Hilfe... iShellExecuteHook COM Dll
Verfasst: 03.10.2007 18:33
Hi guys, Inf0Byt3 here.
I need to create a ShellExecute hook dll and I am stuck. This must be a COM Dll and Trond helped me so far, but as my COM knowledge is #Null, I can't get it to work. All this code must just show a messagebox with a filename when you execute something on your computer. Can anyone help me make this code work please? I need it for my malware scanner, as with a kernel driver it's way too hard to communicate.
The reason I posted here is that nobody could help me on the English Forum
. Oh, and please excuse me I posted in english.
Thanks in advance.
Register.REG
Unregister.REG
Thanks.
I need to create a ShellExecute hook dll and I am stuck. This must be a COM Dll and Trond helped me so far, but as my COM knowledge is #Null, I can't get it to work. All this code must just show a messagebox with a filename when you execute something on your computer. Can anyone help me make this code work please? I need it for my malware scanner, as with a kernel driver it's way too hard to communicate.
The reason I posted here is that nobody could help me on the English Forum

Thanks in advance.
Code: Alles auswählen
;===============
;By Trond
;===============
; Turn on unicode
; How to use:
; 1. Compile and put the dll in C:\ShellHook.dll
; 2. Register the dll with the supplied registry scripts
;-
;- ------- ShellExecuteHook -------
Prototype.l ProtoQueryInterface(*This, *Riid.GUID, *ppvObject.LONG)
Prototype.l ProtoAddRef(*This)
Prototype.l ProtoRelease(*This)
Prototype.l ProtoSIShellExecuteHook_Execute(*This, *info.SHELLEXECUTEINFO)
Structure SIShellExecuteHook
QueryInterface.ProtoQueryInterface
AddRef.ProtoAddRef
Release.ProtoRelease
Execute.ProtoSIShellExecuteHook_Execute
EndStructure
Structure TShellExecuteHook
*VTable.SIShellExecuteHook
RefCount.l
EndStructure
Global ObjectCount
Global LockCount
Procedure TShellExecuteHook_QueryInterface(*This.TShellExecuteHook, *Riid.GUID, *Object.LONG)
If IsEqualGUID_(*Riid, ?GUID_IShellExecuteHook) Or IsEqualGUID_(*Riid, ?GUID_IUnknown)
; Correct GUID
*Object\l = *This
*This\VTable\AddRef(*This)
ProcedureReturn #NOERROR
Else
; Wrong GUID
*Object\l = 0
ProcedureReturn #E_NOINTERFACE
EndIf
EndProcedure
Procedure TShellExecuteHook_AddRef(*This.TShellExecuteHook)
*This\RefCount + 1
ProcedureReturn *This\RefCount
EndProcedure
Procedure TShellExecuteHook_Release(*This.TShellExecuteHook)
*This\RefCount - 1
If *This\RefCount = 0
FreeMemory(*This\VTable)
FreeMemory(*This)
ObjectCount - 1
EndIf
ProcedureReturn *This\RefCount
EndProcedure
Procedure TShellExecuteHook_Execute(*This.TShellExecuteHook, *info.SHELLEXECUTEINFO)
MessageRequester("", PeekS(*info\lpFile))
ProcedureReturn #S_FALSE
EndProcedure
Procedure New_TShellExecuteHook()
Protected *Result.TShellExecuteHook
*Result = AllocateMemory(SizeOf(TShellExecuteHook))
*Result\VTable = AllocateMemory(SizeOf(SIShellExecuteHook))
*Result\VTable\QueryInterface = @TShellExecuteHook_QueryInterface()
*Result\VTable\AddRef = @TShellExecuteHook_AddRef()
*Result\VTable\Release = @TShellExecuteHook_Release()
*Result\VTable\Execute = @TShellExecuteHook_Execute()
ProcedureReturn *Result
EndProcedure
;-
;- ------- ClassFactory -------
Prototype ProtoSIClassFactory_CreateInstance(*This, A, B, C)
Prototype ProtoSIClassFactory_LockServer(*This, Lock)
Structure SIClassFactory
QueryInterface.ProtoQueryInterface
AddRef.ProtoAddRef
Release.ProtoRelease
CreateInstance.ProtoSIClassFactory_CreateInstance
LockServer.ProtoSIClassFactory_LockServer
EndStructure
Structure TClassFactory
*VTable.SIClassFactory
EndStructure
Global ClassFactoryObject.TClassFactory
Global ClassFactoryObjectVTable.SIClassFactory
Procedure TClassFactory_QueryInterface(*This.TShellExecuteHook, *Riid.GUID, *Object.LONG)
If IsEqualGUID_(*Riid, ?GUID_IClassFactory) Or IsEqualGUID_(*Riid, ?GUID_IUnknown)
*Object\l = *This
ProcedureReturn #NOERROR
Else
*Object\l = 0
ProcedureReturn #E_NOINTERFACE
EndIf
EndProcedure
Procedure TClassFactory_FixedReference()
ProcedureReturn 1
EndProcedure
Procedure TClassFactory_CreateInstance(*This.TClassFactory, *Aggr, *GUID, *Object.Long)
Protected *Hook.TShellExecuteHook
Protected Result
If *Aggr
Result = #CLASS_E_NOAGGREGATION
Else
*Hook = New_TShellExecuteHook()
*Hook\VTable\AddRef(*Hook)
Result = *Hook\VTable\QueryInterface(*Hook, *GUID, *Object)
*Hook\VTable\Release(*Hook)
If Result = #NOERROR
ObjectCount + 1
EndIf
EndIf
ProcedureReturn Result
EndProcedure
Procedure TClassFactory_LockServer(*This, Lock)
If Lock
LockCount + 1
Else
LockCount - 1
EndIf
ProcedureReturn #NOERROR
EndProcedure
ProcedureDLL DllRegisterServer()
ProcedureReturn #S_OK
EndProcedure
ProcedureDLL DllUnregisterServer()
ProcedureReturn #S_OK
EndProcedure
ProcedureDLL AttachProcess(Instance)
ClassFactoryObject\VTable = @ClassFactoryObjectVTable
ClassFactoryObject\VTable\QueryInterface = @TClassFactory_QueryInterface()
ClassFactoryObject\VTable\AddRef = @TClassFactory_FixedReference()
ClassFactoryObject\VTable\Release = @TClassFactory_FixedReference()
ClassFactoryObject\VTable\CreateInstance = @TClassFactory_CreateInstance()
ClassFactoryObject\VTable\LockServer = @TClassFactory_LockServer()
EndProcedure
ProcedureDLL DllGetClassObject(*objid.GUID, *riid.GUID, *object.LONG)
If IsEqualGUID_(*objid, ?GUID_IShellExecuteHook)
*object\l = @ClassFactoryObject
ProcedureReturn #S_OK
EndIf
*object\l = 0
ProcedureReturn #CLASS_E_CLASSNOTAVAILABLE
EndProcedure
ProcedureDLL DllCanUnloadNow()
If ObjectCount <= 0 And LockCount <= 0
ProcedureReturn #S_OK
Else
ProcedureReturn #S_FALSE
EndIf
EndProcedure
;-
;- Dll Server Registration
;-
;- ------- GUIDs -------
DataSection
GUID_IUnknown:
Data.l $00000000
Data.w $0000, $0000
Data.b $C0, $00, $00, $00, $00, $00, $00, $46
GUID_IClassFactory:
Data.l $00000001
Data.w $0, $0
Data.b $C0, $0, $0, $0, $0, $0, $0, $46
GUID_IShellExecuteHook:
Data.l $65A63651
Data.w $8AFB, $4A2B
Data.b $AC, $75, $CB, $4C, $68, $B0, $DD, $B0
EndDataSection
Code: Alles auswählen
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65A63651-8AFB-4A2B-AC75-CB4C68B0DDB0}]
@="TestHook"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65A63651-8AFB-4A2B-AC75-CB4C68B0DDB0}\InprocServer32]
@="C:\\ShellHook.dll"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{65A63651-8AFB-4A2B-AC75-CB4C68B0DDB0}"="TestHook"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{65A63651-8AFB-4A2B-AC75-CB4C68B0DDB0}"="TestHook"
Code: Alles auswählen
Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65A63651-8AFB-4A2B-AC75-CB4C68B0DDB0}]
@="TestHook"
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65A63651-8AFB-4A2B-AC75-CB4C68B0DDB0}\InprocServer32]
@="C:\\ShellHook.dll"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{65A63651-8AFB-4A2B-AC75-CB4C68B0DDB0}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{65A63651-8AFB-4A2B-AC75-CB4C68B0DDB0}"=-