Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.

Kako hookirati explorer ?

[es] :: Zaštita :: Kako hookirati explorer ?

[ Pregleda: 1768 | Odgovora: 4 ] > FB > Twit

Postavi temu Odgovori

Autor

Pretraga teme: Traži
Markiranje Štampanje RSS

reiser

Član broj: 7895
Poruke: 2314



+102 Profil

icon Kako hookirati explorer ?25.09.2004. u 02:08 - pre 238 meseci
Ovo mi je potrebno da bi virus mogao da salje podatke preko interneta a da ga firewall ne primeti...
Saznao sam da je to moguce tako sto cu da napravim jedan dll koji ce sadrzati funkcije za hook-ovanje i unhook-ovanje procesa.
Takodje, dll sadrzi i funkciju koja se izvrsava kad dodje red na nju u lancu.

Ja bih rado iskopirao source kod dll-a ovde, ali ne znam da li je to dozvoljeno...

Moze li neko da mi pojasni koji je prvi parametar u SetWindowsHookEx, tj. koji tip hook-a treba da bude ? I sta posle, kad hookiram explorer, sta treba da radim - kako da posaljem mail preko toga i samim tim zaobidjem fw ?

poz
 
Odgovor na temu

Shadowed
Vojvodina

Član broj: 649
Poruke: 12851



+4784 Profil

icon Re: Kako hookirati explorer ?25.09.2004. u 11:48 - pre 238 meseci
Cini mi se da si malo pomesao dve stvari. Taj .dll o kome pricas treba da bude plug-in za IE (bilo toolbar, bilo browser helper...) i potrebno je da ga napravis kao COM objekat pre cemu treba da implementira odgovarajuce interfejse.
SetWindowsHookEx sluzi da postavi globalno presretanje poruka OS-a programima i ona postavlja neku tvoju funkciju u red za cekanje za prolazak poruke. Na taj nacin mozes pratiti poruke bilo koje vrste (vrstu poruka odredjujes prvim parametrom) ali bi morao da filtriras naknadno koje su poruke za IE.
To bi bila dva razlicita nacina pracenja IE-a.
Sto se prvog parametra tice...
Citat:
. idHook
Specifies the type of hook procedure to be installed. This parameter can be one of the following values:
WH_CALLWNDPROC
Installs a hook procedure that monitors messages before the system sends them to the destination window procedure. For more information, see the CallWndProc hook procedure.
WH_CALLWNDPROCRET
Installs a hook procedure that monitors messages after they have been processed by the destination window procedure. For more information, see the CallWndRetProc hook procedure.
WH_CBT
Installs a hook procedure that receives notifications useful to a computer-based training (CBT) application. For more information, see the CBTProc hook procedure.
WH_DEBUG
Installs a hook procedure useful for debugging other hook procedures. For more information, see the DebugProc hook procedure.
WH_GETMESSAGE
Installs a hook procedure that monitors messages posted to a message queue. For more information, see the GetMsgProc hook procedure.
WH_JOURNALPLAYBACK
Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure. For more information, see the JournalPlaybackProc hook procedure.
WH_JOURNALRECORD
Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros. For more information, see the JournalRecordProc hook procedure.
WH_KEYBOARD
Installs a hook procedure that monitors keystroke messages. For more information, see the KeyboardProc hook procedure.
WH_MOUSE
Installs a hook procedure that monitors mouse messages. For more information, see the MouseProc hook procedure.
WH_MSGFILTER
Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. For more information, see the MessageProc hook procedure.
WH_SHELL
Installs a hook procedure that receives notifications useful to shell applications. For more information, see the ShellProc hook procedure.
WH_SYSMSGFILTER
Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the system. For more information, see the SysMsgProc hook procedure.

Inace pogledaj MSDN, sve to (i mnogo vise imas tamo). BTW, u kom jeziku radis?
 
Odgovor na temu

Mikky

Član broj: 18
Poruke: 1563
*.vdial.verat.net

ICQ: 44582291


+58 Profil

icon Re: Kako hookirati explorer ?25.09.2004. u 21:39 - pre 238 meseci
Progooglaj malo "dll injection"
npr:
http://www.codeproject.com/dll/DLL_Injection_tutorial.asp


-I know UNIX, PASCAL, C, FORTRAN,
COBOL, and nineteen other high-tech
words.
 
Odgovor na temu

Sundance

Član broj: 7510
Poruke: 2559
*.sava.sczg.hr



Profil

icon Re: Kako hookirati explorer ?01.10.2004. u 00:13 - pre 238 meseci
CreateRemoteThread() is your friend :)

jos malo pa ce svi trojani na ovaj ili onaj nacin poceti koristiti process injection, pa ce i kucni firewall bit za qrac :(
 
Odgovor na temu

[es] :: Zaštita :: Kako hookirati explorer ?

[ Pregleda: 1768 | Odgovora: 4 ] > FB > Twit

Postavi temu Odgovori

Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.