After protect a file (.EXE on this case), .EXE calls MessageBoxA and that API can be hooked to log or alter his params.
If there any chance to make on VMProtect a API Wrapper to avoid calling the original hooked API?
For MessageBox you can use the same trick as VMProtect.
A simple example:
#include <windows.h>
#include <winternl.h>
#pragma comment(lib, "ntdll.lib")
extern "C" NTSTATUS NTAPI ZwRaiseHardError(LONG ErrorStatus, ULONG NumberOfParameters, ULONG UnicodeStringParameterMask,
PULONG_PTR Parameters, ULONG ValidResponseOptions, PULONG Response);
int main()
{
UNICODE_STRING msgBody;
UNICODE_STRING msgCaption;
ULONG ErrorResponse;
const wchar_t cBody[] = L"Some message";
msgBody.Length = sizeof(cBody) - sizeof(wchar_t);
msgBody.MaximumLength = msgBody.Length;
msgBody.Buffer = (wchar_t*)cBody;
const wchar_t cCaption[] = L"Caption";
msgCaption.Length = sizeof(cCaption) - sizeof(wchar_t);
msgCaption.MaximumLength = msgCaption.Length;
msgCaption.Buffer = (wchar_t*)cCaption;
const ULONG_PTR msgParams[] = {
(ULONG_PTR)&msgBody,
(ULONG_PTR)&msgCaption,
(ULONG_PTR)(MB_OK | MB_ICONWARNING)
};
ZwRaiseHardError(0x50000018L, 0x00000003L, 3, (PULONG_PTR)msgParams, NULL, &ErrorResponse);
return 0;
}
Under certain conditions this trick does not work correctly, but these conditions are so rare that you can ignore it.
This example can be improved by performing a manual map for ntdll
Because your msgParams have wrong structure. They must have 4 parameters (the latest parameter specifies the timeout and usually it equals INFINITE):
const ULONG_PTR msgParams = {
(ULONG_PTR)&msgBody,
(ULONG_PTR)&msgCaption,
(ULONG_PTR)(MB_OK | MB_ICONWARNING),
INFINITE
};
ZwRaiseHardError(0x50000018L, > 4> , 3, (PULONG_PTR)msgParams, NULL, &ErrorResponse); // 0x50000018L = STATUS_SERVICE_NOTIFICATION | HARDERROR_OVERRIDE_ERRORMODE
Возможно с количеством параметров Вы правы, так как код не мой, а был взят с одного из форумов, но с 3 параметрами тоже работает (видимо из-за счастливого стечения обстоятельств).
Под редким условием я подразумевал настройку ACL для процесса. Окно отображается, но оно пустое (без нужного текста).
При надобности я могу зарепортить в отдельной теме с демкой для воспроизведения проблемы
Без нужного текста - это скорее всего проблемы с инициализацией UNICODE_STRING, либо с массивом аргументов (например сам массив не выровнен на границу 4/8 байт).
__forceinline void InitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
{
if (SourceString)
DestinationString->MaximumLength = (DestinationString->Length = (USHORT)(wcslen(SourceString) * sizeof(WCHAR))) + sizeof(UNICODE_NULL);
else
DestinationString->MaximumLength = DestinationString->Length = 0;
DestinationString->Buffer = (PWCH)SourceString;
}
MessageBox was just a example, what we can do with anothers APIs ?
Can VMP add a API Wrapping?
Для реализации в VMP эта проблема тоже актуальна. Отправил репорт на info@vmpsoft.com с описанием и файлами для демонстрации (Subject письма: “ZwRaiseHardError bug”)
Any news or plans?
VMProtect doesn’t protect system DLLs against hooks.
Its there any chance to add a API Wrapper ?
What prevents you from implementing a check for the most common hooks yourself?
Because there are too many ways of hook a APi.
Checking for 0xE9 or things like that can be bypassed just changing the instruction hooking method.
You have now answered your own question
Nope, patching the first bytes of a API can be avoided by making somewhat type of API Wrapper like Themida does, but honestly i don’t like Themida, i don’t use it and i will not use it, im on the VMProtect way, and will be nice if it can add somewhat of API Wrapper too!
Themida does not prevent hooks in any way. API Wrapping is just hiding the original imports, nothing more.
As I said above, you can implement your own checks for the most common hooks. Alternatively, make a manual map for the library whose functions you are calling. In any case, this is not the responsibility of the protectors.
Themida’s API Wrapper protects the first instructions of a API recreating and obsfucating it from scratch (all info is here) XeroNic(HS) BLOG :: Themida 의 API Wrapping 분석(?) causing that any hooked API doesn’t get called.
A protector should make somewhat of protection against hooked APIs, because some programs like API Monitor’s rohitab ( API Monitor: Spy on API Calls and COM Interfaces (Freeware 32-bit and 64-bit Versions!) | rohitab.com ) hooks all APIs to see how the program works.
It says exactly the same thing as I told you.
Themida destroys the original IAT and replaces the WINAPI calls in the application code with its own bridges, so that the process dump does not identify which WINAPI functions are being used. Only hooks that are installed using IAT patching will not work.
Nothing prevents me from installing the hook by patching the first bytes of the functions directly in the system libraries themselves (which I use successfully, it works fine for any protected application, including Themida).
Functions in system libraries are not protected in any way (you can check this simply by opening the protected application in a debugger and checking the system library functions).
So you’re either a troll or you just don’t understand how it works.