilege. \n");
        return FALSE;
    }
    return TRUE;
}

BOOL EjectDll(DWORD dwPID, LPCTSTR szDllName) {
    BOOL    bMore = FALSE, bFound = FALSE;
    HANDLE  hSnapshot, hProcess, hThread;
    HMODULE hModule = NULL;
    MODULEENTRY32 me = { sizeof(me) };
    LPTHREAD_START_ROUTINE pThreadProc;

    // dwPID = 目标进程PID
    // 使用TH32CS_SNAPMODULE参数, 获取加载到目标进程的dll名称
    hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);

    bMore = Module32First(hSnapshot, &me);
    for (; bMore; bMore = Module32Next(hSnapshot, &me)) {
        if (!_tcsicmp((LPCTSTR)me.szModule, szDllName)
            || !_tcsicmp((LPCTSTR)me.szExePath, szDllName)) {
            bFound = TRUE;
            break;
        }
    }

    if (!bFound) {
        CloseHandle(hSnapshot);
        return FALSE;
    }
    
    if (!(hProcess = OpenProcess(PROCESS_ALL_ACCESS,   // dwDesiredAccess  
        FALSE,                // bInheritHandle  
        dwPID)))             // dwProcessId  
    {
        _tprintf(L"OpenProcess() fail : err_code = %d\n", GetLastError());
        return FALSE;
    }

    hModule = GetModuleHandleA("kernel32.dll");
    pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(
        hModule, "FreeLibrary");

    if (!(hThread = CreateRemoteThread(hProcess,            // hProcess  
        NULL,                // lpThreadAttributes  
        0,                   // dwStackSize  
        pThreadProc,         // dwStackSize  
        me.modBaseAddr,      // lpParameter  
        0,                   // dwCreationFlags  
        NULL)))              // lpThreadId  
    {
        printf("CreateRemoteThread() fail : err_code = %d\n", GetLastError());
        return FALSE;
    }

    WaitForSingleObject(hThread, INFINITE);

    CloseHandle(hThread);
    CloseHandle(hProcess);
    CloseHandle(hSnapshot);

    return TRUE;
}

int _tmain(int argc, TCHAR* argv[])
{
    DWORD   dwPID = 0xffffffff;

    // 查找process
    dwPID = FindProcID(DEF_PROC_NAME);
    if (dwPID == 0xffffffff) {
        _tprintf(L"There is no %s process!\n", DEF_PROC_NAME);
        return 1;
    }
    _tprintf(L"PID of \"%s\" is %d\n", DEF_PROC_NAME, dwPID);

    // 更改privilege
    if (!SetPrivilege(SE_DEBUG_NAME, TRUE))
        return 1;

    // eject dll
    if (EjectDll(dwPID, DEF_DLL_NAME))
        _tprintf(L"EjectDll(%d \"%s\") success!\n", dwPID, DEF_DLL_NAME);
    else
        _tprintf(L"EjectDll(%d \"%s\") failed!\n", dwPID, DEF_DLL_NAME);
    return 0;
}

int main(int argc, char* argv[])
{
    DWORD dwPID = 0;
    if (argc != 2) {
        printf("\n USAGE : %s pid\n", argv[0]);
        return 1;
    }
    // code injection
    dwPID = (DWORD)atol(argv[1]);
    InjectCode(dwPID);
    return 0;
}

* main()函数用来调用InjectCode()函数

// Thread Parameter
typedef struct _THREAD_PARAM {
    FARPROC pFunc[2];       // LoadLibraryA(), GetProcAddress()
    char    szBuf[4][128];  // "user32.dll", "MessageBoxA"
                            // "www.reversecore.com", "ReverseCore"
} THREAD_PARAM, *PTHREAD_PARAM;

// LoadLibraryA()
typedef HMODULE (WINAPI *PFLOADLIBRARY)(LPCSTR lpLibFileName);

// GetProcAddress()
typedef FARPROC (WINAPI *PFGETPROCADDRESS)(HMODULE hModule, LPCSTR lpProcName);

// MessageBoxA()
typedef int (WINAPI *PFMESSAGEBOXA)(HWND hwnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);

+ 定义了用于充当线程参数的结构体THREAD_PARAM
+ 指向LoadLibraryA()起始地址的函数指针PFLOADLIBRARY
+ 指向GetProcAddress()起始地址的函数指针PFGETPROCADDRESS
+ 指向MessageBoxA()起始地址的PFMESSAGEBOXA

// Thread Procedure
DWORD WINAPI ThreadProc(LPVOID lParam) {
    PTHREAD_PARAM   pParam = (PTHREAD_PARAM)lParam;
    HMODULE         hMod = NULL;
    FARPROC         pFunc = NULL;
    // LoadLibrary("user32.dll")
    // pParam->pFunc[0] -> kernel32!LoadLibraryA()
    // pParam->szBuf[0] -> "user32.dll"
    hMod = ((PFLOADLIBRARY)pParam->pFunc[0])(pParam->szBuf[0]);

    // GetProcAddress("MessageBoxA")
    // pParam->pFunc[1] -> kernel32!GetProcAddress()
    // pParam->szBuf[1] -> "MessageBoxA"
    pFunc = (FARPROC)((PFGETPROCADDRESS)pParam->pFunc[1])(hMod, pParam->szBuf[1]);

    // MessageBoxA(NULL, "www.reversecore.com", "ReverseCore", MB_OK)
    // pParam->pFunc[2] -> "www.reversecore.com"
    // pParam->szBuf[3] -> "ReverseCore"
    ((PFMESSAGEBOXA)pFunc)(NULL, pParam->szBuf[2], pParam->szBuf[3], MB_OK);

    return 0;
}

+ 等价于
```
hMod = LoadLibraryA("user32.dll");
pFunc = GetProcAddress(hMod, "MessageBoxA");
MessageBoxA(NULL, "www.reversecore.com", "ReverseCore", MB_OK);
```
+ 若直接将等价代码注入其他进程, 因为在CodeInjection进程中发生重定位, 以及目标进程中发生重定位的关系, 传递过去的代码(内存中实际上相关API以及参数, 字符串都是以地址的形式硬编码的)会因为地址不同而无法运行
+ 所以在ThreadProc()函数中使用THREAD_PARAM结构体来接收2个API地址与4个字符串数据
+ 其实可以不传递LoadLibraryA()与GetProcAddress()而直接传递MessageBoxA(), 但是原则上先传递LoadLibraryA()与GetProcAddress()来加载需要的dll, 再获取要用的函数地址, 这样的程序对于目标进程的适用性比较强
+ 大部分用户模式进程都会加载kernel32.dll, 所以直接传递LoadLibraryA()与GetProcAddress()的地址不会出什么问题, 但是某些系统进程不会加载, 应事前确认

BOOL InjectCode(DWORD dwPID) {
    HMODULE         hMod = NULL;
    THREAD_PARAM    param = { 0, };
    HANDLE          hProcess = NULL;
    HANDLE          hThread = NULL;
    LPVOID          pRemoteBuf[2] = { 0, };
    DWORD           dwSize = 0;

    hMod = GetModuleHandleA("kernel32.dll");

    // set THREAD_PARAM
    param.pFunc[0] = GetProcAddress(hMod, "LoadLibraryA");
    param.pFunc[1] = GetProcAddress(hMod, "GetProcAddress");
    strcpy_s(param.szBuf[0], "user32.dll");
    strcpy_s(param.szBuf[1], "MessageBoxA");
    strcpy_s(param.szBuf[2], "www.reversecore.com");
    strcpy_s(param.szBuf[3], "ReverseCore");

    // Open Process
    hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);

    // Allocation for THREAD_PARAM
    dwSize = sizeof(THREAD_PARAM);
    pRemoteBuf[0] = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);
    WriteProcessMemory(hProcess, pRemoteBuf[0], (LPVOID)&param, dwSize, NULL);

    // Allocation for ThreadProc()
    dwSize = (DWORD)InjectCode - (DWORD)ThreadProc;
    pRemoteBuf[1] = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(hProcess, pRemoteBuf[1], (LPVOID)ThreadProc, dwSize, NULL);


    hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteBuf[1], pRemoteBuf[0], 0, NULL);
    WaitForSingleObject(hThread, INFINITE);

    CloseHandle(hThread);
    CloseHandle(hProcess);

    return TRUE;
}

+ 与dll注入类似, InjectCode()函数把THREAD_PARAM结构体变量的地址以参数形式传递给ThreadProc()线程函数
+ 函数ThreadProc()大小的计算方法: `dwSize = (DWORD)InjectCode - (DWORD)ThreadProc;` ; 因为在MS Visual C++中使用Release模式编译程序代码后, 源代码中按照顺序编写, 所以直接用函数指针相减即可
+ 总体结构如下:
```
OpenProcess();

// data: THREAD_PARAM
VirtualAllocEx();
WriteProcessMemory();

// code: ThreadProc
VirtualAllocEx();
WriteProcessMemory();

CreateRemoteThread();
```

// hookdbg.cpp
#include <stdio.h>
#include <Windows.h>

LPVOID  g_pWriteFile = NULL;
CREATE_PROCESS_DEBUG_INFO g_cpdi;
BYTE    g_chINT3 = 0xcc, g_chOrgByte = 0;

void DebugLoop();
bool OnCreateProcessDebugEvent(LPDEBUG_EVENT);
bool OnExceptionDebugEvent(LPDEBUG_EVENT);


int main(int argc, char* argv[])
{
    DWORD   dwPID;
    if (argc != 2) {
        printf("\nUsage: hookdbg.exe pid\n");
        return 1;
    }

    // Attach Process
    dwPID = atoi(argv[1]);
    if (!DebugActiveProcess(dwPID)) {
        printf("DebugActiveProcess(%d) failed!!\nError Code = %d\n", dwPID, GetLastError());
        return 1;
    }

    // 调试器循环
    DebugLoop();

    return 0;
}


// TODO: 类似于窗口过程函数(WndProc)
// 从被调试者处接收事件并处理, 然后使被调试者继续运行
void DebugLoop() {
    DEBUG_EVENT  de;
    DWORD        dwContinueStatus;

    // 等待被调试者发生事件
    // API: WaitForDebugEvent
    // BOOL APIENTRY WaitForDebugEvent(
    //      _Out_ LPDEBUG_EVENT lpDebugEvent,
    //      _In_ DWORD dwMilliseconds
    //  );
    // 由DEBUG_EVENT结构体de接收被调试进程的所有调试事件
    while (WaitForDebugEvent(&de, INFINITE))
    {
        dwContinueStatus = DBG_CONTINUE;
        // 被调试进程生成或者附加事件
        if (CREATE_PROCESS_DEBUG_EVENT == de.dwDebugEventCode) {
            OnCreateProcessDebugEvent(&de);
        }
        // 异常事件
        else if (EXCEPTION_DEBUG_EVENT == de.dwDebugEventCode) {
            if (OnExceptionDebugEvent(&de))
                continue;
        }
        // 被调试进程终止事件
        else if (EXIT_PROCESS_DEBUG_EVENT == de.dwDebugEventCode) {
            // 调试器终止
            break;
        }
        // 再次运行被调试者
        // API: ContinueDebugEvent
        // BOOL APIENTRY ContinueDebugEvent(
        // _In_ DWORD dwProcessId,
        // _In_ DWORD dwThreadId,
        // _In_ DWORD dwContinueStatus
        // );
        // TODO: 使被调试者继续运行, 
        // 如果调试事件处理正常, 则dwContinueStatus应为DBG_CONTINUE
        // 若无法处理, 希望在应用程序的SEH中处理, 则dwContinueStatus应为DBG_EXCEPTION_NOT_HANDLED
        ContinueDebugEvent(de.dwProcessId, de.dwThreadId, dwContinueStatus);
    }
}

// TODO: 首先获取WriteFile() API的起始地址(调试者和被调试者具有相同的RVA)
// 然后获取被调试进程句柄, 并设置断点
bool OnCreateProcessDebugEvent(LPDEBUG_EVENT pde) {
    // 获取WriteFile() API地址
    g_pWriteFile = GetProcAddress(GetModuleHandleA("kernel32.dll"), "WriteFile");

    // 通过CREATE_PROCESS_DEBUG_INFO结构体的hProcess成员获取被调试进程句柄
    memcpy(&g_cpdi, &pde->u.CreateProcessInfo, sizeof(CREATE_PROCESS_DEBUG_INFO));

    // API "钩子" - WriteFile()
    // 设置断点, 保存原始字节值(调试器拥有被调试者的调试权限)
    ReadProcessMemory(g_cpdi.hProcess, g_pWriteFile, &g_chOrgByte, sizeof(BYTE), NULL);
    WriteProcessMemory(g_cpdi.hProcess, g_pWriteFile, &g_chINT3, sizeof(BYTE), NULL);

    return true;
}

bool OnExceptionDebugEvent(LPDEBUG_EVENT pde) {
    CONTEXT     ctx;
    PBYTE       lpBuffer = NULL;
    DWORD       dwNumOfBytesToWrite, dwAddrOfBuffer, i;
    PEXCEPTION_RECORD per = &pde->u.Exception.ExceptionRecord;

    // 是断点异常(INT 3)时
    if (EXCEPTION_BREAKPOINT == per->ExceptionCode) {
        // 断点地址为WriteFile() API地址时
        if (g_pWriteFile == per->ExceptionAddress) {
            // 1. Unhook
            // 将0xcc恢复
            WriteProcessMemory(g_cpdi.hProcess, g_pWriteFile, &g_chOrgByte, sizeof(BYTE), NULL);

            // 2. 获取线程上下文
            ctx.ContextFlags = CONTEXT_CONTROL;
            GetThreadContext(g_cpdi.hThread, &ctx);

            // 3. 获取WriteFile()的第2, 3个参数
            // param 2 : ESP + 0x8
            // param 3 : ESP + 0xc
            ReadProcessMemory(g_cpdi.hProcess, (LPVOID)(ctx.Esp + 0x8), &dwAddrOfBuffer, sizeof(DWORD), NULL);
            ReadProcessMemory(g_cpdi.hProcess, (LPVOID)(ctx.Esp + 0xc), &dwNumOfBytesToWrite, sizeof(DWORD), NULL);

            // 4. 分配临时缓冲区
            lpBuffer = (PBYTE)malloc(dwNumOfBytesToWrite + 1);
            memset(lpBuffer, 0, dwNumOfBytesToWrite + 1);

            // 5. 复制WriteFile()缓冲区到临时缓冲区
            ReadProcessMemory(g_cpdi.hProcess, (LPVOID)dwAddrOfBuffer, lpBuffer, dwNumOfBytesToWrite, NULL);
            printf("\n# original string: %s\n", lpBuffer);

            // 6. 大小写互换
            for (i = 0; i < dwNumOfBytesToWrite; i++) {
                if (isalpha(lpBuffer[i]))
                    lpBuffer[i] ^= 0x20;
            }
            printf("\n# converted string: %s\n", lpBuffer);

            // 7. 将变换后的缓冲区复制到WriteFile()缓冲区
            WriteProcessMemory(g_cpdi.hProcess, (LPVOID)dwAddrOfBuffer, lpBuffer, dwNumOfBytesToWrite, NULL);

            // 8. 释放临时缓冲区
            free(lpBuffer);

            // 9. 将上下文的EIP更改为WriteFile()首地址
            // 由于执行完INT 3, 当前EIP比首地址大1
            ctx.Eip = (DWORD)g_pWriteFile;
            SetThreadContext(g_cpdi.hThread, &ctx);

            // 10. 运行被调试进程
            ContinueDebugEvent(pde->dwProcessId, pde->dwThreadId, DBG_CONTINUE);
            Sleep(0);

            // 11. API"钩子"
            WriteProcessMemory(g_cpdi.hProcess, g_pWriteFile, &g_chINT3, sizeof(BYTE), NULL);

            return true;
        }
    }
    return false;
}

// SetWindowTextWHooking.dll
#include <windows.h>
#include <stdlib.h>

FARPROC g_pOrgFun;
typedef bool(*PFSETWINDOWTEXTW)(HWND, LPWSTR);

bool __stdcall hook_iat(LPCSTR, PROC, PROC);
bool __stdcall MySetWindowTextW(HWND, LPWSTR);

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
        // 保存原始api地址, 为脱钩用
        g_pOrgFun = GetProcAddress(GetModuleHandle(L"user32.dll"), "SetWindowTextW");

        // hook
        hook_iat("user32.dll", g_pOrgFun, (PROC)MySetWindowTextW);
        break;
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        // unhook
        hook_iat("user32.dll", (PROC)MySetWindowTextW, g_pOrgFun);
        break;
    }
    return TRUE;
}

bool __stdcall MySetWindowTextW(HWND hWnd, LPWSTR lpString) {
    wchar_t* pNum = L"零一二三四五六七八九";
    wchar_t temp[2] = { 0, };
    int i = 0, nLen = 0, nIndex = 0;
    
    nLen = wcslen(lpString);
    for (i = 0; i < nLen; i++) {
        if (L'0' <= lpString[i] && lpString[i] <= L'9') {
            temp[0] = lpString[i];
            nIndex = _wtoi(temp);
            lpString[i] = pNum[nIndex];
        }
    }
    return ((PFSETWINDOWTEXTW)g_pOrgFun)(hWnd, lpString);
}

bool __stdcall hook_iat(LPCSTR szDllName, PROC src, PROC dest) {
    HMODULE hMod;
    LPCSTR szLibName;
    PIMAGE_IMPORT_DESCRIPTOR pImportDesc;
    PIMAGE_THUNK_DATA pThunk;
    DWORD dwOldProtect, dwRVA;
    PBYTE pAddr;

    // hMod, pAddr = ImageBase of calc.exe
    //               VA to MZ signature(IMAGE_DOS_HEADER)
    hMod = GetModuleHandle(NULL);
    pAddr = (PBYTE)hMod;

    // pAddr = VA to PE signature (IMAGE_NT_HEADRERS)
    pAddr += *((DWORD*)&pAddr[0x3C]);

    // dwRVA = RVA to IMAGE_IMPORT_DESCRIPTOR
    dwRVA = *((DWORD*)&pAddr[0x80]);

    // pImportDesc = VA to IMAGE_IMPORT_DESCRIPTOR Table
    pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)hMod + dwRVA);

    for (; pImportDesc->Name; pImportDesc++) {
        // szLibName = VA to IMAGE_IMPORT_DESCRIPTOR.Name
        szLibName = (LPCSTR)((DWORD)hMod + pImportDesc->Name);

        if (!_stricmp(szLibName, szDllName)) {
            // pThunk = IMAGE_IMPORT_DESCRIPTOR.FirstThunk
            //        = VA to IAT
            pThunk = (PIMAGE_THUNK_DATA)((DWORD)hMod + pImportDesc->FirstThunk);

            // pThunk->u1.Function = VA to API
            for (; pThunk->u1.Function; pThunk++) {
                if (pThunk->u1.Function == (DWORD)src) {
                    // 更改内存属性为E/R/W
                    VirtualProtect((LPVOID)&pThunk->u1.Function, 4, PAGE_EXECUTE_READWRITE, &dwOldProtect);

                    // 修改IAT
                    pThunk->u1.Function = (DWORD)dest;

                    // 恢复内存属性
                    VirtualProtect((LPVOID)&pThunk->u1.Function, 4, dwOldProtect, &dwOldProtect);
                    
                    return TRUE;
                }
            }
        }
    }

    return FALSE;
}