[Windows] Instrumentation Callback 등록하기

Instrumentation Callback's Strcture

Instrumentation Callback을 등록하기 위해서는 특정한 구조체를 사용해야 한다.

typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION
{
    ULONG Version;  // x64 -> 0 | x86 -> 1
    ULONG Reserved; // Always 0
    PVOID Callback; // VOID (CALLBACK *InstrumentationCallback)();
} PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, *PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION;

How to Reigster Instrumentation Callback?

Instrumentation Callback을 등록하기 위해서는 NtSetInforamationProcess 함수를 사용해야 한다.

VOID CALLBACK InstrumentationCallback()
{
    printf("Instrumentation Callback\n");
}

PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION nirvana;
nirvana.Version = 0;
nirvana.Reserved = 0;
nirvana.Callback = InstrumentationCallback;

NtSetInformationProcess(hProcess, PROCESS_INFO_CLASS_INSTRUMENTATION, &nirvana, sizeof(PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION));

Example

#include <stdio.h>
#include <windows.h>

#define PROCESS_INFO_CLASS_INSTRUMENTATION 40

NTSYSAPI NTSTATUS NTAPI NtSetInformationProcess(HANDLE ProcessHandle, PROCESS_INFORMATION_CLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength);

typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION
{
    ULONG Version;
    ULONG Reserved;
    PVOID Callback;
} PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, *PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION;

VOID CALLBACK InstrumentationCallback()
{
    printf("Instrumentation Callback\n");
}

int main(int argc, char *argv[])
{
    PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION nirvana;
    nirvana.Version = 0;
    nirvana.Reserved = 0;
    nirvana.Callback = InstrumentationCallback;
    
    NtSetInformationProcess(GetCurrentProcess(), PROCESS_INFO_CLASS_INSTRUMENTATION, &nirvana, sizeof(PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION));
    OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());
    
    return 0;
}