0%

随笔-一个DLL注入器

发表于 2024-11-19 更新于 2024-11-23 分类于随笔阅读次数：
本文字数： 877 阅读时长 ≈ 3 分钟

远程线程注入

代码

使用CreateRemoteThread，在Debug下编译，简单的创建远程线程，没有反反注入

#include <stdio.h>
#include <windows.h>
#include <tchar.h>
#include <tlhelp32.h>
#include <stdbool.h>
#pragma warning(disable:4996)
#pragma warning(disable:28251)
#define IDC_BUTTON 0x100
#define IDC_EDIT_1 0x101
#define IDC_EDIT_2 0x102
LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);
HINSTANCE g_hInstance;
HWND g_hwnd;

BOOL LoadDll(DWORD dwProcessID, const char* szDllPathName) {

	BOOL bRet;
	HANDLE hProcess;
	HANDLE hThread;
	DWORD dwLength;
	DWORD dwLoadAddr;
	LPVOID lpAllocAddr;
	DWORD dwThreadID;
	HMODULE hModule;

	bRet = 0;
	dwLoadAddr = 0;
	hProcess = 0;

	// 1. 获取进程句柄  被注入的进程的句柄
	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID);
	if (hProcess == NULL) {
        MessageBox(g_hwnd, TEXT("OpenProcess failed!"), TEXT("提示"), MB_OK);
		return FALSE;
	}

	// 2. 获取DLL文件路径的长度，并在最后+1，因为要加上0结尾的长度
	dwLength = strlen(szDllPathName) + 1;

	// 3. 在目标进程分配内存  在被注入的进程中分别配一段空间，存储DLL的地址
	lpAllocAddr = VirtualAllocEx(hProcess, NULL, dwLength, MEM_COMMIT, PAGE_READWRITE);
	if (lpAllocAddr == NULL) {
        MessageBox(g_hwnd, TEXT("VirtualAllocEx failed!"), TEXT("提示"), MB_OK);
		CloseHandle(hProcess);
		return FALSE;
	}

	// 4. 拷贝DLL路径名字到被注入进程的内存
	bRet = WriteProcessMemory(hProcess, lpAllocAddr, reinterpret_cast<LPCVOID>(szDllPathName), dwLength, NULL);
	if (!bRet) {
        MessageBox(g_hwnd, TEXT("WriteProcessMemory failed!"), TEXT("提示"), MB_OK);
		CloseHandle(hProcess);
		return FALSE;
	}

	// 5. 获取模块句柄
	// LoadLibrary这个函数是在kernel32.dll这个模块中的，所以需要先获取kernel32.dll这个模块的句柄
	hModule = GetModuleHandle("kernel32.dll");
	if (!hModule) {
        MessageBox(g_hwnd, TEXT("GetModuleHandle failed!"), TEXT("提示"), MB_OK);
		CloseHandle(hProcess);
		return FALSE;
	}

	// 6. 获取LoadLibraryA函数地址
	dwLoadAddr = reinterpret_cast<DWORD>(GetProcAddress(hModule, "LoadLibraryA"));
	if (!dwLoadAddr) {
        MessageBox(g_hwnd, TEXT("GetProcessAddress failed!"), TEXT("提示"), MB_OK);
		CloseHandle(hModule);
		CloseHandle(hProcess);
		return FALSE;
	}
	// 7. 创建远程线程，加载DLL
	hThread = CreateRemoteThread(hProcess, NULL, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>(dwLoadAddr), lpAllocAddr, 0, &dwThreadID);
	if (!hThread) {
        MessageBox(g_hwnd, TEXT("CreateRemoteThread failed!"), TEXT("提示"), MB_OK);
		CloseHandle(hModule);
		CloseHandle(hProcess);
		return FALSE;
	}
	CloseHandle(hThread);
	CloseHandle(hProcess);
	return TRUE;
}

DWORD GetProcessIdByName(const char* processName) {
	HANDLE hSnap;
	PROCESSENTRY32 pe32;
	DWORD processId = 0;
	hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (hSnap == INVALID_HANDLE_VALUE) {
        MessageBox(g_hwnd, TEXT("Failed to create process snapshot!"), TEXT("提示"), MB_OK);
		return 0;
	}
	pe32.dwSize = sizeof(PROCESSENTRY32);
	if (!Process32First(hSnap, &pe32)) {
        MessageBox(g_hwnd, TEXT("Failed to get the first process!"), TEXT("提示"), MB_OK);
		CloseHandle(hSnap);
		return 0;
	}
	while (true) {
		if (strcmp((char const*)pe32.szExeFile, processName) == 0) {
			processId = pe32.th32ProcessID;
			break;
		}
		if (!Process32Next(hSnap, &pe32)) {
			break;
		}
	}
	CloseHandle(hSnap);
	return processId;
}

int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow)
{
    char szOutBuff[0x80];
    TCHAR className[] = TEXT("DllInjector");
    WNDCLASS wndclass = { 0 };                                
    wndclass.hbrBackground = (HBRUSH)COLOR_BACKGROUND;        
    wndclass.lpszClassName = className;                        
    wndclass.hInstance = hInstance;                           
    wndclass.lpfnWndProc = WindowProc;
    RegisterClass(&wndclass);                                       

    HWND hwnd = CreateWindow(className,TEXT("Dll Injector (CreateRemoteThread)"),WS_OVERLAPPEDWINDOW,300,350,320,180,NULL,NULL,hInstance,NULL);
    g_hwnd = hwnd;
    if (hwnd == NULL)                       
    {
        MessageBox(NULL, TEXT("CreateWindow failed!"), TEXT("提示"), MB_OK);
        return -10;
    }
    ShowWindow(hwnd, SW_SHOW);
    //消息处理
    MSG msg;
    BOOL bRet;
    while ((bRet = GetMessage(&msg, NULL, 0, 0)) != 0)
    {
        if (bRet == -1)
        {
            MessageBox(NULL, TEXT("GetMessage failed!"), TEXT("提示"), MB_OK);
        }
        else
        {
            // 转换消息
            TranslateMessage(&msg);
            // 分发消息
            DispatchMessage(&msg);
        }
    }
    return 0;
}

//消息处理函数
LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    switch (uMsg)
    {
    case WM_DESTROY:
    {
        PostQuitMessage(0);
        return 0;
    }
    case WM_CREATE:
    {
		CreateWindow(TEXT("EDIT"), TEXT(""), WS_CHILD | WS_VISIBLE | ES_AUTOHSCROLL | ES_MULTILINE, 100, 20, 170, 20, hwnd, (HMENU)IDC_EDIT_1, g_hInstance, NULL);
		CreateWindow(TEXT("EDIT"), TEXT(""), WS_CHILD | WS_VISIBLE | ES_AUTOHSCROLL | ES_MULTILINE, 100, 55, 170, 20, hwnd, (HMENU)IDC_EDIT_2, g_hInstance, NULL);
		CreateWindow(TEXT("STATIC"), TEXT("进程名："), WS_CHILD | WS_VISIBLE, 15, 20, 75, 20, hwnd, NULL, g_hInstance, NULL);
		CreateWindow(TEXT("STATIC"), TEXT("DLL路径："), WS_CHILD | WS_VISIBLE, 15, 55, 75, 20, hwnd, NULL, g_hInstance, NULL);
		CreateWindow(TEXT("BUTTON"), TEXT("注入DLL"), WS_CHILD | WS_VISIBLE, 100, 100, 100, 30, hwnd, (HMENU)IDC_BUTTON, g_hInstance, NULL);
		DragAcceptFiles(hwnd, TRUE);
		break;
	}

    case WM_COMMAND:
    {
        switch (LOWORD(wParam))
        {
        case IDC_BUTTON:
        {
            TCHAR processName[0x200];
            TCHAR dllPath[0x200];

            // 获取IDC_EDIT_1中的字符串
            HWND hEdit1 = GetDlgItem(hwnd, IDC_EDIT_1);
            GetWindowText(hEdit1, processName, sizeof(processName));

            // 获取IDC_EDIT_2中的字符串
            HWND hEdit2 = GetDlgItem(hwnd, IDC_EDIT_2);
            GetWindowText(hEdit2, dllPath, sizeof(dllPath));

            DWORD processId = GetProcessIdByName((const char*)processName);
            if (processId == NULL) {
                MessageBox(hwnd, TEXT("Failed to find the process"), TEXT("提示"), MB_OK);
                return NULL;
            }

            // 注入DLL
            if (LoadDll(processId, (const char*)dllPath)) {
                MessageBox(hwnd, TEXT("DLL injected successfully."), TEXT("提示"), MB_OK);
                return NULL;
            }
            else {
                MessageBox(hwnd, TEXT("Failed to inject DLL."), TEXT("提示"), MB_OK);
                return NULL;
            }

            break;
        }

        }

        break;
    }
    case WM_DROPFILES:
    {
        HDROP hDrop = (HDROP)wParam;
        UINT nFiles = DragQueryFile(hDrop, (UINT)-1, NULL, 0);
        if (nFiles >= 1)
        {
            TCHAR szFilePath[MAX_PATH];

            // 获取拖拽的文件的路径
            if (DragQueryFile(hDrop, 0, szFilePath, MAX_PATH) > 0)
            {
                // 将文件路径复制到IDC_EDIT_2中
                HWND hEdit2 = GetDlgItem(hwnd, IDC_EDIT_2);
                SetWindowText(hEdit2, szFilePath);
            }
        }
        DragFinish(hDrop);
        break;
    }
    }
    return DefWindowProc(hwnd, uMsg, wParam, lParam);
}