Win8.1下的 Dll注入测试

最新推荐文章于 2024-10-17 13:34:47 发布

intfre

最新推荐文章于 2024-10-17 13:34:47 发布

阅读量602

点赞数

CC 4.0 BY-SA版权

分类专栏：安全文章标签：源码 windows8 Dll注入 CreateRemoteThreadEx CreateRemoteThread

本文链接：https://blog.youkuaiyun.com/nibiru_holmes/article/details/46411281

安全专栏收录该内容

15 篇文章

订阅专栏

本文详细介绍了一种使用C++实现的DLL注入技术。该技术通过五个关键步骤实现：首先使用OpenProcess函数获取目标进程的句柄；其次利用VirtualAllocEx函数在目标进程中分配内存空间；然后借助WriteProcessMemory函数将DLL路径写入已分配的内存；接着运用CreateRemoteThread函数创建一个新线程来加载DLL；最后关闭句柄以释放资源。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1，OpenProcess获得要注入进程的句柄
2，VirtualAllocEx在远程进程中开辟出一段内存，
3，WriteProcessMemory将Dll的名字写入第二步开辟出的内存中。
4，CreateRemoteThread将LoadLibraryW作为线程函数，参数为Dll的名称，创建新线程
5，CloseHandle关闭线程句柄

<pre name="code" class="cpp">效果如图所示：

效果如图所示：<img src="https://img-blog.youkuaiyun.com/20150608131602100?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />

<img src="https://img-blog.youkuaiyun.com/20150608131622245?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />

<img src="https://img-blog.youkuaiyun.com/20150608131647044?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />

void CMFCApplication5Dlg::OnBnClickedButton1()
{

	CEdit* pBoxOne;
	CEdit* pBoxTwo;
	pBoxOne = (CEdit*)GetDlgItem(IDC_EDIT1);
	pBoxTwo = (CEdit*)GetDlgItem(IDC_EDIT2);


	CString szDllName;
	CString szPid;
	pBoxOne->GetWindowText(szDllName);
	pBoxTwo->GetWindowText(szPid);


	MessageBox(szDllName, _T("DllNmae"), MB_OK);
	MessageBox(szPid, _T("Pid"), MB_OK);
	
	DWORD dwPid = 0;
	dwPid = _ttoi(szPid);
	WCHAR *buffer = (WCHAR*)szDllName.GetBuffer(szDllName.GetLength());
	int bufsize = _tcslen(buffer)*sizeof(WCHAR)+sizeof(WCHAR);
	DWORD dwWriteNum = 0;
	
	
	
	
	
	
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
	if (hProcess == NULL){
		AfxMessageBox(L"get Handle error!");
	}

	

    PVOID Addr = VirtualAllocEx(hProcess, NULL, bufsize, MEM_COMMIT, PAGE_READWRITE);
	if (Addr == NULL){
		AfxMessageBox(L"get Addr error!");
	}
	else AfxMessageBox(TEXT("申请成功"));



	if (!WriteProcessMemory(hProcess, Addr, buffer, bufsize, &dwWriteNum)){

		AfxMessageBox(TEXT("写入失败"));

	}
	else AfxMessageBox(TEXT("写入成功"));
	
	if (!GetModuleHandle(L"Kernel32.dll")){
		AfxMessageBox(TEXT("获取失败"));
	}
	FARPROC pFunAddr = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryW");
	if (!pFunAddr){
		AfxMessageBox(TEXT("GetProcAddress获取失败"));

	}

	DWORD dwNewThreadId = NULL;
	HANDLE hThread = CreateRemoteThreadEx(hProcess, NULL, 0,
		(LPTHREAD_START_ROUTINE)pFunAddr, Addr, 0, NULL, &dwNewThreadId);
	if (dwNewThreadId == NULL){ AfxMessageBox(TEXT("注入失败")); }

	else AfxMessageBox(TEXT("成功注入"));

	
	CloseHandle(hThread);
	CloseHandle(hProcess);
	CDialogEx::OnOK();
}