DLL注入与卸载

àì夳堔傛蜴生んèń 2022-08-06 03:08 235阅读 0赞

DLL注入可用于编写外挂和病毒不易发现。

void CInjectDllToolDlg::StartInject(char *path, int pid)
    {
    	int pathLen = strlen(path)+sizeof(char);//获取dll目录大小
    	HANDLE hPro = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    	if (!hPro)
    	{
    		MessageBox("打开进程失败", "警告", 0);
    		return;
    	}
    	//在该进程申请内存，用来存放path数据
    	LPVOID dllAddr = VirtualAllocEx(hPro, NULL, pathLen, MEM_COMMIT, PAGE_READWRITE);
    	if (!dllAddr)
    	{
    		MessageBox("获取地址失败", "警告", 0);
    		CloseHandle(hPro);
    		return;
    	}
    	//在申请的内存中写入path
    	DWORD wNum = 0;
    	if (!WriteProcessMemory(hPro, dllAddr, path, pathLen, &wNum))
    	{
    		MessageBox("写入失败", "警告", 0);
    		VirtualFreeEx(hPro, dllAddr, pathLen, MEM_DECOMMIT);
    		CloseHandle(hPro);
    		return;
    	}
    	//获取loadlibrary函数地址
    	FARPROC pFun = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
    
    	if (!pFun)
    	{
    		MessageBox("获取函数失败", "警告", 0);
    		VirtualFreeEx(hPro, dllAddr, pathLen, MEM_DECOMMIT);
    		CloseHandle(hPro);
    		return;
    	}
    	DWORD dwPid;
    	HANDLE hThread = CreateRemoteThread(hPro, NULL, 0, (LPTHREAD_START_ROUTINE)pFun, dllAddr, 0, &dwPid);
    	if (!hThread)
    	{
    		MessageBox("注入失败", "警告", 0);
    		VirtualFreeEx(hPro, dllAddr, pathLen, MEM_DECOMMIT);
    		CloseHandle(hPro);
    		return;
    	}
    	DWORD errorNum = GetLastError();
    	WaitForSingleObject(hThread, INFINITE);
    	CloseHandle(hThread);
    	CloseHandle(hPro);
    }

这个只适用于xp系统，win7系统不可以随便CreateRemoteThread了，返回值一直为NULL

具体方法引用看雪：[Vista&Win7下CreateRemoteThread应用的若干问题和解决方案][Vista_Win7_CreateRemoteThread]

Dll卸载与注入流程大体相同，先创建 进程快照找到相应的线程模块，获取FreeLibrary地址，再创建远程线程卸载

void UnInjectDll(char *szDllName, DWORD dwPid)
    {
    	if(dwPid==0 || strlen(szDllName)==0)
    	{
    		AfxMessageBox("输入信息不全");
    		return;
    	}
    	//创建进程快照
    	HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,dwPid);
    	MODULEENTRY32 ME32 = {0};
    	ME32.dwSize = sizeof(MODULEENTRY32);
    	BOOL isNext = Module32First(hSnap,&ME32);
    	BOOL flag = FALSE;
    	while(isNext)
    	{
    		if(strcmp(ME32.szModule,szDllName)==0)
    		{
    			flag = TRUE;
    			break;
    		}
    		isNext = Module32Next(hSnap,&ME32);
    	}
    	if(flag == FALSE)
    	{
    		AfxMessageBox("找不到目标模块");
    		return;
    	}
    	CloseHandle(hSnap);
    	HANDLE hPro = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);
    	FARPROC pFun = GetProcAddress(GetModuleHandle("kernel32.dll"),"FreeLibrary");
    	HANDLE hThread = CreateRemoteThread(hPro,NULL,0,(LPTHREAD_START_ROUTINE)pFun,ME32.szModule,0,NULL);
    	if(!hThread)
    	{
    		AfxMessageBox("创建远程线程失败");
    		return ;
    	}
    	AfxMessageBox("卸载成功");
    	WaitForSingleObject(hThread,INFINITE);
    	CloseHandle(hThread);
    	CloseHandle(hPro);
    }

[Vista_Win7_CreateRemoteThread]: http://bbs.pediy.com/showthread.php?t=101469http://bbs.pediy.com/showthread.php?t=101469