dll注入进程后卸载的代码

最新推荐文章于 2024-03-25 19:58:25 发布

原创最新推荐文章于 2024-03-25 19:58:25 发布 · 3.8k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#dll #null #access

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

这是一个关于如何在远程进程中加载DLL并随后卸载它的C++代码示例。通过使用`VirtualAllocEx`，`WriteProcessMemory`，`CreateRemoteThread`等函数，实现了DLL的注入和卸载。代码中定义了`LoadRemoteLibrary`和`FreeRemoteLibrary`两个关键函数，分别用于加载和释放远程DLL。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

//App.cpp
#include "stdafx.h"
#include <windows.h>

#define MAX_SIZE 1024*16
#define DLL "D:/Code/TestCode/UnloadDll/UnloadDll/Debug/demo.dll" // 需要完整路径
HMODULE LoadRemoteLibrary(HANDLE hProcess,const char *pcLibraryName);
BOOL FreeRemoteLibrary(HANDLE hProcess, HMODULE hRemoteLibrary);

int main(int argc, char* argv[])
{
    DWORD dwPID = 0;
    HANDLE hNewHandle = NULL;
    HMODULE hRemoteHandle = NULL;
    int i=0;
    if( argc < 2 )
    {
        return -1;
    }

    dwPID = atoi(argv[1]);

    hNewHandle = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPID);

    if( NULL == hNewHandle )
    {
        printf("[-] OpenProcess failed.../r/n");
        return -2;
    }

    hRemoteHandle = LoadRemoteLibrary(hNewHandle,DLL);

    if( NULL == hRemoteHandle  )
    {
        printf("[-] LoadRemoteLibaray failed.../r/n");
        return -3;
    }

    printf("[+] LoadRemoteLibaray succeed!/r/n");

    for(i=0;i<=20;i++)
    {
        printf(".");
        Sleep(100);
    }
    printf("/r/n");

    if( FreeRemoteLibrary(hNewHandle,hRemoteHandle) == NULL )
    {
        printf("[-] FreeRemoteLibaray failed.../r/n");
        return -4;
    }
    printf("[+] FreeRemoteLibrary succeed!/r/n");
    return 0;
}

HMODULE LoadRemoteLibrary(HANDLE hProcess,const char *pcLibraryName)
{
    void* pvRemoteMem=NULL;
    DWORD dwBytesWritten;
    HMODULE nRet=NULL;
    DWORD dwRemoteThreadId;
    HANDLE hRemoteThread=NULL;

    __try
    {
        pvRemoteMem=VirtualAllocEx(hProcess,NULL,strlen(pcLibraryName)+1,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
        if (NULL == pvRemoteMem)
        {
            printf("[-] VirtualAllocEx failed.../r/n");
            __leave;
        }

        if (FALSE == WriteProcessMemory(hProcess,pvRemoteMem,(void*)pcLibraryName,strlen(pcLibraryName)+1,&dwBytesWritten))
        {
            printf("[-] WriteProcessMemory failed.../r/n");
            __leave;
        }
        hRemoteThread=CreateRemoteThread(hProcess,NULL,MAX_SIZE,(LPTHREAD_START_ROUTINE)
#ifdef UNICODE
        GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryW"),
#else
        GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"),
#endif
        pvRemoteMem,0,&dwRemoteThreadId);
        if (NULL == hRemoteThread)
        {
            printf("[-] CreateRemoteThread failed.../r/n");
            __leave;
        }
        else
        {
            __try
            {
                WaitForSingleObject(hRemoteThread,INFINITE);
                GetExitCodeThread(hRemoteThread,(DWORD*)&nRet);
                printf("ErrorCode:%d/r/n",GetLastError() );
            }
            __finally
            {
                CloseHandle(hRemoteThread);
            }
        }
    }
    __finally
    {
        if (NULL != pvRemoteMem)
            VirtualFreeEx(hProcess,pvRemoteMem,0,MEM_RELEASE);
    }
    return nRet;
}

BOOL FreeRemoteLibrary(HANDLE hProcess, HMODULE hRemoteLibrary)
{
    DWORD dwRemoteThreadId;
    HANDLE hRemoteThread;
    BOOL nRet;

    hRemoteThread=CreateRemoteThread(hProcess,NULL,MAX_SIZE,
        (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32.dll"), "FreeLibrary"),(void*)hRemoteLibrary,0,&dwRemoteThreadId);

    if (NULL == hRemoteThread)
        return FALSE;

    WaitForSingleObject(hRemoteThread,INFINITE);
    GetExitCodeThread(hRemoteThread,(DWORD*)&nRet);
    return nRet;
}

Code:


//DemoDll.cpp 
#include "stdafx.h" 

BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved 
                     ) 
{ 
    MessageBox(NULL,"DemoMessage","MSG",MB_OK); 
    return TRUE; 
}