192 lines
8.8 KiB
C
192 lines
8.8 KiB
C
/*
|
||
* snowcat-hook.dll —— 观测版
|
||
*
|
||
* 目的：搞清楚 QQ 9.9.37 到底是谁、在什么时机读取 resources\app\package.json，
|
||
* 以及读取走的是 kernel32!CreateFileW 还是 ntdll!NtCreateFile（NT 层）。
|
||
*
|
||
* 只记录，不改内容。结果写到 D:\SnowCat.Portable\hook-trace.txt
|
||
*/
|
||
#include <windows.h>
|
||
#include <winternl.h>
|
||
#include <stdio.h>
|
||
#include <wchar.h>
|
||
#include "MinHook.h"
|
||
|
||
#define TRACE_PATH L"D:\\SnowCat.Portable\\hook-trace.txt"
|
||
|
||
static HANDLE (WINAPI *origCreateFileW)(LPCWSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE) = NULL;
|
||
static NTSTATUS (NTAPI *origNtOpenFile)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, ULONG, ULONG) = NULL;
|
||
static NTSTATUS (NTAPI *origNtCreateFile)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK,
|
||
PLARGE_INTEGER, ULONG, ULONG, ULONG, ULONG, PVOID, ULONG) = NULL;
|
||
|
||
static CRITICAL_SECTION g_lock;
|
||
static volatile LONG g_subsReady = 0;
|
||
|
||
static void trace(const wchar_t* api, const wchar_t* path) {
|
||
EnterCriticalSection(&g_lock);
|
||
HANDLE h = CreateFileW(TRACE_PATH, FILE_APPEND_DATA, FILE_SHARE_READ | FILE_SHARE_WRITE,
|
||
NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
||
if (h != INVALID_HANDLE_VALUE) {
|
||
char buf[2048];
|
||
int n = WideCharToMultiByte(CP_UTF8, 0, path, -1, buf, sizeof(buf) - 1, NULL, NULL);
|
||
if (n <= 0) { buf[0] = 0; }
|
||
char line[2304];
|
||
int len = snprintf(line, sizeof(line), "%s\t%s\n", (const char*)api, buf);
|
||
DWORD w = 0;
|
||
SetFilePointer(h, 0, NULL, FILE_END);
|
||
WriteFile(h, line, (DWORD)len, &w, NULL);
|
||
CloseHandle(h);
|
||
}
|
||
LeaveCriticalSection(&g_lock);
|
||
}
|
||
|
||
static int interesting(const wchar_t* p) {
|
||
if (!p) return 0;
|
||
if (wcsstr(p, L"package.json")) return 1;
|
||
if (wcsstr(p, L"application.asar")) return 1;
|
||
if (wcsstr(p, L"loadNapCat")) return 1;
|
||
if (wcsstr(p, L"app_launcher")) return 1;
|
||
if (wcsstr(p, L"qqnt")) return 1;
|
||
return 0;
|
||
}
|
||
|
||
static wchar_t g_fakePkg[MAX_PATH];
|
||
static wchar_t g_patchedAsar[MAX_PATH];
|
||
static wchar_t g_qqDir[MAX_PATH];
|
||
|
||
static void buildSubstitutes(void) {
|
||
// QQ 目录 = QQ.exe 所在目录（反射注入器是父进程拉起的，模块表里主 exe 可查）
|
||
wchar_t exePath[MAX_PATH];
|
||
GetModuleFileNameW(NULL, exePath, MAX_PATH);
|
||
wchar_t* slash = wcsrchr(exePath, L'\\');
|
||
if (slash) *slash = 0;
|
||
wcscpy(g_qqDir, exePath);
|
||
|
||
// 假 package.json：优先 snowcat-fake-pkg.json（真字段+main 覆写合并版）
|
||
wchar_t fakePath[MAX_PATH];
|
||
swprintf(fakePath, MAX_PATH, L"%s\\snowcat-fake-pkg.json", g_qqDir);
|
||
WIN32_FILE_ATTRIBUTE_DATA fa2;
|
||
if (GetFileAttributesExW(fakePath, GetFileExInfoStandard, &fa2)) {
|
||
wcscpy(g_fakePkg, fakePath);
|
||
} else {
|
||
DWORD n = GetEnvironmentVariableW(L"NAPCAT_PATCH_PACKAGE", g_fakePkg, MAX_PATH);
|
||
if (n == 0) {
|
||
swprintf(g_fakePkg, MAX_PATH, L"%s\\qqnt.json", g_qqDir);
|
||
}
|
||
}
|
||
// patched asar：snowcat-patched.asar（若存在）
|
||
swprintf(g_patchedAsar, MAX_PATH, L"%s\\snowcat-patched.asar", g_qqDir);
|
||
WIN32_FILE_ATTRIBUTE_DATA fa;
|
||
if (!GetFileAttributesExW(g_patchedAsar, GetFileExInfoStandard, &fa)) {
|
||
g_patchedAsar[0] = 0; // 无副本则不替换 asar
|
||
}
|
||
}
|
||
|
||
static int isPkg(const wchar_t* p) {
|
||
return p && wcsstr(p, L"resources") && wcsstr(p, L"package.json");
|
||
}
|
||
static int isAsar(const wchar_t* p) {
|
||
return p && wcsstr(p, L"application.asar");
|
||
}
|
||
|
||
static HANDLE WINAPI detourCreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode,
|
||
LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition,
|
||
DWORD dwFlagsAndAttributes, HANDLE hTemplateFile) {
|
||
if (interesting(lpFileName)) trace(L"CreateFileW", lpFileName);
|
||
if (g_subsReady) {
|
||
if (isPkg(lpFileName)) return origCreateFileW(g_fakePkg, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
|
||
if (isAsar(lpFileName) && g_patchedAsar[0]) return origCreateFileW(g_patchedAsar, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
|
||
}
|
||
return origCreateFileW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes,
|
||
dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
|
||
}
|
||
|
||
static NTSTATUS NTAPI detourNtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess,
|
||
POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock,
|
||
PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess,
|
||
ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength) {
|
||
if (g_subsReady && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
|
||
wchar_t* bp = ObjectAttributes->ObjectName->Buffer;
|
||
/* NT 路径 \??\C:\... —— 匹配用宽松 wcsstr 即可 */
|
||
if (isPkg(bp)) {
|
||
static UNICODE_STRING us;
|
||
static wchar_t ntpath[MAX_PATH + 8];
|
||
swprintf(ntpath, MAX_PATH + 8, L"\\\\??\\\\%s", g_fakePkg);
|
||
us.Buffer = ntpath;
|
||
us.Length = (USHORT)(wcslen(ntpath) * 2);
|
||
us.MaximumLength = us.Length + 2;
|
||
ObjectAttributes->ObjectName = &us;
|
||
trace(L"NtCreateFile→FAKE-PKG", bp);
|
||
return origNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
|
||
}
|
||
if (isAsar(bp) && g_patchedAsar[0]) {
|
||
static UNICODE_STRING us2;
|
||
static wchar_t ntpath2[MAX_PATH + 8];
|
||
swprintf(ntpath2, MAX_PATH + 8, L"\\\\??\\\\%s", g_patchedAsar);
|
||
us2.Buffer = ntpath2;
|
||
us2.Length = (USHORT)(wcslen(ntpath2) * 2);
|
||
us2.MaximumLength = us2.Length + 2;
|
||
ObjectAttributes->ObjectName = &us2;
|
||
trace(L"NtCreateFile→PATCHED-ASAR", bp);
|
||
return origNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
|
||
}
|
||
}
|
||
if (ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
|
||
if (interesting(ObjectAttributes->ObjectName->Buffer)) {
|
||
trace(L"NtCreateFile", ObjectAttributes->ObjectName->Buffer);
|
||
}
|
||
}
|
||
return origNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize,
|
||
FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
|
||
}
|
||
|
||
static NTSTATUS NTAPI detourNtOpenFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess,
|
||
POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock,
|
||
ULONG ShareAccess, ULONG OpenOptions) {
|
||
if (ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
|
||
trace(L"NtOpenFile", ObjectAttributes->ObjectName->Buffer);
|
||
}
|
||
return origNtOpenFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions);
|
||
}
|
||
|
||
|
||
|
||
|
||
static DWORD WINAPI initThread(LPVOID param) {
|
||
(void)param;
|
||
InitializeCriticalSection(&g_lock);
|
||
buildSubstitutes();
|
||
g_subsReady = 1;
|
||
trace(L"===", L"injected");
|
||
|
||
if (MH_Initialize() != MH_OK) { trace(L"===ERR", L"MH_Initialize failed"); return 1; }
|
||
|
||
HMODULE k32 = GetModuleHandleW(L"kernel32.dll");
|
||
HMODULE nt = GetModuleHandleW(L"ntdll.dll");
|
||
void* pCreateFileW = (void*)GetProcAddress(k32, "CreateFileW");
|
||
void* pNtCreateFile = (void*)GetProcAddress(nt, "NtCreateFile");
|
||
|
||
if (pCreateFileW && MH_CreateHook(pCreateFileW, &detourCreateFileW, (LPVOID*)&origCreateFileW) == MH_OK)
|
||
trace(L"===", L"hook CreateFileW ok");
|
||
if (pNtCreateFile && MH_CreateHook(pNtCreateFile, &detourNtCreateFile, (LPVOID*)&origNtCreateFile) == MH_OK)
|
||
trace(L"===", L"hook NtCreateFile ok");
|
||
|
||
void* pNtOpenFile = (void*)GetProcAddress(nt, "NtOpenFile");
|
||
if (pNtOpenFile && MH_CreateHook(pNtOpenFile, &detourNtOpenFile, (LPVOID*)&origNtOpenFile) == MH_OK)
|
||
trace(L"===", L"hook NtOpenFile ok");
|
||
|
||
MH_EnableHook(MH_ALL_HOOKS);
|
||
trace(L"===", L"hooks enabled");
|
||
return 0;
|
||
}
|
||
|
||
BOOL WINAPI DllMain(HMODULE hModule, DWORD reason, LPVOID reserved) {
|
||
(void)reserved;
|
||
if (reason == DLL_PROCESS_ATTACH) {
|
||
DisableThreadLibraryCalls(hModule);
|
||
HANDLE th = CreateThread(NULL, 0, initThread, NULL, 0, NULL);
|
||
if (th) CloseHandle(th);
|
||
}
|
||
return TRUE;
|
||
}
|