代码比较乱不过还是好用的 DLL注入

最新推荐文章于 2021-05-25 08:44:13 发布

原创最新推荐文章于 2021-05-25 08:44:13 发布 · 436 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#dll #null #path #access

本文介绍了一种在Windows环境下实现DLL注入的技术。通过获取目标进程ID并利用远程线程注入DLL，实现了外部DLL文件加载到指定进程的效果。文章提供了完整的C++代码示例，包括获取进程ID、内存分配、远程线程创建等关键步骤。

// fuck of.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include <windows.h>
#include <stdlib.h>
#include <tlhelp32.h>
DWORD GetProcessId (LPSTR szProcName);
BOOL DllInject(DWORD dwProcessId, LPSTR lpszDllPath);
DWORD GetProcessId (LPSTR szProcName){
PROCESSENTRY32 pProcess = {sizeof(PROCESSENTRY32)};
HANDLE hSnapshot = CreateToolhelp32Snapshot (TH32CS_SNAPALL, NULL);
if(Process32First(hSnapshot, &pProcess) == NULL)
{return FALSE;}
do {if((strcmp(*(&szProcName), pProcess.szExeFile) == NULL))
{   CloseHandle(hSnapshot);
return pProcess.th32ProcessID;
}
}
while (Process32Next(hSnapshot, &pProcess));
CloseHandle(hSnapshot); return FALSE;}
BOOL DllInject(DWORD dwProcessId, LPSTR lpszDllPath){
HMODULE hmKernel = GetModuleHandle("Kernell32.dll");
if(dwProcessId == NULL)    {    return FALSE;   }
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
if(hProcess == NULL)    {    return FALSE;   }
CHAR szPath[_MAX_PATH] = "";
GetCurrentDirectoryA(_MAX_PATH, szPath);
strcat(szPath, "//");
strcat(szPath, lpszDllPath);
int nPathLen = strlen(szPath);
LPVOID lpvMem = (PVOID)VirtualAllocEx( hProcess, NULL, strlen(szPath), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess, (PVOID)lpvMem, szPath, strlen(szPath), NULL);
HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibraryA, (PVOID)lpvMem, 0, NULL);
DWORD dwWaitResult = 0, dwExitResult = 0;
if(hThread == NULL) {  return FALSE; }
dwWaitResult = WaitForSingleObject(hThread, 10000);
GetExitCodeThread(hThread, &dwExitResult);
CloseHandle(hThread);
VirtualFreeEx(hProcess, lpvMem, strlen(lpszDllPath), MEM_DECOMMIT | MEM_RELEASE);
CloseHandle(hProcess);    return ((dwWaitResult != WAIT_TIMEOUT) && (dwExitResult > 0));}
int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
  // TODO: Place code here.
DWORD dwProcess = GetProcessId("calc.exe");
DllInject(dwProcess, "inject.dll");
return 0;
}