隐藏dll

最新推荐文章于 2023-11-08 18:05:53 发布

fanpeii

最新推荐文章于 2023-11-08 18:05:53 发布

阅读量1.1k

点赞数

CC 4.0 BY-SA版权

分类专栏： windows api 学习心得文章标签： dll module string struct list buffer

本文链接：https://blog.youkuaiyun.com/fanpeii/article/details/6171698

windows api 学习心得专栏收录该内容

20 篇文章

订阅专栏

本文介绍了一种在Windows环境下隐藏DLL的方法，通过直接操作PEB_LDR_DATA结构中的LDR_MODULE链表来实现DLL的隐藏，避免被常规手段检测到。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

这是一段隐藏dll的代码。

#include<windows.h>

typedef struct _UNICODE_STRING {
USHORT   Length;
USHORT   MaximumLength;
   PWSTR   Buffer;
} UNICODE_STRING,*PUNICODE_STRING;

typedef struct _PEB_LDR_DATA
{
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef struct _LDR_MODULE
{
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;
} LDR_MODULE, *PLDR_MODULE;

void HideDll2()
{
    HMODULE hMod = ::GetModuleHandle("123.dll");
    PLIST_ENTRY Head,Cur;
    PPEB_LDR_DATA ldr;
    PLDR_MODULE ldm;
    __asm
    {
        mov eax , fs:[0x30]
        mov ecx , [eax + 0x0c] //Ldr
        mov ldr , ecx
    }
    Head = &(ldr->InLoadOrderModuleList);
    Cur = Head->Flink;
    do
    {
        ldm = CONTAINING_RECORD( Cur, LDR_MODULE, InLoadOrderModuleList);
        //printf("EntryPoint [0x%X]/n",ldm->BaseAddress);
        if( hMod == ldm->BaseAddress)
         {
            ldm->InLoadOrderModuleList.Blink->Flink =
                ldm->InLoadOrderModuleList.Flink;
            ldm->InLoadOrderModuleList.Flink->Blink =
                ldm->InLoadOrderModuleList.Blink;
            ldm->InInitializationOrderModuleList.Blink->Flink =
                ldm->InInitializationOrderModuleList.Flink;
            ldm->InInitializationOrderModuleList.Flink->Blink =
                ldm->InInitializationOrderModuleList.Blink;
            ldm->InMemoryOrderModuleList.Blink->Flink =
                ldm->InMemoryOrderModuleList.Flink;
            ldm->InMemoryOrderModuleList.Flink->Blink =
                ldm->InMemoryOrderModuleList.Blink;
            break;
         }
        Cur= Cur->Flink;
     }while(Head != Cur);
}