浏览代码

添加Extern Exception异常弹框的劫持处理,需要注意的是Ca210Ctrl.dll模块内异常,注意基址查找和偏移值。

Jeff 3 年之前
父节点
当前提交
d55f1d18f4
共有 1 个文件被更改,包括 48 次插入1 次删除
  1. 48 1
      Source/Assist/Assist/Assist.cpp

+ 48 - 1
Source/Assist/Assist/Assist.cpp

@@ -4,6 +4,7 @@
 #include "stdafx.h"
 #include "Assist.h"
 #include <stdio.h> 
+#include <process.h>
 
 // 全局CallData;
 CALLDATA _cd_Go;
@@ -15,6 +16,7 @@ CALLDATA _cd_Go_SN;
 CALLDATA _cd_Go_CommunicationError;
 CALLDATA _cd_Go_SetCommunicationError;
 CALLDATA _cd_Initial_failed;
+CALLDATA _cd_ExternalException;
 
 // 调试耗时值ms;
 DWORD dwElapsed = 0;
@@ -43,6 +45,7 @@ void Call_MySaveAsOutputData();
 void Call_MyInitial_Failed();
 void Call_MyGoCommunicationError();
 void Call_MyGoSetCommunicationError();
+void Call_MyExternalException();
 
 // 其他函数;
 void SetChannel(int nChannel);
@@ -94,6 +97,22 @@ void InitCallData()
 	*(LPDWORD)(&_cd_Disconnect.szMyCallData[1]) = (DWORD)_cd_Disconnect.myCall - _cd_Disconnect.dwOriginalAddr - JMP_DLEN;
 #pragma endregion
 
+#pragma region ExternalException
+	// 必须获取模块地址:ca210ctrl.dll
+	HMODULE hModule = GetModuleHandle(_T("Ca210Ctrl.dll"));
+	// 044D677C | FF15 78645404 | call dword ptr ds:[<&RaiseException>] |
+	_cd_ExternalException.myCall = Call_MyExternalException;
+	// 044D6782 | 5F | pop edi |
+	_cd_ExternalException.dwBack2Addr = (DWORD)hModule + 0x106782;
+	_cd_ExternalException.dwOriginalAddr = (DWORD)hModule + 0x10677C;
+	_cd_ExternalException.dwOriginalCallAddr = 0x769F05B0;
+
+	_cd_ExternalException.nMyCallDataLen = JMP_DLEN;
+	memset(_cd_ExternalException.szMyCallData, 0x90, CALL_LEN);
+	_cd_ExternalException.szMyCallData[0] = 0xE9; // 汇编硬编码:jmp [4字节地址];
+	*(LPDWORD)(&_cd_ExternalException.szMyCallData[1]) = (DWORD)_cd_ExternalException.myCall - _cd_ExternalException.dwOriginalAddr - JMP_DLEN;
+#pragma endregion
+
 #pragma region Go按钮劫持
 	// Go 
 	_cd_Go.myCall = Call_MyGo;
@@ -171,6 +190,9 @@ BOOL HijackedAllCall()
 	if ( !(bHijack = HijackedCall(&_cd_Go_SetCommunicationError)) )
 		goto end;
 
+	if ( !(bHijack = HijackedCall(&_cd_ExternalException)) )
+		goto end;
+
 end:
 	return bHijack;
 }
@@ -438,7 +460,7 @@ void __declspec(naked) Call_MyGoSetCommunicationError()
 		mov ESI, dwESI;
 		mov EDI, dwEDI;
 		// 执行原Call;
-		//call _cd_Go_SetCommunicationError.dwOriginalCallAddr
+		//call _cd_Go_SetCommunicationError.dwOriginalCallAddr	// 经验证,即使不执行原call,也会弹异常框;
 		// 返回劫持地址下一行;
 		jmp _cd_Go_SetCommunicationError.dwBack2Addr
 	}
@@ -526,6 +548,31 @@ void __declspec(naked) Call_MyConnect()
 	}   
 }
 
+void MyExternalException()
+{
+	MessageBox(NULL, _T("MyExternalExceptionE06D7363,重启异常待重启"), _T("提示"), MB_OK);
+	::exit(0);
+}
+
+void __declspec(naked) Call_MyExternalException()
+{
+	// 备份寄存器;
+	__asm {
+		pushad;
+	}
+
+	MyExternalException();
+
+	__asm
+	{
+		// 恢复寄存器; 
+		popad;
+		// 失败:JMP到出错处理;
+		call _cd_ExternalException.dwOriginalCallAddr;
+		jmp _cd_ExternalException.dwBack2Addr;
+	} 
+}
+
 void MyDisconnect()
 {
 	MessageBox(NULL, _T("MyDisconnect Function"), _T("MyDisconnect"), MB_OK);