int cef_version_info(int entry);

///// Structure used to read data from a stream. The functions of this structure// may be called on any thread.///typedef struct _cef_stream_reader_t {  ///  // Base structure.  ///  cef_base_ref_counted_t base;   ///  // Read raw binary data.  ///  size_t(CEF_CALLBACK* read)(struct _cef_stream_reader_t* self,                             void* ptr,                             size_t size,                             size_t n);   ///  // Seek to the specified offset position. |whence| may be any one of SEEK_CUR,  // SEEK_END or SEEK_SET. Returns zero on success and non-zero on failure.  ///  int(CEF_CALLBACK* seek)(struct _cef_stream_reader_t* self,                          int64 offset,                          int whence);   ///  // Return the current offset position.  ///  int64(CEF_CALLBACK* tell)(struct _cef_stream_reader_t* self);   ///  // Return non-zero if at end of file.  ///  int(CEF_CALLBACK* eof)(struct _cef_stream_reader_t* self);   ///  // Returns true (1) if this reader performs work like accessing the file  // system which may block. Used as a hint for determining the thread to access  // the reader from.  ///  int(CEF_CALLBACK* may_block)(struct _cef_stream_reader_t* self);} cef_stream_reader_t;  ///// Create a new cef_stream_reader_t object from a file.///CEF_EXPORT cef_stream_reader_t* cef_stream_reader_create_for_file(    const cef_string_t* fileName); ///// Create a new cef_stream_reader_t object from data.///CEF_EXPORT cef_stream_reader_t* cef_stream_reader_create_for_data(    void* data,    size_t size);

///// All ref-counted framework structures must include this structure first.///typedef struct _cef_base_ref_counted_t {  ///  // Size of the data structure.  ///  size_t size;   ///  // Called to increment the reference count for the object. Should be called  // for every new copy of a pointer to a given object.  ///  void(CEF_CALLBACK* add_ref)(struct _cef_base_ref_counted_t* self);   ///  // Called to decrement the reference count for the object. If the reference  // count falls to 0 the object should self-delete. Returns true (1) if the  // resulting reference count is 0.  ///  int(CEF_CALLBACK* release)(struct _cef_base_ref_counted_t* self);   ///  // Returns true (1) if the current reference count is 1.  ///  int(CEF_CALLBACK* has_one_ref)(struct _cef_base_ref_counted_t* self);   ///  // Returns true (1) if the current reference count is at least 1.  ///  int(CEF_CALLBACK* has_at_least_one_ref)(struct _cef_base_ref_counted_t* self);} cef_base_ref_counted_t;  ///// Structure that supports the reading of zip archives via the zlib unzip API.// The functions of this structure should only be called on the thread that// creates the object.///typedef struct _cef_zip_reader_t {  ///  // Base structure.  ///  cef_base_ref_counted_t base;   ///  // Moves the cursor to the first file in the archive. Returns true (1) if the  // cursor position was set successfully.  ///  int(CEF_CALLBACK* move_to_first_file)(struct _cef_zip_reader_t* self);   ///  // Moves the cursor to the next file in the archive. Returns true (1) if the  // cursor position was set successfully.  ///  int(CEF_CALLBACK* move_to_next_file)(struct _cef_zip_reader_t* self);   ///  // Moves the cursor to the specified file in the archive. If |caseSensitive|  // is true (1) then the search will be case sensitive. Returns true (1) if the  // cursor position was set successfully.  ///  int(CEF_CALLBACK* move_to_file)(struct _cef_zip_reader_t* self,                                  const cef_string_t* fileName,                                  int caseSensitive);   ///  // Closes the archive. This should be called directly to ensure that cleanup  // occurs on the correct thread.  ///  int(CEF_CALLBACK* close)(struct _cef_zip_reader_t* self);   // The below functions act on the file at the current cursor position.   ///  // Returns the name of the file.  ///  // The resulting string must be freed by calling cef_string_userfree_free().  cef_string_userfree_t(CEF_CALLBACK* get_file_name)(      struct _cef_zip_reader_t* self);   ///  // Returns the uncompressed size of the file.  ///  int64(CEF_CALLBACK* get_file_size)(struct _cef_zip_reader_t* self);   ///  // Returns the last modified timestamp for the file.  ///  cef_basetime_t(CEF_CALLBACK* get_file_last_modified)(      struct _cef_zip_reader_t* self);   ///  // Opens the file for reading of uncompressed data. A read password may  // optionally be specified.  ///  int(CEF_CALLBACK* open_file)(struct _cef_zip_reader_t* self,                               const cef_string_t* password);   ///  // Closes the file.  ///  int(CEF_CALLBACK* close_file)(struct _cef_zip_reader_t* self);   ///  // Read uncompressed file contents into the specified buffer. Returns < 0 if  // an error occurred, 0 if at the end of file, or the number of bytes read.  ///  int(CEF_CALLBACK* read_file)(struct _cef_zip_reader_t* self,                               void* buffer,                               size_t bufferSize);   ///  // Returns the current offset in the uncompressed file contents.  ///  int64(CEF_CALLBACK* tell)(struct _cef_zip_reader_t* self);   ///  // Returns true (1) if at end of the file contents.  ///  int(CEF_CALLBACK* eof)(struct _cef_zip_reader_t* self);} cef_zip_reader_t; ///// Writes the contents of |src_dir| into a zip archive at |dest_file|. If// |include_hidden_files| is true (1) files starting with "." will be included.// Returns true (1) on success.  Calling this function on the browser process UI// or IO threads is not allowed.///CEF_EXPORT int cef_zip_directory(const cef_string_t* src_dir,                                 const cef_string_t* dest_file,                                 int include_hidden_files);  ///// Create a new cef_zip_reader_t object. The returned object's functions can// only be called from the thread that created the object.///CEF_EXPORT cef_zip_reader_t* cef_zip_reader_create(    struct _cef_stream_reader_t* stream);

///// Opens the file for reading of uncompressed data. A read password may// optionally be specified.///int(CEF_CALLBACK* open_file)(struct _cef_zip_reader_t* self,                             const cef_string_t* password);

int CEF_CALLBACK hook_read_file(    struct _cef_zip_reader_t* self,    void* buffer,    size_t bufferSize) {     // 调用原始的read_file    int result = old_read_file(self, buffer, bufferSize);     // 获取文件名    cef_string_userfree_t ptr_file_name = get_file_name(self);     // 对比文件名    if (strcmp(ptr_file_name->str, "xxxx") == 0) {         // 如果文件名满足要求，则可以考虑遍历buffer修改关键点    }}

///// Returns the browser host object. This function can only be called in the// browser process./// struct _cef_browser_host_t* CEF_CALLBACK get_host(      struct _cef_browser_t* self); ///// Open developer tools (DevTools) in its own browser. The DevTools browser// will remain associated with this browser. If the DevTools browser is// already open then it will be focused, in which case the |windowInfo|,// |client| and |settings| parameters will be ignored. If |inspect_element_at|// is non-NULL then the element at the specified (x,y) location will be// inspected. The |windowInfo| parameter will be ignored if this browser is// wrapped in a cef_browser_view_t.///void CEF_CALLBACK show_dev_tools(    struct _cef_browser_host_t* self,    const struct _cef_window_info_t* windowInfo,    struct _cef_client_t* client,    const struct _cef_browser_settings_t* settings,    const cef_point_t* inspect_element_at);

///// Structure used to represent a browser window. When used in the browser// process the functions of this structure may be called on any thread unless// otherwise indicated in the comments. When used in the render process the// functions of this structure may only be called on the main thread.///typedef struct _cef_browser_t {  ///  // Base structure.  ///  cef_base_ref_counted_t base;   ///  // Returns the browser host object. This function can only be called in the  // browser process.  ///  struct _cef_browser_host_t*(CEF_CALLBACK* get_host)(      struct _cef_browser_t* self);   ///  // Returns true (1) if the browser can navigate backwards.  ///  int(CEF_CALLBACK* can_go_back)(struct _cef_browser_t* self);   ///  // Navigate backwards.  ///  void(CEF_CALLBACK* go_back)(struct _cef_browser_t* self);   ///  // Returns true (1) if the browser can navigate forwards.  ///  int(CEF_CALLBACK* can_go_forward)(struct _cef_browser_t* self);   ///  // Navigate forwards.  ///  void(CEF_CALLBACK* go_forward)(struct _cef_browser_t* self);   ///  // Returns true (1) if the browser is currently loading.  ///  int(CEF_CALLBACK* is_loading)(struct _cef_browser_t* self);   ///  // Reload the current page.  ///  void(CEF_CALLBACK* reload)(struct _cef_browser_t* self);   ///  // Reload the current page ignoring any cached data.  ///  void(CEF_CALLBACK* reload_ignore_cache)(struct _cef_browser_t* self);   ///  // Stop loading the page.  ///  void(CEF_CALLBACK* stop_load)(struct _cef_browser_t* self);   ///  // Returns the globally unique identifier for this browser. This value is also  // used as the tabId for extension APIs.  ///  int(CEF_CALLBACK* get_identifier)(struct _cef_browser_t* self);   ///  // Returns true (1) if this object is pointing to the same handle as |that|  // object.  ///  int(CEF_CALLBACK* is_same)(struct _cef_browser_t* self,                             struct _cef_browser_t* that);   ///  // Returns true (1) if the window is a popup window.  ///  int(CEF_CALLBACK* is_popup)(struct _cef_browser_t* self);   ///  // Returns true (1) if a document has been loaded in the browser.  ///  int(CEF_CALLBACK* has_document)(struct _cef_browser_t* self);   ///  // Returns the main (top-level) frame for the browser window. In the browser  // process this will return a valid object until after  // cef_life_span_handler_t::OnBeforeClose is called. In the renderer process  // this will return NULL if the main frame is hosted in a different renderer  // process (e.g. for cross-origin sub-frames).  ///  struct _cef_frame_t*(CEF_CALLBACK* get_main_frame)(      struct _cef_browser_t* self);   ///  // Returns the focused frame for the browser window.  ///  struct _cef_frame_t*(CEF_CALLBACK* get_focused_frame)(      struct _cef_browser_t* self);   ///  // Returns the frame with the specified identifier, or NULL if not found.  ///  struct _cef_frame_t*(CEF_CALLBACK* get_frame_byident)(      struct _cef_browser_t* self,      int64 identifier);   ///  // Returns the frame with the specified name, or NULL if not found.  ///  struct _cef_frame_t*(CEF_CALLBACK* get_frame)(struct _cef_browser_t* self,                                                const cef_string_t* name);   ///  // Returns the number of frames that currently exist.  ///  size_t(CEF_CALLBACK* get_frame_count)(struct _cef_browser_t* self);   ///  // Returns the identifiers of all existing frames.  ///  void(CEF_CALLBACK* get_frame_identifiers)(struct _cef_browser_t* self,                                            size_t* identifiersCount,                                            int64* identifiers);   ///  // Returns the names of all existing frames.  ///  void(CEF_CALLBACK* get_frame_names)(struct _cef_browser_t* self,                                      cef_string_list_t names);} cef_browser_t;

// dllmain.cpp : 定义 DLL 应用程序的入口点。#include "pch.h"#include "detours/detours.h"#include "include/capi/cef_browser_capi.h"#include "include/internal/cef_types_win.h"#include "include/capi/cef_client_capi.h"#include "include/internal/cef_win.h"#include <Windows.h>  PVOID g_cef_browser_host_create_browser = nullptr;PVOID g_cef_get_keyboard_handler = NULL;PVOID g_cef_on_key_event = NULL; void SetAsPopup(cef_window_info_t* window_info) {     window_info->style =        WS_OVERLAPPEDWINDOW | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_VISIBLE;    window_info->parent_window = NULL;    window_info->x = CW_USEDEFAULT;    window_info->y = CW_USEDEFAULT;    window_info->width = CW_USEDEFAULT;    window_info->height = CW_USEDEFAULT;}  int CEF_CALLBACK hook_cef_on_key_event(    struct _cef_keyboard_handler_t* self,    struct _cef_browser_t* browser,    const struct _cef_key_event_t* event,    cef_event_handle_t os_event) {     OutputDebugStringA("[detours] hook_cef_on_key_event \n");     auto cef_browser_host = browser->get_host(browser);     // 键盘按下且是F12    if (event->type == KEYEVENT_RAWKEYDOWN && event->windows_key_code == 123) {         cef_window_info_t windowInfo{};        cef_browser_settings_t settings{};        cef_point_t point{};        SetAsPopup(&windowInfo);        OutputDebugStringA("[detours] show_dev_tools \n");         // 开启调试窗口        cef_browser_host->show_dev_tools            (cef_browser_host, &windowInfo, 0, &settings, &point);    }     return reinterpret_cast<decltype(&hook_cef_on_key_event)>        (g_cef_on_key_event)(self, browser, event, os_event);}    struct _cef_keyboard_handler_t* CEF_CALLBACK hook_cef_get_keyboard_handler(    struct _cef_client_t* self) {    OutputDebugStringA("[detours] hook_cef_get_keyboard_handler \n");     // 调用原始的修改get_keyboard_handler函数    auto keyboard_handler = reinterpret_cast<decltype(&hook_cef_get_keyboard_handler)>        (g_cef_get_keyboard_handler)(self);    if (keyboard_handler) {         // 记录原始的按键事件回调函数        g_cef_on_key_event = keyboard_handler->on_key_event;         // 修改返回值中的按键事件回调函数        keyboard_handler->on_key_event = hook_cef_on_key_event;    }    return keyboard_handler;} int hook_cef_browser_host_create_browser(    const cef_window_info_t* windowInfo,    struct _cef_client_t* client,    const cef_string_t* url,    const struct _cef_browser_settings_t* settings,    struct _cef_dictionary_value_t* extra_info,    struct _cef_request_context_t* request_context) {     OutputDebugStringA("[detours] hook_cef_browser_host_create_browser \n");     // 记录原始的get_keyboard_handler    g_cef_get_keyboard_handler = client->get_keyboard_handler;     // 修改get_keyboard_handler    client->get_keyboard_handler = hook_cef_get_keyboard_handler;      return reinterpret_cast<decltype(&hook_cef_browser_host_create_browser)>        (g_cef_browser_host_create_browser)(        windowInfo, client, url, settings, extra_info, request_context);} // Hook cef_browser_host_create_browserBOOL APIENTRY InstallHook(){    OutputDebugStringA("[detours] InstallHook \n");    DetourTransactionBegin();    DetourUpdateThread(GetCurrentThread());    g_cef_browser_host_create_browser =        DetourFindFunction("libcef.dll", "cef_browser_host_create_browser");    DetourAttach(&g_cef_browser_host_create_browser,                 hook_cef_browser_host_create_browser);    LONG ret = DetourTransactionCommit();    return ret == NO_ERROR;}  BOOL APIENTRY DllMain( HMODULE hModule,                       DWORD  ul_reason_for_call,                       LPVOID lpReserved                     ){    switch (ul_reason_for_call)    {    case DLL_PROCESS_ATTACH:        InstallHook();        break;    case DLL_THREAD_ATTACH:    case DLL_THREAD_DETACH:    case DLL_PROCESS_DETACH:        break;    }    return TRUE;}

cef_browser_host->show_dev_tools            (cef_browser_host, &windowInfo, 0, &settings, &point);

reinterpret_cast<decltype(cef_browser_host->show_dev_tools)>    (cef_browser_host->close_dev_tools)            (cef_browser_host, &windowInfo, 0, &settings, &point);

# 往期推荐

1.四级分页下的页表自映射与基址随机化原理介绍

2.Android 10属性系统原理，检测与定制源码反检测

3.WhatsApp私信协议实现记录

4.Android4.4和8.0 DexClassLoader加载流程分析之寻找脱壳点

5.实战DLL注入

6.某车联网APP加固分析