FARPROC Address;

HMODULE Module;



Module = GetModuleHandle("user32.dll";

if(Module == NULL)

{

	MessageBox(NULL, "GetModuleHandle Failed", "Sucks", MB_OK);

	return FALSE;

}



Address = GetProcAddress(Module, "GetLastInputInfo";

if(Address == NULL)

{

	MessageBox(NULL, "GetProcAddress Failed", "Sucks", MB_OK);

	return FALSE;

}



if(HookEat(Address, (FARPROC)&EAT_GetLastInputInfo) != true)

{

	MessageBox(NULL, "Injection Failed", "Sucks", MB_OK);

	return FALSE;

}

.386

.model flat, stdcall

option casemap:none



include       \masm32\include\windows.inc

include       \masm32\include\kernel32.inc

includelib    \masm32\lib\kernel32.lib

includelib    frizzo.lib

include       \masm32\include\user32.inc

includelib    \masm32\lib\user32.lib



FrizzBox PROTO



.code

start:

	invoke FrizzBox

	invoke ExitProcess,NULL

end start

.386

.model flat,stdcall

option casemap:none

include \masm32\include\windows.inc

include \masm32\include\user32.inc

include \masm32\include\kernel32.inc

includelib \masm32\lib\user32.lib

includelib \masm32\lib\kernel32.lib





LASTINPUTINFO STRUCT

cbSize DWORD ?

dwTime DWORD ?

LASTINPUTINFO ENDS

PLASTINPUTINFO typedef PTR LASTINPUTINFO





.data

deb_det             db "calling FrankRizzo hello hello",0

caption             db "hooktesting",0

format				db "LastInput Was At %x",0



.data?



plii				LASTINPUTINFO <>

string              db 100 dup (?)



.code



DllEntry proc hInstance:HINSTANCE, reasonWORD, reserved1WORD

	.if		reason==DLL_PROCESS_ATTACH

		call FrizzBox

		mov plii.cbSize,sizeof(LASTINPUTINFO)

		invoke GetLastInputInfo,addr plii

		invoke wsprintf,addr string,addr format,plii.dwTime

		invoke MessageBoxA,NULL,addr string,addr caption,NULL

	.elseif reason==DLL_PROCESS_DETACH

		call FrizzBox

		mov plii.cbSize,sizeof(LASTINPUTINFO)

		invoke GetLastInputInfo,addr plii

		invoke wsprintf,addr string,addr format,plii.dwTime

		invoke MessageBoxA,NULL,addr string,addr caption,NULL

	.elseif reason==DLL_THREAD_ATTACH

		call FrizzBox

		mov plii.cbSize,sizeof(LASTINPUTINFO)

		invoke GetLastInputInfo,addr plii

		invoke wsprintf,addr string,addr format,plii.dwTime

		invoke MessageBoxA,NULL,addr string,addr caption,NULL

    .else        

		call FrizzBox

		mov plii.cbSize,sizeof(LASTINPUTINFO)

		invoke GetLastInputInfo,addr plii

		invoke wsprintf,addr string,addr format,plii.dwTime

		invoke MessageBoxA,NULL,addr string,addr caption,NULL

	.endif

	mov  eax,TRUE

	ret

DllEntry Endp



FrizzBox proc

        invoke MessageBox ,NULL,offset deb_det,offset caption, NULL

        ret	

FrizzBox endp



End DllEntry

#include <stdio.h>

#include <windows.h>

#include <tlhelp32.h>



int main (void)

{

	STARTUPINFO				si;

	PROCESS_INFORMATION		pi;

	MODULEENTRY32			mod32;

	HANDLE					prochand;

	HANDLE					hSnap;

	BOOL					modnext = TRUE;

	CHAR					getaddlast[16] = {0};



	printf("creating and hooking getlast\n";

	ZeroMemory( &si, sizeof(si) );

    si.cb = sizeof(si);

    ZeroMemory( &pi, sizeof(pi) );



    if( !CreateProcess( NULL,"frizzoxe.exe",NULL,NULL,FALSE,0,NULL,NULL,&si,&pi ) ) 

    {

        printf( "CreateProcess failed (%d)\n", GetLastError() );

        return 0;

    }

    prochand = pi.hProcess;

	WaitForInputIdle(pi.hProcess,INFINITE);

	Sleep(3000);

	SuspendThread(pi.hThread);

	hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pi.dwProcessId);

	if((LONG)hSnap == -1)

	{

		printf( "CreateToolhelp32SnapShot Failed (%d)\n", GetLastError() );

        return 0;

	}

	ZeroMemory(&mod32,sizeof(mod32));

	mod32.dwSize = sizeof(mod32);

	if(!Module32First(hSnap,&mod32))

	{

		printf( "Module32FirstFailed (%d)\n", GetLastError() );

        return 0;

	}

	printf("first module is %s\n",mod32.szModule);

	while(modnext==TRUE)

	{

		ZeroMemory(&mod32,sizeof(mod32));

		mod32.dwSize = sizeof(mod32);

		modnext = Module32Next(hSnap,&mod32);

		printf("next module is %s\n",mod32.szModule);

		if((strcmp(mod32.szModule,"frizzo.dll") == 0)

		{

			printf("th32ModuleId	= %x\n",mod32.th32ModuleID);

			printf("th32ProcessId	= %x\n",mod32.th32ProcessID);

			printf("gibl			= %x\n",mod32.GlblcntUsage);

			printf("procCUNT		= %x\n",mod32.ProccntUsage);

			printf("modbase			= %x\n",mod32.modBaseAddr);

			printf("modsize			= %x\n",mod32.modBaseSize);

			printf("hMod			= %x\n",mod32.hModule);

			printf("szmod			= %s\n",mod32.szModule);

			printf("szExe			= %s\n",mod32.szExePath);

			ReadProcessMemory(prochand,mod32.modBaseAddr+0x2000,getaddlast,4,NULL);

			printf("GetLastInputInfo has been Resolved to %x in frizzo.dll\n",*(DWORD *)getaddlast);

		}

	}

	printf("did a round robin of all modules in remote process\n";

	ResumeThread(pi.hThread);

	CloseHandle(hSnap);

	CloseHandle(prochand);

	return 1;

}

F:\frizzo>loadandhookgetlast.exe

creating and hooking getlast

first module is frizzoxe.exe

next module is ntdll.dll

next module is kernel32.dll

next module is frizzo.dll

th32ModuleId    = 1

th32ProcessId   = 0

gibl                    = ffff

procCUNT                = ffff

modbase                 = 10000000

modsize                 = 5000

hMod                    = 10000000

szmod                   = frizzo.dll

szExe                   = F:\frizzo\frizzo.dll

GetLastInputInfo has been Resolved to 77d49519 in frizzo.dll

next module is user32.dll

next module is GDI32.dll

next module is uxtheme.dll

next module is msvcrt.dll

next module is ADVAPI32.dll

next module is RPCRT4.dll

next module is RPCRT4.dll

did a round robin of all modules in remote process



F:\frizzo>

int _tmain(int argc, _TCHAR* argv[])

{

	STARTUPINFO si;

	PROCESS_INFORMATION pi;

	HANDLE hProcess;

	DWORD exitValue;



	pfWriteProcessMemory = (pWriteProcessMemory) GetProcAddress(GetModuleHandle(TEXT("kernel32.dll"), "WriteProcessMemory";

	if(HookEAT(GetProcAddress(GetModuleHandle(TEXT("kernel32.dll"), "WriteProcessMemory", (FARPROC) &EAT_WriteProcessMemory) == FALSE)

	{

		error("Can't Hook";

		return 0;

	}



	ZeroMemory( &si, sizeof(si) );

	si.cb = sizeof(si);

	ZeroMemory( &pi, sizeof(pi) );



	if(CreateProcess(filename, NULL, NULL, NULL, false, NULL, NULL, NULL, &si, &pi) == 0)

	{

		error("CreateProcess";

		return 0;

	}



	hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pi.dwProcessId);

	if(hProcess == NULL)

	{

		error("OpenProcess";

		return 0;

	}



	for(; 

	{ 		

		GetExitCodeProcess(hProcess, &exitValue);

		if(exitValue != STILL_ACTIVE)

		{

			break;

		}

		else

		{

			Sleep(500);

		}

	}



	return 0;

}





BOOL WINAPI EAT_WriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten)

{

        // Maybe listening to Dub side of the moon isn't good while writing code.  ;-)

	MessageBox(NULL, "Money is power", "HA!", MB_OK);



	return pfWriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten);

}







/////////////////////////////////////////////////  Hooking code below here ////////////////////////////////////



//	Matt Pietrek's function

IMAGE_SECTION_HEADER *GetEnclosingSectionHeader(u32 rva) 

{

	IMAGE_SECTION_HEADER *section = IMAGE_FIRST_SECTION(ntHd); 

	for (u32 i = 0; i < ntHd->FileHeader.NumberOfSections; i++, section++ )

	{

		// This 3 line idiocy is because Watcom's linker actually sets the

		// Misc.VirtualSize field to 0.  (!!! - Retards....!!!)

		u32 size = section->Misc.VirtualSize;

		if ( 0 == size )

			size = section->SizeOfRawData;



		// Is the RVA within this section?

		if ( (rva >= section->VirtualAddress) && 

			(rva < (section->VirtualAddress + size)))

			return section;

	}



	return NULL;

}



unsigned long GetMappedSectionOffset(IMAGE_SECTION_HEADER *seHd)

{

	IMAGE_SECTION_HEADER *section = IMAGE_FIRST_SECTION(ntHd);

	u32 offset = MakeDelta(u32, section, dosHd);

	for(u32 i = 0; i < ntHd->FileHeader.NumberOfSections; i++, section++)

	{

		if(section->Name == seHd->Name)

		{

			offset = MakeDelta(u32, section->VirtualAddress, section->PointerToRawData);

			break;

		}

	}



	return offset;

}



//	This function is also Pietrek's, with a modification by me so that it can handle

//	images that are mapped into memory.

void *GetPtrFromRVA(u32 rva, bool mapped)

{

	IMAGE_SECTION_HEADER *pSectionHdr = GetEnclosingSectionHeader(rva);

	s32 offset = 0;



	if(mapped)

		offset = GetMappedSectionOffset(pSectionHdr);

	if (!pSectionHdr)

		return 0;



	s32 delta = (s32)(pSectionHdr->VirtualAddress-pSectionHdr->PointerToRawData);

	return (void *) ( (u8 *)dosHd + rva - delta + offset);

}



bool HookEAT(FARPROC hookFrom, FARPROC hookTo)

{

	u32 i;

	HMODULE target;

	u32 oldprot, oldprot2;



	if(!GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, (LPCSTR)hookFrom, &target))

	{

		return false;

	}



	dosHd = (IMAGE_DOS_HEADER *)target;

	ntHd = MakePtr(IMAGE_NT_HEADERS *, target, dosHd->e_lfanew);

	IMAGE_EXPORT_DIRECTORY *ied = (IMAGE_EXPORT_DIRECTORY *)GetPtrFromRVA(ntHd->OptionalHeader.DataDirectory[IMAGE_EXPORT].VirtualAddress, true);



	FARPROC *funcs = (FARPROC *)GetPtrFromRVA(ied->AddressOfFunctions, true);



	for(i = 0; i < ied->NumberOfFunctions; i++)

	{

		if(MakePtr(FARPROC, target, funcs[I]) == hookFrom)

		{

			break;

		}

	}



	if(i >= ied->NumberOfFunctions)

	{

		return false;

	}



	VirtualProtect(&funcs[I], sizeof(u32), PAGE_READWRITE, (DWORD *)&oldprot);

	funcs[I] = MakeDelta(FARPROC, hookTo, target);

	VirtualProtect(&funcs[I], sizeof(u32), oldprot, (DWORD *)&oldprot2);



	return true;

}









////////////////////////////////// Utility Functions below here ///////////////////////////////////



void error(LPSTR lpszFunction) 

{ 

	LPVOID lpMsgBuf;



	if (!FormatMessage( 

		FORMAT_MESSAGE_ALLOCATE_BUFFER | 

		FORMAT_MESSAGE_FROM_SYSTEM | 

		FORMAT_MESSAGE_IGNORE_INSERTS,

		NULL,

		GetLastError(),

		MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language

		(LPTSTR) &lpMsgBuf,

		0,

		NULL ))

	{

		// Handle the error.

		return;

	}



	MessageBox(NULL, (LPCTSTR)lpMsgBuf, lpszFunction, MB_OK);



	// Free the buffer.

	LocalFree( lpMsgBuf );

}