一种躲避模块检测的方法。（断链隐藏模块Ldr）含代码。

最新推荐文章于 2024-08-07 01:40:20 发布

原创最新推荐文章于 2024-08-07 01:40:20 发布 · 4.6k 阅读

4 ·

CC 4.0 BY-SA版权

文章标签：

#module #c

游戏应用逆向专栏收录该内容

6 篇文章

订阅专栏

本文介绍了一种在Windows环境下隐藏模块的技术实现。通过直接操作进程的PEB_LDR_DATA结构，遍历InLoadOrderModuleList链表，找到目标模块并修改其双向链表指针，从而实现在内存中对该模块的隐藏。

void hide_module()
{
	HMODULE hMod = AfxGetApp()->m_hInstance;
	PLIST_ENTRY Head,Cur;
	PPEB_LDR_DATA ldr;
	PLDR_MODULE ldm;
	__asm
	{
		mov eax , fs:[0x30]
			mov ecx , [eax + 0x0c] //Ldr
			mov ldr , ecx
	}
	Head = &(ldr->InLoadOrderModuleList);
	Cur = Head->Flink;
	do
	{
		ldm = CONTAINING_RECORD( Cur, LDR_MODULE, InLoadOrderModuleList);
		if( hMod == ldm->BaseAddress)
		{
			ldm->InLoadOrderModuleList.Blink->Flink =
				ldm->InLoadOrderModuleList.Flink;
			ldm->InLoadOrderModuleList.Flink->Blink =
				ldm->InLoadOrderModuleList.Blink; 
			ldm->InInitializationOrderModuleList.Blink->Flink =
				ldm->InInitializationOrderModuleList.Flink;
			ldm->InInitializationOrderModuleList.Flink->Blink =
				ldm->InInitializationOrderModuleList.Blink;  
			ldm->InMemoryOrderModuleList.Blink->Flink =
				ldm->InMemoryOrderModuleList.Flink;
			ldm->InMemoryOrderModuleList.Flink->Blink =
				ldm->InMemoryOrderModuleList.Blink;  
			break;
		}
		Cur= Cur->Flink; 
	}while(Head != Cur);
}