dll注入进程后卸载的代码

最新推荐文章于 2024-03-25 19:58:25 发布

iiprogram

最新推荐文章于 2024-03-25 19:58:25 发布

阅读量3.8k

点赞数

分类专栏： windows底层核心編程文章标签： dll null access

本文链接：https://blog.youkuaiyun.com/iiprogram/article/details/751911

版权

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

这是一个关于如何在远程进程中加载DLL并随后卸载它的C++代码示例。通过使用`VirtualAllocEx`，`WriteProcessMemory`，`CreateRemoteThread`等函数，实现了DLL的注入和卸载。代码中定义了`LoadRemoteLibrary`和`FreeRemoteLibrary`两个关键函数，分别用于加载和释放远程DLL。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

//App.cpp
#include "stdafx.h"
#include <windows.h>

#define MAX_SIZE 1024*16
#define DLL "D:/Code/TestCode/UnloadDll/UnloadDll/Debug/demo.dll" // 需要完整路径
HMODULE LoadRemoteLibrary(HANDLE hProcess,const char *pcLibraryName );
BOOL FreeRemoteLibrary(HANDLE hProcess, HMODULE hRemoteLibrary );

int main(int argc, char* argv [])
{
    DWORD dwPID = 0 ;
    HANDLE hNewHandle = NULL ;
    HMODULE hRemoteHandle = NULL ;
    int i=0 ;
    if( argc < 2 )
    {
        return -1 ;
    }

    dwPID = atoi(argv[1 ]);

    hNewHandle = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPID );

    if( NULL == hNewHandle )
    {
        printf("[-] OpenProcess failed.../r/n" );
        return -2 ;
    }

    hRemoteHandle = LoadRemoteLibrary(hNewHandle,DLL );

    if( NULL == hRemoteHandle   )
    {
        printf("[-] LoadRemoteLibaray failed.../r/n" );
        return -3 ;
    }

    printf("[+] LoadRemoteLibaray succeed!/r/n" );

    for(i=0;i<=20;i ++)
    {
        printf("." );
        Sleep(100 );
    }
    printf("/r/n" );

    if( FreeRemoteLibrary(hNewHandle,hRemoteHandle) == NULL )
    {
        printf("[-] FreeRemoteLibaray failed.../r/n" );
        return -4 ;
    }
    printf("[+] FreeRemoteLibrary succeed!/r/n" );
    return 0 ;
}

HMODULE LoadRemoteLibrary(HANDLE hProcess,const char *pcLibraryName )
{
    void* pvRemoteMem=NULL ;
    DWORD dwBytesWritten ;
    HMODULE nRet=NULL ;
    DWORD dwRemoteThreadId ;
    HANDLE hRemoteThread=NULL ;

     __try
     {
        pvRemoteMem=VirtualAllocEx(hProcess,NULL,strlen(pcLibraryName)+1,MEM_COMMIT,PAGE_EXECUTE_READWRITE );
        if (NULL == pvRemoteMem )
        {
            printf("[-] VirtualAllocEx failed.../r/n" );
            __leave ;
        }

        if (FALSE == WriteProcessMemory(hProcess,pvRemoteMem,(void*)pcLibraryName,strlen(pcLibraryName)+1,&dwBytesWritten ))
        {
            printf("[-] WriteProcessMemory failed.../r/n" );
            __leave ;
        }
        hRemoteThread=CreateRemoteThread(hProcess,NULL,MAX_SIZE,(LPTHREAD_START_ROUTINE )
#ifdef UNICODE
        GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryW" ),
#else
        GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA" ),
#endif
        pvRemoteMem,0,&dwRemoteThreadId );
        if (NULL == hRemoteThread )
        {
            printf("[-] CreateRemoteThread failed.../r/n" );
            __leave ;
        }
        else
        {
             __try
             {
                WaitForSingleObject(hRemoteThread,INFINITE );
                GetExitCodeThread(hRemoteThread,(DWORD*)&nRet );
                printf("ErrorCode:%d/r/n",GetLastError () );
            }
             __finally
             {
                CloseHandle(hRemoteThread );
            }
        }
    }
     __finally
     {
        if (NULL != pvRemoteMem )
            VirtualFreeEx(hProcess,pvRemoteMem,0,MEM_RELEASE );
    }
    return nRet ;
}

BOOL FreeRemoteLibrary(HANDLE hProcess, HMODULE hRemoteLibrary )
{
    DWORD dwRemoteThreadId ;
    HANDLE hRemoteThread ;
    BOOL nRet ;

    hRemoteThread=CreateRemoteThread(hProcess,NULL,MAX_SIZE ,
        (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32.dll"), "FreeLibrary"),(void*)hRemoteLibrary,0,&dwRemoteThreadId );

    if (NULL == hRemoteThread )
        return FALSE ;

    WaitForSingleObject(hRemoteThread,INFINITE );
    GetExitCodeThread(hRemoteThread,(DWORD*)&nRet );
    return nRet ;
}

Code:


//DemoDll.cpp 
#include "stdafx.h" 

BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved 
                     ) 
{ 
    MessageBox(NULL,"DemoMessage","MSG",MB_OK); 
    return TRUE; 
}