├── .gitignore ├── README.md ├── WibuDebugHook.sln └── WibuDebugHook ├── WibuDebugHook.cpp ├── WibuDebugHook.vcxproj ├── WibuDebugHook.vcxproj.filters └── minhook ├── MinHook.h ├── libMinHook.x64.lib └── libMinHook.x86.lib /.gitignore: -------------------------------------------------------------------------------- 1 | bin/ 2 | Release/ 3 | Debug/ 4 | x64/ 5 | .vs/ 6 | *.sdf 7 | *.opensdf 8 | *.suo 9 | *.vcxproj.user 10 | *.VC.*db -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # WibuDebugHook 2 | 3 | Injectable DLL that helps with debugging Wibu CodeMeter. Credits to [TechLord](https://github.com/TechLord-Forever) for providing sample binaries! 4 | 5 | A hollowed process is started with `CreateProcessA`, this is the relevant code: 6 | 7 | ```c++ 8 | DWORD __stdcall DebugLoop(int a1, int a2, char *a3, int a4) 9 | { 10 | DWORD result; // eax@2 11 | int pid; // eax@3 12 | int hThread; // esi@12 13 | DEBUG_EVENT event; // [sp+4h] [bp-330h]@7 14 | CONTEXT ctx; // [sp+64h] [bp-2D0h]@12 15 | 16 | if ( !sub_404D80() ) 17 | return -1; 18 | pid = sub_404FF2(a3); 19 | if ( !pid ) 20 | return -2; 21 | if ( DebugActiveProcess(pid) ) 22 | { 23 | while ( 1 ) 24 | { 25 | while ( 1 ) 26 | { 27 | while ( !WaitForDebugEvent(&event, 500) ) 28 | ; 29 | if ( event.dwDebugEventCode == 1 ) 30 | break; 31 | result = event.dwDebugEventCode - EXIT_PROCESS_DEBUG_EVENT; 32 | if ( event.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT ) 33 | return result; 34 | LABEL_27: 35 | ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE); 36 | } 37 | hThread = OpenThread(0x1FFFFF, 0, event.dwThreadId); 38 | ctx.ContextFlags = CONTEXT_ALL; 39 | GetThreadContext(hThread, &ctx); 40 | if ( event.u.Exception.ExceptionRecord.ExceptionCode > 0xC000001D ) 41 | { 42 | if ( event.u.Exception.ExceptionRecord.ExceptionCode == 0xC0000094 ) 43 | { 44 | ctx.Ebx = 7; 45 | goto LABEL_26; 46 | } 47 | if ( event.u.Exception.ExceptionRecord.ExceptionCode == 0xC0000096 ) 48 | { 49 | ctx.Eip += 3; 50 | goto LABEL_26; 51 | } 52 | } 53 | else 54 | { 55 | if ( event.u.Exception.ExceptionRecord.ExceptionCode == 0xC000001D ) 56 | { 57 | ctx.Eip += 2; 58 | goto LABEL_26; 59 | } 60 | if ( event.u.Exception.ExceptionRecord.ExceptionCode == 0x406D1388 61 | || event.u.Exception.ExceptionRecord.ExceptionCode == 0x80000003 ) 62 | { 63 | goto LABEL_26; 64 | } 65 | if ( event.u.Exception.ExceptionRecord.ExceptionCode == 0xC0000005 66 | && (event.u.Exception.ExceptionRecord.NumberParameters != 2 67 | || event.u.Exception.ExceptionRecord.ExceptionInformation[1] >= 2 68 | && event.u.Exception.ExceptionRecord.ExceptionInformation[1] <= 6) ) 69 | { 70 | ctx.Eip += 7; 71 | LABEL_26: 72 | SetThreadContext(hThread, &ctx); 73 | CloseHandle2(hThread); 74 | goto LABEL_27; 75 | } 76 | } 77 | ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_EXCEPTION_NOT_HANDLED); 78 | CloseHandle2(hThread); 79 | } 80 | } 81 | return -3; 82 | } 83 | ``` 84 | 85 | When debugging, `DebugActiveProcess` will fail, thus killing the process. This causes a check with `OpenProcess` to fail later. In addition to injecting this DLL (I use `version.dll` DLL hijacking), you can use the following [ScyllaHide](https://github.com/x64dbg/ScyllaHide) options to debug Wibu CodeMeter: 86 | 87 | ![ScyllaHide](https://i.imgur.com/EevkEor.png) 88 | -------------------------------------------------------------------------------- /WibuDebugHook.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.26430.14 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WibuDebugHook", "WibuDebugHook\WibuDebugHook.vcxproj", "{1678411B-BB3E-4159-8884-D4A88CA1E035}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {1678411B-BB3E-4159-8884-D4A88CA1E035}.Debug|x64.ActiveCfg = Debug|x64 17 | {1678411B-BB3E-4159-8884-D4A88CA1E035}.Debug|x64.Build.0 = Debug|x64 18 | {1678411B-BB3E-4159-8884-D4A88CA1E035}.Debug|x86.ActiveCfg = Debug|Win32 19 | {1678411B-BB3E-4159-8884-D4A88CA1E035}.Debug|x86.Build.0 = Debug|Win32 20 | {1678411B-BB3E-4159-8884-D4A88CA1E035}.Release|x64.ActiveCfg = Release|x64 21 | {1678411B-BB3E-4159-8884-D4A88CA1E035}.Release|x64.Build.0 = Release|x64 22 | {1678411B-BB3E-4159-8884-D4A88CA1E035}.Release|x86.ActiveCfg = Release|Win32 23 | {1678411B-BB3E-4159-8884-D4A88CA1E035}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | EndGlobal 29 | -------------------------------------------------------------------------------- /WibuDebugHook/WibuDebugHook.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | #include "minhook/MinHook.h" 4 | 5 | #ifdef _WIN64 6 | #pragma comment(lib, "minhook/libMinHook.x64.lib") 7 | #else 8 | #pragma comment(lib, "minhook/libMinHook.x86.lib") 9 | #endif //_WIN64 10 | 11 | typedef BOOL(WINAPI *p_CreateProcessA)( 12 | __in_opt LPCSTR lpApplicationName, 13 | __inout_opt LPSTR lpCommandLine, 14 | __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, 15 | __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, 16 | __in BOOL bInheritHandles, 17 | __in DWORD dwCreationFlags, 18 | __in_opt LPVOID lpEnvironment, 19 | __in_opt LPCSTR lpCurrentDirectory, 20 | __in LPSTARTUPINFOA lpStartupInfo, 21 | __out LPPROCESS_INFORMATION lpProcessInformation); 22 | 23 | typedef HANDLE(WINAPI *p_OpenProcess)( 24 | __in DWORD dwDesiredAccess, 25 | __in BOOL bInheritHandle, 26 | __in DWORD dwProcessId); 27 | 28 | static p_CreateProcessA o_CreateProcessA; 29 | static p_OpenProcess o_OpenProcess; 30 | static DWORD hollowPid = 0; 31 | 32 | static BOOL WINAPI hook_CreateProcessA( 33 | __in_opt LPCSTR lpApplicationName, 34 | __inout_opt LPSTR lpCommandLine, 35 | __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, 36 | __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, 37 | __in BOOL bInheritHandles, 38 | __in DWORD dwCreationFlags, 39 | __in_opt LPVOID lpEnvironment, 40 | __in_opt LPCSTR lpCurrentDirectory, 41 | __in LPSTARTUPINFOA lpStartupInfo, 42 | __out LPPROCESS_INFORMATION lpProcessInformation) 43 | { 44 | auto result = o_CreateProcessA( 45 | lpApplicationName, 46 | lpCommandLine, 47 | lpProcessAttributes, 48 | lpThreadAttributes, 49 | bInheritHandles, 50 | dwCreationFlags, 51 | lpEnvironment, 52 | lpCurrentDirectory, 53 | lpStartupInfo, 54 | lpProcessInformation); 55 | if(!hollowPid && result) 56 | { 57 | if(!lpApplicationName && 58 | lpCommandLine && 59 | !lpProcessAttributes && 60 | !lpThreadAttributes && 61 | !bInheritHandles && 62 | dwCreationFlags == CREATE_SUSPENDED && 63 | !lpEnvironment && 64 | !lpCurrentDirectory) 65 | { 66 | hollowPid = lpProcessInformation->dwProcessId; 67 | } 68 | } 69 | return result; 70 | } 71 | 72 | static HANDLE WINAPI hook_OpenProcess( 73 | __in DWORD dwDesiredAccess, 74 | __in BOOL bInheritHandle, 75 | __in DWORD dwProcessId) 76 | { 77 | auto hProcess = o_OpenProcess( 78 | dwDesiredAccess, 79 | bInheritHandle, 80 | dwProcessId); 81 | if(!hProcess && hollowPid && dwProcessId == hollowPid) 82 | hProcess = HANDLE(1); 83 | return hProcess; 84 | } 85 | 86 | static bool hook() 87 | { 88 | if(MH_Initialize() != MH_OK) 89 | return false; 90 | auto kernel32 = GetModuleHandleW(L"kernelbase.dll") ? L"kernelbase.dll" : L"kernel32.dll"; 91 | if(MH_CreateHookApi(kernel32, "CreateProcessA", &hook_CreateProcessA, (LPVOID*)&o_CreateProcessA) != MH_OK) 92 | return false; 93 | if(MH_CreateHookApi(kernel32, "OpenProcess", &hook_OpenProcess, (LPVOID*)&o_OpenProcess) != MH_OK) 94 | return false; 95 | if(MH_EnableHook(MH_ALL_HOOKS) != MH_OK) 96 | return false; 97 | return true; 98 | } 99 | 100 | extern "C" __declspec(dllexport) BOOL WINAPI DllMain( 101 | _In_ HINSTANCE hinstDLL, 102 | _In_ DWORD fdwReason, 103 | _In_ LPVOID lpvReserved 104 | ) 105 | { 106 | if(fdwReason == DLL_PROCESS_ATTACH) 107 | { 108 | DisableThreadLibraryCalls(hinstDLL); 109 | hook(); 110 | } 111 | return TRUE; 112 | } -------------------------------------------------------------------------------- /WibuDebugHook/WibuDebugHook.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 15.0 23 | {1678411B-BB3E-4159-8884-D4A88CA1E035} 24 | WibuDebugHook 25 | 10.0.14393.0 26 | 27 | 28 | 29 | DynamicLibrary 30 | true 31 | v141_xp 32 | MultiByte 33 | 34 | 35 | DynamicLibrary 36 | false 37 | v141_xp 38 | true 39 | MultiByte 40 | 41 | 42 | DynamicLibrary 43 | true 44 | v141_xp 45 | MultiByte 46 | 47 | 48 | DynamicLibrary 49 | false 50 | v141_xp 51 | true 52 | MultiByte 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | .dll 74 | 75 | 76 | .dll 77 | 78 | 79 | .dll 80 | 81 | 82 | .dll 83 | 84 | 85 | 86 | Level3 87 | Disabled 88 | true 89 | 90 | 91 | 92 | 93 | Level3 94 | Disabled 95 | true 96 | 97 | 98 | 99 | 100 | Level3 101 | MaxSpeed 102 | true 103 | true 104 | true 105 | 106 | 107 | true 108 | true 109 | 110 | 111 | 112 | 113 | Level3 114 | MaxSpeed 115 | true 116 | true 117 | true 118 | 119 | 120 | true 121 | true 122 | 123 | 124 | 125 | 126 | 127 | 128 | 129 | 130 | -------------------------------------------------------------------------------- /WibuDebugHook/WibuDebugHook.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /WibuDebugHook/minhook/MinHook.h: -------------------------------------------------------------------------------- 1 | /* 2 | * MinHook - The Minimalistic API Hooking Library for x64/x86 3 | * Copyright (C) 2009-2017 Tsuda Kageyu. 4 | * All rights reserved. 5 | * 6 | * Redistribution and use in source and binary forms, with or without 7 | * modification, are permitted provided that the following conditions 8 | * are met: 9 | * 10 | * 1. Redistributions of source code must retain the above copyright 11 | * notice, this list of conditions and the following disclaimer. 12 | * 2. Redistributions in binary form must reproduce the above copyright 13 | * notice, this list of conditions and the following disclaimer in the 14 | * documentation and/or other materials provided with the distribution. 15 | * 16 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 17 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 | * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 19 | * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER 20 | * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 21 | * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 22 | * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 23 | * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 24 | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 25 | * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 26 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 | */ 28 | 29 | #pragma once 30 | 31 | #if !(defined _M_IX86) && !(defined _M_X64) && !(defined __i386__) && !(defined __x86_64__) 32 | #error MinHook supports only x86 and x64 systems. 33 | #endif 34 | 35 | #include 36 | 37 | // MinHook Error Codes. 38 | typedef enum MH_STATUS 39 | { 40 | // Unknown error. Should not be returned. 41 | MH_UNKNOWN = -1, 42 | 43 | // Successful. 44 | MH_OK = 0, 45 | 46 | // MinHook is already initialized. 47 | MH_ERROR_ALREADY_INITIALIZED, 48 | 49 | // MinHook is not initialized yet, or already uninitialized. 50 | MH_ERROR_NOT_INITIALIZED, 51 | 52 | // The hook for the specified target function is already created. 53 | MH_ERROR_ALREADY_CREATED, 54 | 55 | // The hook for the specified target function is not created yet. 56 | MH_ERROR_NOT_CREATED, 57 | 58 | // The hook for the specified target function is already enabled. 59 | MH_ERROR_ENABLED, 60 | 61 | // The hook for the specified target function is not enabled yet, or already 62 | // disabled. 63 | MH_ERROR_DISABLED, 64 | 65 | // The specified pointer is invalid. It points the address of non-allocated 66 | // and/or non-executable region. 67 | MH_ERROR_NOT_EXECUTABLE, 68 | 69 | // The specified target function cannot be hooked. 70 | MH_ERROR_UNSUPPORTED_FUNCTION, 71 | 72 | // Failed to allocate memory. 73 | MH_ERROR_MEMORY_ALLOC, 74 | 75 | // Failed to change the memory protection. 76 | MH_ERROR_MEMORY_PROTECT, 77 | 78 | // The specified module is not loaded. 79 | MH_ERROR_MODULE_NOT_FOUND, 80 | 81 | // The specified function is not found. 82 | MH_ERROR_FUNCTION_NOT_FOUND 83 | } 84 | MH_STATUS; 85 | 86 | // Can be passed as a parameter to MH_EnableHook, MH_DisableHook, 87 | // MH_QueueEnableHook or MH_QueueDisableHook. 88 | #define MH_ALL_HOOKS NULL 89 | 90 | #ifdef __cplusplus 91 | extern "C" { 92 | #endif 93 | 94 | // Initialize the MinHook library. You must call this function EXACTLY ONCE 95 | // at the beginning of your program. 96 | MH_STATUS WINAPI MH_Initialize(VOID); 97 | 98 | // Uninitialize the MinHook library. You must call this function EXACTLY 99 | // ONCE at the end of your program. 100 | MH_STATUS WINAPI MH_Uninitialize(VOID); 101 | 102 | // Creates a Hook for the specified target function, in disabled state. 103 | // Parameters: 104 | // pTarget [in] A pointer to the target function, which will be 105 | // overridden by the detour function. 106 | // pDetour [in] A pointer to the detour function, which will override 107 | // the target function. 108 | // ppOriginal [out] A pointer to the trampoline function, which will be 109 | // used to call the original target function. 110 | // This parameter can be NULL. 111 | MH_STATUS WINAPI MH_CreateHook(LPVOID pTarget, LPVOID pDetour, LPVOID *ppOriginal); 112 | 113 | // Creates a Hook for the specified API function, in disabled state. 114 | // Parameters: 115 | // pszModule [in] A pointer to the loaded module name which contains the 116 | // target function. 117 | // pszTarget [in] A pointer to the target function name, which will be 118 | // overridden by the detour function. 119 | // pDetour [in] A pointer to the detour function, which will override 120 | // the target function. 121 | // ppOriginal [out] A pointer to the trampoline function, which will be 122 | // used to call the original target function. 123 | // This parameter can be NULL. 124 | MH_STATUS WINAPI MH_CreateHookApi( 125 | LPCWSTR pszModule, LPCSTR pszProcName, LPVOID pDetour, LPVOID *ppOriginal); 126 | 127 | // Creates a Hook for the specified API function, in disabled state. 128 | // Parameters: 129 | // pszModule [in] A pointer to the loaded module name which contains the 130 | // target function. 131 | // pszTarget [in] A pointer to the target function name, which will be 132 | // overridden by the detour function. 133 | // pDetour [in] A pointer to the detour function, which will override 134 | // the target function. 135 | // ppOriginal [out] A pointer to the trampoline function, which will be 136 | // used to call the original target function. 137 | // This parameter can be NULL. 138 | // ppTarget [out] A pointer to the target function, which will be used 139 | // with other functions. 140 | // This parameter can be NULL. 141 | MH_STATUS WINAPI MH_CreateHookApiEx( 142 | LPCWSTR pszModule, LPCSTR pszProcName, LPVOID pDetour, LPVOID *ppOriginal, LPVOID *ppTarget); 143 | 144 | // Removes an already created hook. 145 | // Parameters: 146 | // pTarget [in] A pointer to the target function. 147 | MH_STATUS WINAPI MH_RemoveHook(LPVOID pTarget); 148 | 149 | // Enables an already created hook. 150 | // Parameters: 151 | // pTarget [in] A pointer to the target function. 152 | // If this parameter is MH_ALL_HOOKS, all created hooks are 153 | // enabled in one go. 154 | MH_STATUS WINAPI MH_EnableHook(LPVOID pTarget); 155 | 156 | // Disables an already created hook. 157 | // Parameters: 158 | // pTarget [in] A pointer to the target function. 159 | // If this parameter is MH_ALL_HOOKS, all created hooks are 160 | // disabled in one go. 161 | MH_STATUS WINAPI MH_DisableHook(LPVOID pTarget); 162 | 163 | // Queues to enable an already created hook. 164 | // Parameters: 165 | // pTarget [in] A pointer to the target function. 166 | // If this parameter is MH_ALL_HOOKS, all created hooks are 167 | // queued to be enabled. 168 | MH_STATUS WINAPI MH_QueueEnableHook(LPVOID pTarget); 169 | 170 | // Queues to disable an already created hook. 171 | // Parameters: 172 | // pTarget [in] A pointer to the target function. 173 | // If this parameter is MH_ALL_HOOKS, all created hooks are 174 | // queued to be disabled. 175 | MH_STATUS WINAPI MH_QueueDisableHook(LPVOID pTarget); 176 | 177 | // Applies all queued changes in one go. 178 | MH_STATUS WINAPI MH_ApplyQueued(VOID); 179 | 180 | // Translates the MH_STATUS to its name as a string. 181 | const char * WINAPI MH_StatusToString(MH_STATUS status); 182 | 183 | #ifdef __cplusplus 184 | } 185 | #endif 186 | 187 | -------------------------------------------------------------------------------- /WibuDebugHook/minhook/libMinHook.x64.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mrexodia/WibuDebugHook/da33941a34e0d5210c4999844cd4f7f4d9263018/WibuDebugHook/minhook/libMinHook.x64.lib -------------------------------------------------------------------------------- /WibuDebugHook/minhook/libMinHook.x86.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mrexodia/WibuDebugHook/da33941a34e0d5210c4999844cd4f7f4d9263018/WibuDebugHook/minhook/libMinHook.x86.lib --------------------------------------------------------------------------------