|
| 1 | +/* |
| 2 | + Windows API Hooking using Trampoline |
| 3 | + @5mukx |
| 4 | +*/ |
| 5 | + |
| 6 | +use std::{ |
| 7 | + ffi::{CStr, CString}, |
| 8 | + ptr::null_mut, |
| 9 | +}; |
| 10 | + |
| 11 | +use widestring::WideCString; |
| 12 | +use winapi::{ |
| 13 | + shared::{ |
| 14 | + minwindef::{DWORD, LPVOID, UINT}, |
| 15 | + ntdef::{LPCSTR, LPWSTR}, |
| 16 | + windef::HWND, |
| 17 | + }, |
| 18 | + um::{ |
| 19 | + errhandlingapi::GetLastError, |
| 20 | + libloaderapi::{GetModuleHandleA, GetProcAddress}, |
| 21 | + memoryapi::VirtualProtect, |
| 22 | + winnt::PAGE_EXECUTE_READWRITE, |
| 23 | + winuser::{MB_ICONINFORMATION, MB_OK, MessageBoxA, MessageBoxW}, |
| 24 | + }, |
| 25 | +}; |
| 26 | + |
| 27 | +const INTERCEPTOR_SIZE: usize = 14; |
| 28 | + |
| 29 | +#[repr(C)] |
| 30 | +struct ApiInterceptor { |
| 31 | + target_function: LPVOID, |
| 32 | + replacement_function: LPVOID, |
| 33 | + original_code: [u8; INTERCEPTOR_SIZE], |
| 34 | + original_protection: DWORD, |
| 35 | +} |
| 36 | + |
| 37 | +impl ApiInterceptor { |
| 38 | + fn new() -> Self { |
| 39 | + ApiInterceptor { |
| 40 | + target_function: null_mut(), |
| 41 | + replacement_function: null_mut(), |
| 42 | + original_code: [0; INTERCEPTOR_SIZE], |
| 43 | + original_protection: 0, |
| 44 | + } |
| 45 | + } |
| 46 | +} |
| 47 | + |
| 48 | +fn main() { |
| 49 | + unsafe { |
| 50 | + let user32 = GetModuleHandleA("user32.dll\0".as_ptr() as *const i8); |
| 51 | + let dialog_func = GetProcAddress(user32, "MessageBoxA\0".as_ptr() as *const i8); |
| 52 | + |
| 53 | + let mut interceptor = ApiInterceptor::new(); |
| 54 | + if !setup_interceptor( |
| 55 | + dialog_func as LPVOID, |
| 56 | + custom_dialog as LPVOID, |
| 57 | + &mut interceptor, |
| 58 | + ) { |
| 59 | + println!("[ERROR] Interceptor setup failed"); |
| 60 | + return; |
| 61 | + } |
| 62 | + |
| 63 | + let text1 = CString::new("Testing Smukx System").unwrap(); |
| 64 | + let caption1 = CString::new("System Info").unwrap(); |
| 65 | + |
| 66 | + MessageBoxA( |
| 67 | + null_mut(), |
| 68 | + text1.as_ptr(), |
| 69 | + caption1.as_ptr(), |
| 70 | + MB_OK | MB_ICONINFORMATION, |
| 71 | + ); |
| 72 | + |
| 73 | + println!("[INFO] Activating API interceptor..."); |
| 74 | + |
| 75 | + if !activate_interceptor(&mut interceptor) { |
| 76 | + println!("[ERROR] Interceptor activation failed"); |
| 77 | + return; |
| 78 | + } |
| 79 | + println!("[INFO] Interceptor activated"); |
| 80 | + |
| 81 | + let text2 = CString::new("Smukx Is Great").unwrap(); |
| 82 | + let caption2 = CString::new("System Info").unwrap(); |
| 83 | + |
| 84 | + MessageBoxA( |
| 85 | + null_mut(), |
| 86 | + text2.as_ptr(), |
| 87 | + caption2.as_ptr(), |
| 88 | + MB_OK | MB_ICONINFORMATION, |
| 89 | + ); |
| 90 | + |
| 91 | + println!("[INFO] Deactivating API interceptor..."); |
| 92 | + if !deactivate_interceptor(&mut interceptor) { |
| 93 | + println!("[ERROR] Interceptor deactivation failed"); |
| 94 | + return; |
| 95 | + } |
| 96 | + println!("[INFO] Interceptor deactivated"); |
| 97 | + |
| 98 | + let text3 = CString::new("Smukx System Restored").unwrap(); |
| 99 | + let caption3 = CString::new("System Info").unwrap(); |
| 100 | + MessageBoxA( |
| 101 | + null_mut(), |
| 102 | + text3.as_ptr(), |
| 103 | + caption3.as_ptr(), |
| 104 | + MB_OK | MB_ICONINFORMATION, |
| 105 | + ); |
| 106 | + } |
| 107 | + |
| 108 | + println!("[INFO] PoC Demonstrated Successfully"); |
| 109 | + |
| 110 | +} |
| 111 | + |
| 112 | +fn setup_interceptor( |
| 113 | + target_function: LPVOID, |
| 114 | + replacement_function: LPVOID, |
| 115 | + interceptor: &mut ApiInterceptor, |
| 116 | +) -> bool { |
| 117 | + if target_function.is_null() || replacement_function.is_null() { |
| 118 | + return false; |
| 119 | + } |
| 120 | + |
| 121 | + interceptor.target_function = target_function; |
| 122 | + interceptor.replacement_function = replacement_function; |
| 123 | + |
| 124 | + unsafe { |
| 125 | + std::ptr::copy_nonoverlapping( |
| 126 | + target_function as *const u8, |
| 127 | + interceptor.original_code.as_mut_ptr(), |
| 128 | + INTERCEPTOR_SIZE, |
| 129 | + ); |
| 130 | + |
| 131 | + let mut old_protection: DWORD = 0; |
| 132 | + if VirtualProtect( |
| 133 | + target_function, |
| 134 | + INTERCEPTOR_SIZE, |
| 135 | + PAGE_EXECUTE_READWRITE, |
| 136 | + &mut old_protection, |
| 137 | + ) == 0 |
| 138 | + { |
| 139 | + println!("[!] Memory protection change failed: {}", GetLastError()); |
| 140 | + return false; |
| 141 | + } |
| 142 | + interceptor.original_protection = old_protection; |
| 143 | + } |
| 144 | + true |
| 145 | +} |
| 146 | + |
| 147 | +fn activate_interceptor(interceptor: &mut ApiInterceptor) -> bool { |
| 148 | + if interceptor.target_function.is_null() || interceptor.replacement_function.is_null() { |
| 149 | + return false; |
| 150 | + } |
| 151 | + |
| 152 | + unsafe { |
| 153 | + { |
| 154 | + let interceptor_code: [u8; INTERCEPTOR_SIZE] = [ |
| 155 | + 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, |
| 156 | + ]; |
| 157 | + let patch = interceptor.replacement_function as u64; |
| 158 | + std::ptr::copy_nonoverlapping( |
| 159 | + &patch as *const _ as *const u8, |
| 160 | + (interceptor.target_function as *mut u8).offset(6), |
| 161 | + std::mem::size_of::<u64>(), |
| 162 | + ); |
| 163 | + |
| 164 | + std::ptr::copy_nonoverlapping( |
| 165 | + interceptor_code.as_ptr(), |
| 166 | + interceptor.target_function as *mut u8, |
| 167 | + 6, |
| 168 | + ); |
| 169 | + } |
| 170 | + } |
| 171 | + true |
| 172 | +} |
| 173 | + |
| 174 | +fn deactivate_interceptor(interceptor: &mut ApiInterceptor) -> bool { |
| 175 | + if interceptor.target_function.is_null() { |
| 176 | + return false; |
| 177 | + } |
| 178 | + |
| 179 | + unsafe { |
| 180 | + std::ptr::copy_nonoverlapping( |
| 181 | + interceptor.original_code.as_ptr(), |
| 182 | + interceptor.target_function as *mut u8, |
| 183 | + INTERCEPTOR_SIZE, |
| 184 | + ); |
| 185 | + |
| 186 | + std::ptr::write_bytes(interceptor.original_code.as_mut_ptr(), 0, INTERCEPTOR_SIZE); |
| 187 | + |
| 188 | + let mut old_protection: DWORD = 0; |
| 189 | + if VirtualProtect( |
| 190 | + interceptor.target_function, |
| 191 | + INTERCEPTOR_SIZE, |
| 192 | + interceptor.original_protection, |
| 193 | + &mut old_protection, |
| 194 | + ) == 0 |
| 195 | + { |
| 196 | + println!( |
| 197 | + "[!] Memory protection restoration failed: {}", |
| 198 | + GetLastError() |
| 199 | + ); |
| 200 | + return false; |
| 201 | + } |
| 202 | + |
| 203 | + interceptor.target_function = null_mut(); |
| 204 | + interceptor.replacement_function = null_mut(); |
| 205 | + interceptor.original_protection = 0; |
| 206 | + } |
| 207 | + |
| 208 | + true |
| 209 | +} |
| 210 | + |
| 211 | +unsafe extern "system" fn custom_dialog( |
| 212 | + hwnd: HWND, |
| 213 | + lp_text: LPCSTR, |
| 214 | + lp_caption: LPCSTR, |
| 215 | + u_type: UINT, |
| 216 | +) -> i32 { |
| 217 | + let text = unsafe { CStr::from_ptr(lp_text) }.to_string_lossy(); |
| 218 | + let caption = unsafe { CStr::from_ptr(lp_caption) }.to_string_lossy(); |
| 219 | + |
| 220 | + println!("[INFO] Dialog Parameters:"); |
| 221 | + println!("\tText: {}", text); |
| 222 | + println!("\tCaption: {}", caption); |
| 223 | + |
| 224 | + let new_text = WideCString::from_str("Smukx Is Good").unwrap(); |
| 225 | + let new_caption = WideCString::from_str("System Dialog").unwrap(); |
| 226 | + |
| 227 | + unsafe { |
| 228 | + MessageBoxW( |
| 229 | + hwnd, |
| 230 | + new_text.as_ptr() as LPWSTR, |
| 231 | + new_caption.as_ptr() as LPWSTR, |
| 232 | + u_type, |
| 233 | + ) |
| 234 | + } |
| 235 | +} |
0 commit comments