@ts: Hab mal schnell ein kleines Beispiel gemacht, wie du die Wow64Redirection im TC per DLL Hook deaktivierst. Denn Hook Code hab ich hier aus dem Forum, leider weiß ich nicht mehr von wem:
//Edit: Danke an Thorium, Super Code
inject.pbi :
Code: Alles auswählen
#THREAD_ALL_ACCESS = $1F03FF
Procedure InjectDLL(idTarget.i, FileName.s) ; ProzessID,DLLFileName.s
Define.i FileNameLen, FileNameAddr, CodeAddr, BytesWritten, hKernel32, LoadLibraryAAddr, CodeBuffer, Position, idThread, hThread, hSnapshot, RetVal, LibKernel32, hTarget
Define.CONTEXT ThreadContext
Define.THREADENTRY32 ThreadInfo
;Zielprozess öffnen
hTarget = OpenProcess_(#PROCESS_ALL_ACCESS, 0, IdTarget)
If hTarget = 0
ProcedureReturn 0
EndIf
;ID des Hauptthreads ermitteln
ThreadInfo\dwSize = SizeOf(ThreadInfo)
hSnapshot = CreateToolhelp32Snapshot_(#TH32CS_SNAPTHREAD, 0)
If hSnapshot<>0
RetVal = Thread32First_(hSnapshot, @ThreadInfo)
If RetVal<>0
If ThreadInfo\th32OwnerProcessID = idTarget
idThread = ThreadInfo\th32ThreadID
Else
Repeat
RetVal = Thread32Next_(hSnapshot, @ThreadInfo)
If RetVal = 0
Break
Else
If ThreadInfo\th32OwnerProcessID = idTarget
idThread = ThreadInfo\th32ThreadID
Break
EndIf
EndIf
Until RetVal = 0
EndIf
CloseHandle_(hSnapshot)
EndIf
EndIf
If idThread = 0
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
;Addresse von LoadLibraryA ermitteln
hKernel32 = GetModuleHandle_("Kernel32.dll")
If hKernel32 = 0
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
LoadLibraryAAddr = GetProcAddress_(hKernel32, "LoadLibraryA")
If LoadLibraryAAddr = 0
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
;Thread öffnen
LibKernel32 = OpenLibrary(#PB_Any, "Kernel32.dll")
hThread = CallFunction(LibKernel32, "OpenThread", #THREAD_ALL_ACCESS, 0, idThread)
If hThread = 0
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
;Dateiname der DLL in den Zielprozess schreiben
FileNameLen = Len(FileName) + 1
FileNameAddr = VirtualAllocEx_(hTarget, 0, FileNameLen, #MEM_COMMIT | #MEM_RESERVE, #PAGE_READWRITE)
If FileNameAddr = 0
CloseHandle_(hThread)
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
If WriteProcessMemory_(hTarget, FileNameAddr, FileName, FileNameLen, @BytesWritten) = 0
CloseHandle_(hThread)
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
If BytesWritten<>FileNameLen
CloseHandle_(hThread)
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
;Speicher im Zielprozess für den Code allokieren
CodeAddr = VirtualAllocEx_(hTarget, 0, 22, #MEM_COMMIT | #MEM_RESERVE, #PAGE_EXECUTE_READWRITE)
If CodeAddr = 0
CloseHandle_(hThread)
VirtualFreeEx_(hTarget, FileNameAddr, 0, #MEM_RELEASE)
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
;Speicher für die Codegenerierung allokieren
CodeBuffer = AllocateMemory(22)
;Hauptthread anhalten
If SuspendThread_(hThread) = -1
CloseHandle_(hThread)
VirtualFreeEx_(hTarget, FileNameAddr, 0, #MEM_RELEASE)
VirtualFreeEx_(hTarget, CodeAddr, 0, #MEM_RELEASE)
FreeMemory(CodeBuffer)
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
;EIP-Register des Hauptthreads besorgen
ThreadContext\ContextFlags = #CONTEXT_CONTROL
If GetThreadContext_(hThread, @ThreadContext) = 0
VirtualFreeEx_(hTarget, FileNameAddr, 0, #MEM_RELEASE)
VirtualFreeEx_(hTarget, CodeAddr, 0, #MEM_RELEASE)
FreeMemory(CodeBuffer)
ResumeThread_(hThread)
CloseHandle_(hThread)
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
;Code generieren
PokeB(CodeBuffer, $68) ;push
Position + 1
PokeL(CodeBuffer + Position, ThreadContext\Eip)
Position + 4
PokeB(CodeBuffer + Position, $9C) ;pushfd
Position + 1
PokeB(CodeBuffer + Position, $60) ;pushad
Position + 1
PokeB(CodeBuffer + Position, $68) ;push
Position + 1
PokeL(CodeBuffer + Position, FileNameAddr)
Position + 4
PokeB(CodeBuffer + Position, $B8) ;mov eax,const
Position + 1
PokeL(CodeBuffer + Position, LoadLibraryAAddr)
Position + 4
PokeW(CodeBuffer + Position, $D0FF) ;call eax
Position + 2
PokeB(CodeBuffer + Position, $61) ;popad
Position + 1
PokeB(CodeBuffer + Position, $9D) ;popfd
Position + 1
PokeB(CodeBuffer + Position, $C3) ;ret
;Code in den Zielprozess schreiben
If WriteProcessMemory_(hTarget, CodeAddr, CodeBuffer, 22, @BytesWritten) = 0
VirtualFreeEx_(hTarget, FileNameAddr, 0, #MEM_RELEASE)
VirtualFreeEx_(hTarget, CodeAddr, 0, #MEM_RELEASE)
FreeMemory(CodeBuffer)
ResumeThread_(hThread)
CloseHandle_(hThread)
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
If BytesWritten<>22
VirtualFreeEx_(hTarget, FileNameAddr, 0, #MEM_RELEASE)
VirtualFreeEx_(hTarget, CodeAddr, 0, #MEM_RELEASE)
FreeMemory(CodeBuffer)
ResumeThread_(hThread)
CloseHandle_(hThread)
CloseHandle_(hTarget)
ProcedureReturn 0
EndIf
;EIP-Register auf den Code setzen
ThreadContext\Eip = CodeAddr
ThreadContext\ContextFlags = #CONTEXT_CONTROL
SetThreadContext_(hThread, @ThreadContext)
;Zielprozess weiterlaufen lassen
ResumeThread_(hThread)
;Aufräumen
Delay(1000)
VirtualFreeEx_(hTarget, FileNameAddr, 0, #MEM_RELEASE)
VirtualFreeEx_(hTarget, CodeAddr, 0, #MEM_RELEASE)
FreeMemory(CodeBuffer)
CloseHandle_(hThread)
CloseHandle_(hTarget)
ProcedureReturn 1
EndProcedure
Wow64Hook.dll:
Code: Alles auswählen
Procedure DisableWow64FsRedirection(Flag)
If OSVersion()> = #PB_OS_Windows_Vista
Protected DLL = OpenLibrary(#PB_Any, "kernel32.dll")
Protected IsWow64, Result
If DLL
If CallFunction(DLL, "IsWow64Process", GetCurrentProcess_(), @IsWow64)
If IsWow64
Result = CallFunction(DLL, "Wow64EnableWow64FsRedirection", Flag ! 1)
EndIf
EndIf
CloseLibrary(DLL)
EndIf
EndIf
ProcedureReturn Result
EndProcedure
ProcedureDLL AttachProcess(Dummy)
DisableWow64FsRedirection(#True)
EndProcedure
Launcher:
Code: Alles auswählen
XIncludeFile "inject.pbi"
Define TCName$, Window, Pid, DllName$
; Titel Des Total - Commanders
TCName$ = "Total Commander 7.04a - Thomas Schulze"
; Name der DLL
DllName$ = "Wow64Hook.dll"
Window = FindWindow_(0, TCName$)
If Window
If GetWindowThreadProcessId_(Window, @Pid)
InjectDLL(Pid, DllName$)
EndIf
EndIf
// Edit:
Hab jetzt mal in ein paar Programme die DLL reingehookt. Die Ergebnisse sind ganz unterschiedlich, FreeCommander/WinAmp/Programmer's Notepad/PB/Firefox usw. machts anscheinend gar nichts wenn die DLL drinnen ist, der Windows Explorer und Notepad stürzen ab

.