layout: post
title: 研究spy++如何获取窗口的WndProc回调地址
categories: Reverse_Engineering
description: 研究spy++如何获取窗口的WndProc回调地址
keywords:
url: https://lichao890427.github.io/ https://github.com/lichao890427/
背景
该题目源于网上一段提问，提问者问：每个窗口都有其回调函数WndProc用于处理消息，然而如果获取其他进程的窗口信息，通过GetWindowLong仅能获取到除了WndProc以外的参数，唯独WndProc获取不了，然而为何Spy++可以？是通过HWND对应的内核结构获取到的吗？（内核驱动我不懂，懂得大哥说说）
源码
经过实验我发现确实不能用GetWindowLong获取到该参数GWL_WNDPROC，于是我决定研究一下Spy++，弄了一天终于研究出来了。分析表明Spy++采取了Windows自带Hook功能获取一些特殊窗口参数，关键代码在spyxxhk.dll的SpyxxGetMsgProc函数中。试验方法是：随便用spy++查找一个窗口，右键查看窗口属性，看常规选项卡中“窗口进程”的结果，例如00417912，之后用WinHex打开Spyxx.exe进程的SPYXXHK.DLL模块，搜索该数据，发现在6D325C44处，使用IDA附加该进程，查看该处地址为一变量，查看引用可知SpyxxGetMsgProc中对其进行了修改。接下来看Spyxx.exe对该函数的调用，可以分析出如下代码：
HMODULE spyhkmod;
HHOOK getmsghook;
HHOOK callwndprochook;
HHOOK callwndprocrethook;
extern HHOOK _ghhkMsgHook;//dll导出变量，对应getmsghook
extern HHOOK _ghhkCallHook;//dll导出变量，对应callwndprochook
extern HHOOK _ghhkRetHook;//dll导出变量，对应callwndprocrethook
void SetMsgHook(BOOL Enable)
{
if(Enable)//hook
{
if(!spyhkmod)
{
spyhkmod=GetModuleHandle(_T("SpyxxHk"));
if(!spyhkmod)
return;
}
if(!getmsghook)
{
getmsghook=SetWindowsHookEx(WH_GETMESSAGE,SpyxxGetMsgProc,spyhkmod,0);
if(!getmsghook)
{
CString text,caption;
text.LoadString(113);//Cannot set the WH_GETMESSAGE hook. Message logging is inoperable.
caption.LoadString(1);//Microsoft Spy++
MessageBox(NULL,text,caption,MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL);
return;
}
_ghhkMsgHook=getmsghook;
}
if(!callwndprochook)
{
callwndprochook=SetWindowsHookEx(WH_CALLWNDPROC,SpyxxCallWndProc,spyhkmod,0);
if(!callwndprochook)
{
CString text,caption;
text.LoadString(114);//Cannot set the WH_CALLWNDPROC hook. Message logging is inoperable.
caption.LoadString(1);//Microsoft Spy++
MessageBox(NULL,text,caption,MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL);
UnhookWindowsHookEx(getmsghook);
return;
}
_ghhkCallHook=callwndprochook;
}
if(!callwndprocrethook)
{
callwndprocrethook=SetWindowsHookEx(WH_CALLWNDPROCRET,SpyxxCallWndRetProc,spyhkmod,0);
if(!callwndprocrethook)
{
CString text,caption;
text.LoadString(115);//,Cannot set the WH_CALLWNDPROCRET hook. Message logging is inoperable.
caption.LoadString(1);//Microsoft Spy++
MessageBox(NULL,text,caption,MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL);
UnhookWindowsHookEx(getmsghook);
UnhookWindowsHookEx(callwndprochook);
return;
}
_ghhkRetHook=callwndprocrethook;
}
}
else//unhook
{
if(getmsghook)
{
UnhookWindowsHookEx(getmsghook);
getmsghook=NULL;
}
if(callwndprochook)
{
UnhookWindowsHookEx(callwndprochook);
callwndprochook=NULL;
}
//还有一个没有unhook呢？bug？
}
}
HWND hWnd;
HANDLE hWriterMutex,hAccessMutex,hReadEvent,hWrittenEvent,hOtherAccessMutex,hOtherDataEvent;
void HookMain(void* param)
{
hWriterMutex = CreateMutexW(0, 0, L"Local\\Spy++ Writer Mutex");
hAccessMutex = CreateMutexW(0, 0, L"Local\\Spy++ Access Mutex");
hReadEvent = CreateEventW(0, 0, 1, L"Local\\Spy++ Read Event");
hWrittenEvent = CreateEventW(0, 0, 0, L"Local\\Spy++ Written Event");
hOtherAccessMutex = CreateMutexW(0, 0, L"Local\\Spy++ Other Process Access Mutex");
hOtherDataEvent = CreateEventW(0, 0, 0, L"Local\\Spy++ Other Process Data Event");
PSECURITY_DESCRIPTOR sd=NULL;
if(ConvertStringSecurityDescriptorToSecurityDescriptor(
_T("D:(A;;GA;;;WD)(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;AN)(A;;GA;;;RC)(A;;GA;;;S-1-15-2-1)"),
SDDL_REVISION_1,&sd,NULL))
{
PACL pDacl;
BOOL bDaclPresent;
BOOL bDaclDefaulted;
if(GetSecurityDescriptorDacl(sd,&bDaclPresent,&pDacl,&bDaclDefaulted))
{
SetSecurityInfo(hWriterMutex,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);
SetSecurityInfo(hAccessMutex,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);
SetSecurityInfo(hReadEvent,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);
SetSecurityInfo(hWrittenEvent,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);
SetSecurityInfo(hOtherAccessMutex,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);
SetSecurityInfo(hOtherDataEvent,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pDacl,NULL);
}
LocalFree(sd);
}
if(ConvertStringSecurityDescriptorToSecurityDescriptor(_T("S:(ML;;NW;;;LW)"),SDDL_REVISION_1,&sd,NULL))
{
PACL pSacl;
BOOL bDaclPresent;
BOOL bDaclDefaulted;
if(GetSecurityDescriptorDacl(sd,&bDaclPresent,&pSacl,&bDaclDefaulted))
{
SetSecurityInfo(hWriterMutex,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);
SetSecurityInfo(hAccessMutex,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);
SetSecurityInfo(hReadEvent,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);
SetSecurityInfo(hWrittenEvent,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);
SetSecurityInfo(hOtherAccessMutex,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);
SetSecurityInfo(hOtherDataEvent,SE_KERNEL_OBJECT,LABEL_SECURITY_INFORMATION,NULL,NULL,pSacl,NULL);
}
LocalFree(sd);
}
//.........
SetMsgHook(TRUE);
//........
}
void WINAPI CreateHookThread()
{
//.........
_beginthread(HookMain,0x10000,hWnd);
//.........
}
int CSpyApp::InitInstance()
{
//.........
CreateHookThread();
//.........
}
BOOL gfHookEnabled,gfHookDisabled;
DWORD _gpidSpyxx;
LRESULT WINAPI SpyxxCallWndProc(int nCode, WPARAM wParam, LPARAM lParam)
{
LRESULT ret=CallNextHookEx(_ghhkCallHook,nCode,wParam,lParam);
CWPSTRUCT* cwp=(CWPSTRUCT*)lParam;
if(gfHookEnabled && !gfHookDisabled && nCode == HC_ACTION && cwp && cwp->hwnd)
{
DWORD procid;
DWORD id=GetWindowThreadProcessId(cwp->hwnd,&procid);
if(procid != _gpidSpyxx && id != _gpidSpyxx && GetCurrentThreadId() != _gpidSpyxx)
func(1,0,cwp->hwnd,cwp->message,cwp->wParam,cwp->lParam,0,0,0);
}
return ret;
}
LRESULT WINAPI SpyxxCallWndRetProc(int nCode, WPARAM wParam, LPARAM lParam)
{
LRESULT ret=CallNextHookEx(_ghhkRetHook,nCode,wParam,lParam);
CWPRETSTRUCT* cwp=(CWPRETSTRUCT*)lParam;
if(gfHookEnabled && !gfHookDisabled && nCode == HC_ACTION && cwp && cwp->hwnd)
{
DWORD procid;
DWORD id=GetWindowThreadProcessId(cwp->hwnd,&procid);
if(procid != _gpidSpyxx && id != _gpidSpyxx && GetCurrentThreadId() != _gpidSpyxx)
func(2,cwp->lResult,cwp->hwnd,cwp->message,cwp->wParam,cwp->lParam,0,0,0);
}
return ret;
}
UINT gmsgOtherProcessData;
HWND gopd;//目标进程窗口句柄，exe在OnIdle例程中修改该处
DWORD goproc;//目标窗口回调函数地址
WNDCLASS WndClass;
LRESULT WINAPI SpyxxGetMsgProc(int nCode, WPARAM wParam, LPARAM lParam)
{
MSG* msg=(MSG*)lParam;
if(nCode == HC_ACTION && (wParam&PM_REMOVE) && msg && msg->hwnd)
{
if(msg->message == gmsgOtherProcessData)
{
if(msg->hwnd == gopd && hAccessMutex && !WaitForSingleObject(hAccessMutex,1000))
{
TCHAR ClassName[128];
GetClassName(msg->hwnd,ClassName,128);
if(IsWindowUnicode(msg->hwnd))
goproc=GetWindowLongW(msg->hwnd,GWL_WNDPROC);
else
goproc=GetWindowLongA(msg->hwnd,GWL_WNDPROC);
if(GetClassInfoW(NULL,ClassName,&WndClass))
{
if(WndClass.lpszMenuName) {/*...............*/};
if(IsWindowUnicode(msg->hwnd))
WndClass.lpfnWndProc=(WNDPROC)GetClassLongW(msg->hwnd,GCL_WNDPROC);
}
//..............
msg->message=0;
msg->wParam=0;
msg->lParam=0;
}
}
else if(gfHookEnabled && !gfHookDisabled)
{
DWORD procid;
DWORD id=GetWindowThreadProcessId(msg->hwnd,&procid);
if(procid != _gpidSpyxx && id != _gpidSpyxx && GetCurrentThreadId() != _gpidSpyxx)
func(0,0,msg->hwnd,msg->message,msg->wParam,msg->lParam,msg->time,msg->pt.x,msg->pt.y);
}
}
return CallNextHookEx(_ghhkMsgHook,nCode,wParam,lParam);
}
结论
可以分析出，spy++通过windows hook方式注入相关功能到目标进程，从而实现自己的目的。Window编写hook时是要把函数放在专门的dll中，hook后所有程序都会自动加载该dll