将dll从进程模块列表中移除并保持正常运行

「爱情、让人受尽委屈。」 2022-03-19 15:16 213阅读 0赞

/\*

URL: http://hi.baidu.com/zxhouse

Email: LZX\*QQ.COM

将dll从进程模块列表中移除并保持正常运行，这玩意想想是挺简单，n久前byshell就用了，

简单的思路就是给当前的dll内存映像做份拷贝，然后跳到那份拷贝的地址空间的代码，回头free掉原来的dll，

然后马上用VirtualAlloc在原基址上申请块同样大小的空间，并将那份拷贝还原回去，再跳回去执行。完。

代码写完后再实际程序中应用后发现问题，一旦调用到malloc或new的话就会崩溃，

于是去看了下byshell的代码，发现他申请内存是用VirtualAlloc，但是我大量的代码都是用new来分配，而且类对象不好用VirtualAlloc来分配吧~

经调式才清楚，原来每个dll，windows都会给其分配一个heap，

在freelibrary时系统会将其完全destroy掉，不怕你内存泄露。

调试时在FreeLibrary后HeapDestroy断点正好触发一次，就是这一次那个heap给销毁了。

解决办法就是在FreeLibrary前修改HeapDestroy的第一条指令为return，FreeLibrary后再修复。

实践证明，稳定......

\*/

\#include <windows.h>

\#include <stdio.h>

\#include <tlhelp32.h>

\#include <psapi.h>

\#pragma comment(lib, "Psapi.lib")

\#define \_\_printf printf

void HideLibrary(HMODULE hModule, LPVOID pCallBackAddr, LPVOID lParam);

typedef struct

HMODULE lpDllBase;

LPVOID lpNewDllBase;

PTHREAD\_START\_ROUTINE pAddress;

LPVOID lParam;

\}UNLOADLIB\_CALLBACK, \*PUNLOADLIB\_CALLBACK;

typedef

LPVOID WINAPI VIRTUALALLOC(

LPVOID lpAddress,

SIZE\_T dwSize,

DWORD flAllocationType,

DWORD flProtect

);

typedef

BOOL WINAPI VIRTUALFREE(

LPVOID lpAddress,

SIZE\_T dwSize,

DWORD dwFreeType

);

typedef

BOOL WINAPI HEAPDESTROY(

HANDLE hHeap

);

typedef

HMODULE WINAPI LOADLIBRARY(

LPCTSTR lpFileName

);

typedef

HANDLE WINAPI CREATETHREAD(

LPSECURITY\_ATTRIBUTES lpThreadAttributes,

SIZE\_T dwStackSize,

LPTHREAD\_START\_ROUTINE lpStartAddress,

LPVOID lpParameter,

DWORD dwCreationFlags,

LPDWORD lpThreadId

);

typedef void \*    \_\_cdecl MEMCPY(void \*, const void \*, size\_t);

BOOL incLibraryCount(HMODULE hMe)

//FreeLibrary后很多系统dll也会free掉，所以将所有已加载的再load一次以增加计数

HANDLE hModsSnap =    CreateToolhelp32Snapshot(TH32CS\_SNAPMODULE, 0);

if(INVALID\_HANDLE\_VALUE == hModsSnap)

return FALSE;

MODULEENTRY32 meModuleEntry;

meModuleEntry.dwSize = sizeof(MODULEENTRY32);

if(!Module32First(hModsSnap, &meModuleEntry))

CloseHandle(hModsSnap);

return FALSE;

if(LoadLibrary(meModuleEntry.szModule) == hMe)

FreeLibrary(hMe);

\} while(Module32Next(hModsSnap, &meModuleEntry));

CloseHandle(hModsSnap);

return TRUE;

//枚举指定进程的所有线程

DWORD WINAPI EnumAndSetThreadState(LPVOID lParam)

HANDLE hThreadSnap = NULL;

THREADENTRY32 te32;

memset(&te32,0,sizeof(te32));

te32.dwSize = sizeof(THREADENTRY32);

hThreadSnap = CreateToolhelp32Snapshot(TH32CS\_SNAPTHREAD,0);

DWORD myThreadId = GetCurrentThreadId();

DWORD pid = GetCurrentProcessId();

if (Thread32First(hThreadSnap, &te32))

if (pid == te32.th32OwnerProcessID)

if(myThreadId != te32.th32ThreadID)

HANDLE hThread = OpenThread(

THREAD\_SUSPEND\_RESUME,

FALSE,

te32.th32ThreadID);

if(hThread != NULL)

if((int)lParam)

ResumeThread(hThread);

else

SuspendThread(hThread);

CloseHandle(hThread);

while (Thread32Next(hThreadSnap,&te32));

CloseHandle( hThreadSnap );

return 0;

DWORD WINAPI GotoCallBackAddr(LPVOID lParam)

PUNLOADLIB\_CALLBACK cbFunc = (PUNLOADLIB\_CALLBACK)lParam;

DWORD dwThreadId;

HANDLE hThread;

if(cbFunc->pAddress)

hThread = CreateThread(

NULL,

cbFunc->pAddress,

cbFunc->lParam,

&dwThreadId);

if(hThread)

CloseHandle(hThread);

//那份dll的拷贝不需要了，释放~

VirtualFree(cbFunc->lpNewDllBase, 0, MEM\_DECOMMIT);

delete cbFunc;

return 0;

DWORD WINAPI UnLoadLibrary(LPVOID lParam)

//\_\_asm INT 3

\_\_printf("UnLoadLibrary Entry.\\r\\n");

BYTE HeapDestroy\_HookCode\_bak\[4\];

BYTE HeapDestroy\_HookCode\[4\] = "\\xC2\\x04\\x00";//RETN 0004

MODULEINFO modinfo;

DWORD oldProtect;

PUNLOADLIB\_CALLBACK cbFunc = (PUNLOADLIB\_CALLBACK)lParam;

HMODULE hDllInstance = cbFunc->lpDllBase;

char dllpath\_bak\[MAX\_PATH\];

GetModuleFileName(hDllInstance, dllpath\_bak, sizeof(dllpath\_bak));

GetModuleInformation(GetCurrentProcess(), hDllInstance, &modinfo, sizeof(MODULEINFO));

//给所有dll(除了自己)增加计数,防止FreeLibrary的时候那些dll给系统卸载掉

incLibraryCount(hDllInstance);

//保险起见，挂起其他线程，搞定后再恢复

EnumAndSetThreadState((LPVOID)FALSE);

//FreeLibrary之后原来存放api地址的内存也会被释放，

//但是FreeLibrary之后还有些动作，趁现在还没free，关键API记下来

VIRTUALALLOC \*\_VirtualAlloc = (VIRTUALALLOC\*)

GetProcAddress(GetModuleHandle("kernel32.dll"), "VirtualAlloc");

LOADLIBRARY    \*\_LoadLibrary    = (LOADLIBRARY\*)

GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

CREATETHREAD \*\_CreateThread = (CREATETHREAD\*)

GetProcAddress(GetModuleHandle("kernel32.dll"), "CreateThread");

MEMCPY         \*\_memcpy         = (MEMCPY\*)

GetProcAddress(GetModuleHandle("ntdll.dll"), "memcpy");

//这个很关键，并不是我要调用，是 FreeLibrary 时系统会调用，我要hook它,

//不能给系统破坏这个heap，否则之后的dll貌似能工作，

//但却不能用new或malloc申请内存, VirtualAlloc可以代替之，

//但如果改写好多代码是划不来的，况且一些代码不好改,如list<T>的push内部的new

HEAPDESTROY \*\_HeapDestroy    = (HEAPDESTROY\*)

GetProcAddress(GetModuleHandle("kernel32.dll"), "HeapDestroy");

VirtualProtect(\_HeapDestroy, 3, PAGE\_EXECUTE\_READWRITE, &oldProtect);

//修改第一条指令为直接返回

\_memcpy(HeapDestroy\_HookCode\_bak, \_HeapDestroy, 3);

\_memcpy(\_HeapDestroy, HeapDestroy\_HookCode, 3);

//Sleep(100);

//终于到这里了~~~^\_^!

FreeLibrary(hDllInstance);//释放

//修复刚hook的函数

\_memcpy(\_HeapDestroy, HeapDestroy\_HookCode\_bak, 3);

//\_memcpy(\_RtlFreeHeap, RtlFreeHeap\_HookCode\_bak, 3);

//在原来的dll基址申请同样大小的内存，并把之前的那份dll拷贝还原回去

if(\_VirtualAlloc(hDllInstance,

modinfo.SizeOfImage,

MEM\_COMMIT|MEM\_RESERVE,

PAGE\_EXECUTE\_READWRITE) == NULL

)

//失败，加载原来dll, 以正常方式工作

//注意，不宜在dllmain中调用HideLibrary，LoadLibrary将导致dllmain再次被调用,导致死循环啦

HMODULE hDll = \_LoadLibrary(dllpath\_bak);

//重新计算回调函数在hDll地址空间的地址

cbFunc->pAddress = (LPTHREAD\_START\_ROUTINE)

((DWORD)cbFunc->pAddress - (DWORD)hDllInstance + (DWORD)hDll);

LPTHREAD\_START\_ROUTINE pFunc1 = (LPTHREAD\_START\_ROUTINE)

((DWORD)EnumAndSetThreadState - (DWORD)hDllInstance + (DWORD)hDll);

//恢复被挂起的线程

\_CreateThread(0, 0, pFunc1, (LPVOID)TRUE, 0, 0);

//调用回调函数

if(cbFunc->pAddress)

\_CreateThread(0, 0, cbFunc->pAddress, cbFunc->lParam, 0, 0);

return 0;

\_memcpy(hDllInstance, cbFunc->lpNewDllBase, modinfo.SizeOfImage);

//恢复被挂起的线程

EnumAndSetThreadState((LPVOID)TRUE);

//跳回原dll地址空间的GotoCallBackAddr，由它来释放这边VirtualAlloc申请的指针

\_CreateThread(0, 0, GotoCallBackAddr, cbFunc, 0, 0);

return 0;

DWORD WINAPI HideLibrary02(LPVOID lParam)

//\_\_asm INT 3

\_\_printf("HideLibrary02 Entry.\\r\\n");

PUNLOADLIB\_CALLBACK cbFunc = (PUNLOADLIB\_CALLBACK)lParam;

MODULEINFO modinfo;

GetModuleInformation(GetCurrentProcess(), cbFunc->lpDllBase, &modinfo, sizeof(MODULEINFO));

//申请一块和当前dll同样大小的内存

cbFunc->lpNewDllBase = VirtualAlloc(NULL, modinfo.SizeOfImage, MEM\_COMMIT|MEM\_RESERVE, PAGE\_EXECUTE\_READWRITE);

if(cbFunc->lpNewDllBase == NULL)

return FALSE;

//给当前dll做份拷贝，复制所有数据到刚申请的内存，

memcpy(cbFunc->lpNewDllBase, modinfo.lpBaseOfDll, modinfo.SizeOfImage);

//计算在copy中UnLoadLibrary的地址,并另起线程到该地址执行

void \*pNewUnLoadLibrary = LPVOID((DWORD)cbFunc->lpNewDllBase + (DWORD)UnLoadLibrary - (DWORD)modinfo.lpBaseOfDll);

DWORD ThreadId;

HANDLE hThread = CreateThread(0,0,

(LPTHREAD\_START\_ROUTINE)pNewUnLoadLibrary, (LPVOID)cbFunc, CREATE\_SUSPENDED, &ThreadId);

if(hThread == NULL)

VirtualFree(cbFunc->lpNewDllBase, 0, MEM\_DECOMMIT);

delete cbFunc;

return FALSE;

ResumeThread(hThread);

CloseHandle(hThread);

return TRUE;

void HideLibrary(HMODULE hModule, LPVOID pCallBackAddr, LPVOID lParam)

\_\_printf("HideLibrary Entry.\\r\\n");

PUNLOADLIB\_CALLBACK lparam = new UNLOADLIB\_CALLBACK;

lparam->lpDllBase      = hModule;

lparam->lpNewDllBase = NULL;

lparam->pAddress       = (PTHREAD\_START\_ROUTINE)pCallBackAddr;

lparam->lParam         = lParam;

HANDLE hThread = CreateThread(0,0,

HideLibrary02, (LPVOID)lparam, 0, NULL);

if(hThread == NULL)

\_\_printf("CreateThread HideLibrary02 Failed.\\r\\n");

delete lparam;

return;

CloseHandle(hThread);

return;

///

//example

//rundll32 UnloadLibrary.dll,Test

DWORD WINAPI testThread(LPVOID lParam)

char \*ptest = new char\[512\];

sprintf(ptest, "My Pid: %d\\r\\n 用一些软件查看下，找不到这个dll吧?", GetCurrentProcessId());

MessageBox(0, ptest, (char\*)lParam, 0);

delete ptest;

return 0;

DWORD WINAPI testThread02(LPVOID lParam)

HMODULE hModule = (HMODULE)lParam;

char \*ptest = new char\[512\];

sprintf(ptest, "testThread02\\r\\n");

Sleep(500);

MessageBox(0, ptest, "start", 0);

//不设置回调函数，成功还好，一旦失败则gameover

HideLibrary(hModule, 0, 0);

sprintf(ptest, "My Pid: %d\\r\\n 用一些软件查看下，找不到这个dll吧?", GetCurrentProcessId());

MessageBox(0, ptest, "ok", 0);

delete ptest;

return 0;

HMODULE hDll;

extern "C"

\_\_declspec(dllexport) int Test();

int Test()

//1

//主要线程开始工作后再HideLibrary不是很安全

//CreateThread(0, 0, testThread02, hDll, 0, 0);

//2

//free掉dll后再开启主要工作线程妥当些

char \*p = strdup("hello");

HideLibrary(hDll, testThread, p);

Sleep(60000);

return 0;

BOOL APIENTRY DllMain( HANDLE hModule,

DWORD    ul\_reason\_for\_call,

LPVOID lpReserved

)

switch (ul\_reason\_for\_call)

case DLL\_PROCESS\_ATTACH:

hDll = (HMODULE)hModule;

break;

return TRUE;

将dll从进程模块列表中移除并保持正常运行

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关从数组中移除重复元素

相关 Docker将从Kubernetes中移除，我该怎么办？

相关 Openerp 移除下拉选择列表中的“创建并编辑”链接

相关 ionic 列表选项的移动和移除

相关关于从集合List中移除元素

相关广告拦截应用将从Google应用商城中移除

相关将dll从进程模块列表中移除并保持正常运行

相关 VMware移除虚拟机并没有将虚拟机从磁盘删除

相关从kubernetes集群中移除节点

相关将DLL注入进程思路