1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201

202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233

;Copyright (c) 2008 by Christoph Husse, SecurityRevolutions e.K.
;
;Permission is hereby granted, free of charge, to any person obtaining a copy of this software and 
;associated documentation files (the "Software"), to deal in the Software without restriction, 
;including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, 
;and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, 
;subject to the following conditions:
;
;The above copyright notice and this permission notice shall be included in all copies or substantial 
;portions of the Software.
;
;THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT 
;LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 
;IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 
;WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 
;SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
;
;Visit http://www.codeplex.com/easyhook for more information.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

.386
.model flat, c
.code


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;	
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Trampoline_ASM_x86
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
public Trampoline_ASM_x86@0

Trampoline_ASM_x86@0 PROC

; Handle:		1A2B3C05h
; NETEntry:		1A2B3C03h
; OldProc:		1A2B3C01h
; NewProc:		1A2B3C00h
; NETOutro:		1A2B3C06h
; IsExecuted:	1A2B3C02h
; RetAddr:		1A2B3C04h
; Ptr:NewProc:	1A2B3C07h

	mov eax, esp
	push ecx ; both are fastcall parameters, ECX is also used as "this"-pointer
	push edx
	mov ecx, eax; InitialRSP value for NETIntro()...
	
	mov eax, 1A2B3C02h
	db 0F0h ; interlocked increment execution counter
	inc dword ptr [eax]
	
; is a user handler available?
	mov eax, 1A2B3C07h
	cmp dword ptr[eax], 0
	
	db 3Eh ; branch usually taken
	jne CALL_NET_ENTRY
	
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; call original method
		mov eax, 1A2B3C02h
		db 0F0h ; interlocked decrement execution counter
		dec dword ptr [eax]
		mov eax, 1A2B3C01h
		jmp TRAMPOLINE_EXIT

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; call hook handler or original method...
CALL_NET_ENTRY:	
	
; call NET intro
	push ecx
	push dword ptr [esp + 12] ; push return address
	push 1A2B3C05h ; Hook handle
	mov eax, 1A2B3C03h
	call eax ; Hook->NETIntro(Hook, RetAddr);
	
; should call original method?
	test eax, eax
	
	db 3Eh ; branch usually taken
	jne CALL_HOOK_HANDLER
	
	; call original method
		mov eax, 1A2B3C02h
		db 0F0h ; interlocked decrement execution counter
		dec dword ptr [eax]
		mov eax, 1A2B3C01h
		jmp TRAMPOLINE_EXIT
		
CALL_HOOK_HANDLER:
; adjust return address --- ATTENTION: this offset "83h" will also change if CALL_NET_OUTRO moves due to changes...
	mov dword ptr [esp + 8], 1A2B3C04h

; call hook handler
	mov eax, 1A2B3C00h
	jmp TRAMPOLINE_EXIT 

CALL_NET_OUTRO: ; this is where the handler returns...

; call NET outro --- ATTENTION: Never change EAX/EDX from now on!
	push 0 ; space for return address
	push eax
	push edx
	
	lea eax, [esp + 8]
	push eax ; Param 2: Address of return address
	push 1A2B3C05h ; Param 1: Hook handle
	mov eax, 1A2B3C06h
	call eax ; Hook->NETOutro(Hook);
	
	mov eax, 1A2B3C02h
	db 0F0h ; interlocked decrement execution counter
	dec dword ptr [eax]
	
	pop edx ; restore return value of user handler...
	pop eax
	
; finally return to saved return address - the caller of this trampoline...
	ret
	
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; generic outro for both cases...
TRAMPOLINE_EXIT:

	pop edx
	pop ecx
	
	jmp eax ; ATTENTION: In case of hook handler we will return to CALL_NET_OUTRO, otherwise to the caller...
	
; outro signature, to automatically determine code size
	db 78h
	db 56h
	db 34h
	db 12h

Trampoline_ASM_x86@0 ENDP

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;	
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; HookInjectionCode_ASM_x86
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
public Injection_ASM_x86
Injection_ASM_x86 PROC
; no registers to save, because this is the thread main function
; save first param (address of hook injection information)
	mov esi, dword ptr [esp + 4]
	
; call LoadLibraryW(Inject->EasyHookPath);
	push dword ptr [esi + 8]
	
	call dword ptr [esi + 40] ; LoadLibraryW@4
	mov ebp, eax
	test eax, eax
	je HookInject_FAILURE_A
	
; call GetProcAddress(eax, Inject->EasyHookEntry);
	push dword ptr [esi + 24]
	push ebp
	call dword ptr [esi + 56] ; GetProcAddress@8
	test eax, eax
	je HookInject_FAILURE_B
	
; call EasyHookEntry(Inject);
	push esi
	call eax
	push eax ; save error code

; call FreeLibrary(ebp)
	push ebp
	call dword ptr [esi + 48] ; FreeLibrary@4
	test eax, eax
	je HookInject_FAILURE_C
	jmp HookInject_EXIT
	
HookInject_FAILURE_A:
	call dword ptr [esi + 88] ; GetLastError
	or eax, 40000000h
	jmp HookInject_FAILURE_E
HookInject_FAILURE_B:
	call dword ptr [esi + 88] ; GetLastError
	or eax, 10000000h
	jmp HookInject_FAILURE_E	
HookInject_FAILURE_C:
	call dword ptr [esi + 88] ; GetLastError
	or eax, 30000000h
	jmp HookInject_FAILURE_E	
HookInject_FAILURE_E:
	push eax ; save error value
	
HookInject_EXIT:

	push 0
	push 0
	push 0; // shadow space for executable stack part...

; call VirtualProtect(Outro, 4, PAGE_EXECUTE_READWRITE, &OldProtect)
	lea ebx, dword ptr [esp + 8] ; we'll write to shadow space
	push ebx
	push 40h
	push 12
	push ebx
	call dword ptr [esi + 72] ; VirtualProtect@16
	test eax, eax
	
	jne HookInject_EXECUTABLE

	; failed to make stack executable
		call dword ptr [esi + 88] ; GetLastError
		or eax, 20000000h
		add esp, 16
		ret
		
HookInject_EXECUTABLE:
; save outro to executable stack
	mov dword ptr [esp],	 0448BD3FFh		; call ebx [VirtualFree()]
	mov dword ptr [esp + 4], 05C8B0C24h		; mov eax, [esp + 12]
	mov dword ptr [esp + 8], 0E3FF1024h		; mov ebx, [esp + 16]
											; jmp ebx [exit thread]
	
; save params for VirtualFree(Inject->RemoteEntryPoint, 0, MEM_RELEASE);
	mov ebx, [esi + 64] ; VirtualFree()
	push 08000h
	push 0
	push dword ptr [esi + 16]
	
	lea eax, dword ptr [esp + 12]
	jmp eax
	
; outro signature, to automatically determine code size
	db 78h
	db 56h
	db 34h
	db 12h

Injection_ASM_x86 ENDP

END