dll注入原理分析

获取目标进程的pid
获取目标进程的句柄
向目标进程写入注入dll的路径字符串
建立远程线程

// zhuru1.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include "pch.h"
#include <iostream>
#include <stdio.h> 
#include <Windows.h> 
#include <TlHelp32.h> 
//Code By Pnig0s1992 
//Date:2012,3,13 


DWORD getProcessHandle(LPCTSTR lpProcessName)//根据进程名查找进程PID 
{
	DWORD dwRet = 0;
	HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (hSnapShot == INVALID_HANDLE_VALUE)
	{
		printf("\n获得进程快照失败%d", GetLastError());
		return dwRet;
	}

	PROCESSENTRY32 pe32;//声明进程入口对象 
	pe32.dwSize = sizeof(PROCESSENTRY32);//填充进程入口对象大小 
	Process32First(hSnapShot, &pe32);//遍历进程列表 
	do
	{
		if (!lstrcmp(pe32.szExeFile, lpProcessName))//查找指定进程名的PID 
		{
			dwRet = pe32.th32ProcessID;
			break;
		}
	} while (Process32Next(hSnapShot, &pe32));
	CloseHandle(hSnapShot);
	return dwRet;//返回 
}

INT main(INT argc, CHAR * argv[])
{
	LPCTSTR aimProcess = L"Music_Player.exe";
	DWORD dwPid = getProcessHandle((LPCTSTR)aimProcess);//得到目标进程pid
	LPCSTR lpDllName = "E:\\c_project\\Dlltest\\Debug\\Dlltest.dll";
	HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwPid);//获取目标进程的句柄
	if (hProcess == NULL)
	{
		printf("\n获取进程句柄错误%d", GetLastError());
		return -1;
	}
	DWORD dwSize = strlen(lpDllName) + 1;
	DWORD dwHasWrite;
	LPVOID lpRemoteBuf = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);//获取目标进程的空间
	if (WriteProcessMemory(hProcess, lpRemoteBuf, lpDllName, dwSize, &dwHasWrite))//向目标进程空间写入注入dll的路径
	{
		if (dwHasWrite != dwSize)
		{
			VirtualFreeEx(hProcess, lpRemoteBuf, dwSize, MEM_COMMIT);
			CloseHandle(hProcess);
			return -1;
		}

	}
	else
	{
		printf("\n写入远程进程内存空间出错%d。", GetLastError());
		CloseHandle(hProcess);
		return -1;
	}

	DWORD dwNewThreadId;
	LPVOID lpLoadDll = LoadLibraryA;
	HANDLE hNewRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpLoadDll, lpRemoteBuf, 0, &dwNewThreadId);//在目标进程中创建远程线程
	if (hNewRemoteThread == NULL)
	{
		printf("\n建立远程线程失败%d", GetLastError());
		CloseHandle(hProcess);
		return -1;
	}

	WaitForSingleObject(hNewRemoteThread, INFINITE);//等待远程线程执行结束

	CloseHandle(hNewRemoteThread);//关闭远程线程

	//准备卸载之前注入的Dll 
	DWORD dwHandle, dwID;
	LPVOID pFunc = GetModuleHandleA;//获得在远程线程中被注入的Dll的句柄 
	HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, lpRemoteBuf, 0, &dwID);
	WaitForSingleObject(hThread, INFINITE);//等待远程线程执行结束
	GetExitCodeThread(hThread, &dwHandle);//线程的结束码即为Dll模块儿的句柄 
	CloseHandle(hThread);
	pFunc = FreeLibrary;
	hThread = CreateRemoteThread(hThread, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, (LPVOID)dwHandle, 0, &dwID); //将FreeLibraryA注入到远程线程中去卸载Dll 
	WaitForSingleObject(hThread, INFINITE);//等待远程线程执行结束
	CloseHandle(hThread);
	CloseHandle(hProcess);
	return 0;
}

问题一

每次当我先用ollydbg附加Music_Player.exe这个进程时，然后调试我们的注入程序，当执行到

OpenProcess返回NULL。
想到一个办法，先不用olly attach，等在目标进程中创建了远程线程后，我们在进行attach，于是乎陷入了死锁
ollydbg停在了 ntdll.ldrshutdownthread

注入程序停在了WaitForSingleObject(hNewRemoteThread, INFINITE);等待目标线程的结束

在询问过高人后发现是自己知识还存在很大的盲区。
ollydbg在attach目标进程后会将所有进程全部挂起

我们创建的远程线程也被挂起了，因为WaitForSingleObject(hNewRemoteThread, INFINITE)，所以我们的注入程序会被阻塞


点击resume all threads，激活所有线程

程序正常运行