淺談Windows CE中的未公開函數(shù)
作者：0xeb_XX
本文將介紹Windows CE中的未公開函數(shù)，包括PerformCallBack4、RegisterAPISet、QueryAPISetID、GetAPIAddress等多個函數(shù)。
PerformCallBack4
強(qiáng)制令別的進(jìn)程調(diào)用某個API，如果這個API是LoadLibrary的話，就相當(dāng)于線程注入了，由coredll.dll提供
PerformCallBack4函數(shù)的定義：
- [DllImport("coredll.dll")]
- public static extern uint PerformCallBack4(ref CallBackInfo CallBackInfo,
- IntPtr ni_pVoid1,IntPtr ni_pVoid2,IntPtr ni_pVoid3);
其中函數(shù)的參數(shù)CallBackInfo結(jié)構(gòu)定義:
- public struct CallBackInfo
- {
- public IntPtr hProc; //遠(yuǎn)程的目標(biāo)進(jìn)程
- public IntPtr pfn; //指向遠(yuǎn)程目標(biāo)進(jìn)程的函數(shù)地址的指針
- public IntPtr pvArg0; //函數(shù)的需要的***個參數(shù)
- }
而PerformCallback4的 ni_pVoid1、ni_pVoid2、ni_pVoid3為傳遞到遠(yuǎn)程目標(biāo)進(jìn)程執(zhí)行函數(shù)的其它三個參數(shù)。
例子：
- /*-------------------------------------------------------------------
- FUNCTION: CallCoredllInProc
- PURPOSE: CallCoredllInProc uses undocumented method
- PerformCallBack4 to call exported methods from coredll.dll in
- the specified process.
- PARAMETERS:
- HANDLE p_hProcess - handle to the process, where the call should
- be made
- LPCTSTR p_pszMethodName - name of method exported from coredll,
- such as VirtualAlloc, VirtualFree, etc.
- DWORD p_dwParam1, p_dwParam2, p_dwParam3, p_dwParam4 - arguments
- DWORD * p_pdwResult - pointer to the return value
- RETURNS:
- TRUE on success, FALSE on failure
- -------------------------------------------------------------------*/
- BOOL CallCoredllInProc
- (
- HANDLE p_hProcess,
- LPCTSTR p_pszMethodName,
- DWORD p_dwParam1, DWORD p_dwParam2,
- DWORD p_dwParam3, DWORD p_dwParam4,
- DWORD * p_pdwResult)
- {
- HINSTANCE l_hCoreDll = NULL;
- BOOL l_bReturn = FALSE;
- __try
- {
- //Use undocumented method PerformCallBack4
- //to call method in NK.EXE.
- CALLBACKINFO CallbackInfo;
- CallbackInfo.m_hDestinationProcessHandle = p_hProcess;
- l_hCoreDll = LoadLibrary(_T("COREDLL"));
- CallbackInfo.m_pFunction =
- (FARPROC)GetProcAddress(l_hCoreDll, p_pszMethodName);
- if(!CallbackInfo.m_pFunction)
- {
- /*HTRACE(TG_Error,
- _T("GetProcAddress(%x, %s) failed. Err %d"),
- l_hCoreDll, p_pszMethodName, GetLastError());
- */
- }
- else
- {
- CallbackInfo.m_pFirstArgument = (LPVOID)p_dwParam1;
- DWORD l_dwResult = PerformCallBack4
- (&CallbackInfo, p_dwParam2, p_dwParam3, p_dwParam4);
- if(p_pdwResult)
- {
- *p_pdwResult = l_dwResult;
- }
- l_bReturn = TRUE;
- }
- }
- __except(1)
- {
- /*
- HTRACE(TG_Error, _T("Exception in CallCoredllInProc(%s)"),
- p_pszMethodName);
- */
- l_bReturn = FALSE;
- }
- if(l_hCoreDll)
- {
- FreeLibrary(l_hCoreDll);
- }
- return l_bReturn;
- }//BOOL CallCoredllInProc
CreateAPISet
CE6.0以前是個未公開API，不過6.0以后就公開了
This function creates an API set from the list of functions passed as a parameter.
Syntax
- HANDLE CreateAPISet(
- char acName[4],
- USHORT cFunctions,
- const PFNVOID *ppfnMethods,
- const ULONGLONG *pu64Sig
- );
- Parameters
- acName
- [in] Name of the API set.
- cFunctions
- [in] Number of functions for this API set.
- ppfnMethods
- [in] Array of functions for the API set.
- pu64Sig
- [in] Array of signatures for the functions.
- Return Value
- A handle to the API set.
- Remarks
- Before any process can become a handle server, the process must create and register a handle-based API set with this function and RegisterAPISet.
- Requirements
- Header pkfuncs.h
- Library coredll.lib
- Windows Embedded CE Windows Embedded CE 6.0 and later
CE6.0以前在coredll.dll里面有這個函數(shù)
RegisterAPISet
CE6.0以前是個未公開API，不過6.0以后就公開了
This function registers an API set.
Syntax
- BOOL RegisterAPISet(
- HANDLE hASet,
- DWORD dwSetID
- );
- Parameters
- hASet
- [in] Handle to API set created by the CreateAPISet function.
- dwSetID
- [in] Type of API set. You must perform a bitwise OR operation on this parameter with REGISTER_APISET_TYPE to create a handle-based API set.
- Return Value
- TRUE indicates success. FALSE indicates failure. Call GetLastError to get extended error information.
- Remarks
- Before any process can become a handle server, the process must create and register a handle-based API set with CreateAPISet and RegisterAPISet.
- Requirements
- Header pkfuncs.h
- Library coredll.lib
- Windows Embedded CE Windows Embedded CE 6.0 and later
CE6.0以前在coredll.dll里面有這個函數(shù)
QueryAPISetID
根據(jù)名字查詢該API的ID，由coredll.dll提供
Syntax
- int QueryAPISetID(
- char *pName
- );
- Parameters
- pName
- [in] API的名字
- Return Value
- API的ID
GetAPIAddress
獲取特定API的特定Method的地址，由coredll.dll提供
- FARPROC GetAPIAddress(
- int setId,
- int iMethod
- );
- Parameters
- setId
- [in] API的ID
- iMethod
- [in] Method的ID
- Return Value
- 該Method的地址
GetProcessIndexFromID
根據(jù)進(jìn)程的ID計算出進(jìn)程的序號（這個序號就是進(jìn)程處于第幾個slot），由coredll.dll提供
Syntax
- DWORD GetProcessIndexFromID(
- HANDLE hProc
- );
Parameters
hProc
[in] 進(jìn)程的句柄，這里為什么不是進(jìn)程的ID而是進(jìn)程的句柄呢？非常簡單，因?yàn)樵贑E中進(jìn)程的句柄就是進(jìn)程的ID！
Return Value
進(jìn)程的序號
【編輯推薦】
責(zé)任編輯：彭凡
來源：
百度空間
