最近在看病毒相关内容，看着大部分知识都知道，不知道用起来行不行。下午正好有人问怎么注入线程，在公司用《windows核心编程》的注入DLL程序修改了一下，实现了远程注入DLL调用函数。刚才回来，觉得照着别人的程序改，总还是学不到家，自己花了两个小时写了一个。能注入到其他进程中，执行弹出MessageBox框。当然，能注入去弹出这个框，就能干很多坏事了，看你想干什么了。把代码贴上来，也不改了，反正能看懂。有几个细节可能会忽略：
1. ThreadFunc应该定义成static，不能是全局函数。如果是全局函数，只能取到jmp ThreadFunc这块代码的地址。
2. 在调试模式会使写函数数据时数据出错。
下午就被这两个东西浪费了一个多小时。
推荐两篇有用的内容：http://www.cnblogs.com/BoyXiao/archive/2011/08/11/2134367.html
http://www.vckbase.com/index.php/wv/1580
// InjectToRemoteProcess.cpp : 定义应用程序的入口点。
//
#include "stdafx.h"
#include "InjectToRemoteProcess.h"
#define MAX_LOADSTRING 100
// 全局变量:
HINSTANCE hInst; // 当前实例
TCHAR szTitle[MAX_LOADSTRING]; // 标题栏文本
TCHAR szWindowClass[MAX_LOADSTRING]; // 主窗口类名
// 此代码模块中包含的函数的前向声明:
ATOM MyRegisterClass(HINSTANCE hInstance);
BOOL InitInstance(HINSTANCE, int);
LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);
INT_PTR CALLBACK About(HWND, UINT, WPARAM, LPARAM);
INT_PTR CALLBACK Inject(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);
int APIENTRY _tWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPTSTR lpCmdLine,
int nCmdShow)
{
UNREFERENCED_PARAMETER(hPrevInstance);
UNREFERENCED_PARAMETER(lpCmdLine);
// TODO: 在此放置代码。
MSG msg;
HACCEL hAccelTable;
// 初始化全局字符串
LoadString(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);
LoadString(hInstance, IDC_INJECTTOREMOTEPROCESS, szWindowClass, MAX_LOADSTRING);
MyRegisterClass(hInstance);
// 执行应用程序初始化:
if (!InitInstance (hInstance, nCmdShow))
{
return FALSE;
}
hAccelTable = LoadAccelerators(hInstance, MAKEINTRESOURCE(IDC_INJECTTOREMOTEPROCESS));
// 主消息循环:
while (GetMessage(&msg, NULL, 0, 0))
{
if (!TranslateAccelerator(msg.hwnd, hAccelTable, &msg))
{
TranslateMessage(&msg);
DispatchMessage(&msg);
}
}
return (int) msg.wParam;
}
//
// 函数: MyRegisterClass()
//
// 目的: 注册窗口类。
//
// 注释:
//
// 仅当希望
// 此代码与添加到 Windows 95 中的“RegisterClassEx”
// 函数之前的 Win32 系统兼容时，才需要此函数及其用法。调用此函数十分重要，
// 这样应用程序就可以获得关联的
// “格式正确的”小图标。
//
ATOM MyRegisterClass(HINSTANCE hInstance)
{
WNDCLASSEX wcex;
wcex.cbSize = sizeof(WNDCLASSEX);
wcex.style = CS_HREDRAW | CS_VREDRAW;
wcex.lpfnWndProc = WndProc;
wcex.cbClsExtra = 0;
wcex.cbWndExtra = 0;
wcex.hInstance = hInstance;
wcex.hIcon = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_INJECTTOREMOTEPROCESS));
wcex.hCursor = LoadCursor(NULL, IDC_ARROW);
wcex.hbrBackground = (HBRUSH)(COLOR_WINDOW+1);
wcex.lpszMenuName = MAKEINTRESOURCE(IDC_INJECTTOREMOTEPROCESS);
wcex.lpszClassName = szWindowClass;
wcex.hIconSm = LoadIcon(wcex.hInstance, MAKEINTRESOURCE(IDI_SMALL));
return RegisterClassEx(&wcex);
}
//
// 函数: InitInstance(HINSTANCE, int)
//
// 目的: 保存实例句柄并创建主窗口
//
// 注释:
//
// 在此函数中，我们在全局变量中保存实例句柄并
// 创建和显示主程序窗口。
//
BOOL InitInstance(HINSTANCE hInstance, int nCmdShow)
{
HWND hWnd;
hInst = hInstance; // 将实例句柄存储在全局变量中
hWnd = CreateWindow(szWindowClass, szTitle, WS_OVERLAPPEDWINDOW,
CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, NULL, NULL, hInstance, NULL);
if (!hWnd)
{
return FALSE;
}
ShowWindow(hWnd, nCmdShow);
UpdateWindow(hWnd);
return TRUE;
}
//
// 函数: WndProc(HWND, UINT, WPARAM, LPARAM)
//
// 目的: 处理主窗口的消息。
//
// WM_COMMAND - 处理应用程序菜单
// WM_PAINT - 绘制主窗口
// WM_DESTROY - 发送退出消息并返回
//
//
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
int wmId, wmEvent;
PAINTSTRUCT ps;
HDC hdc;
switch (message)
{
case WM_COMMAND:
wmId = LOWORD(wParam);
wmEvent = HIWORD(wParam);
// 分析菜单选择:
switch (wmId)
{
case IDM_ABOUT:
DialogBox(hInst, MAKEINTRESOURCE(IDD_ABOUTBOX), hWnd, About);
break;
case IDM_EXIT:
DestroyWindow(hWnd);
break;
case IDM_INJECT:
DialogBox(hInst,MAKEINTRESOURCE(IDD_DLG_INJECT),hWnd,Inject);
default:
return DefWindowProc(hWnd, message, wParam, lParam);
}
break;
case WM_PAINT:
hdc = BeginPaint(hWnd, &ps);
// TODO: 在此添加任意绘图代码...
EndPaint(hWnd, &ps);
break;
case WM_DESTROY:
PostQuitMessage(0);
break;
default:
return DefWindowProc(hWnd, message, wParam, lParam);
}
return 0;
}
// “关于”框的消息处理程序。
INT_PTR CALLBACK About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
UNREFERENCED_PARAMETER(lParam);
switch (message)
{
case WM_INITDIALOG:
return (INT_PTR)TRUE;
case WM_COMMAND:
if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL)
{
EndDialog(hDlg, LOWORD(wParam));
return (INT_PTR)TRUE;
}
break;
}
return (INT_PTR)FALSE;
}
struct ProcStruct
{
FARPROC MsgAddr;
TCHAR strMsg[24];
TCHAR strTitle[24];
};
static DWORD __stdcall ThreadFunc(ProcStruct * pPS)
{
typedef int (__stdcall *pMsgBox)(HWND,LPCTSTR,LPCTSTR,UINT);
pMsgBox MsgBox =(pMsgBox)pPS->MsgAddr;
MsgBox(NULL,pPS->strMsg,pPS->strTitle,0);
return 0;
}
static DWORD __stdcall OffsetFunc(LPVOID* pParam)
{
return 0;
}
bool AdjustProcessTokenPrivilege()
{
LUID luidTmp;
HANDLE hToken;
TOKEN_PRIVILEGES tkp;
if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
//OutputDebugString("AdjustProcessTokenPrivilege OpenProcessToken Failed ! \n");
return false;
}
if(!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luidTmp))
{
//OutputDebugString("AdjustProcessTokenPrivilege LookupPrivilegeValue Failed ! \n");
CloseHandle(hToken);
return FALSE;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = luidTmp;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if(!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
{
//OutputDebugString("AdjustProcessTokenPrivilege AdjustTokenPrivileges Failed ! \n");
CloseHandle(hToken);
return FALSE;
}
return true;
}
DWORD InjectFunctionToProcess(DWORD dwProcessId)
{
AdjustProcessTokenPrivilege();
try
{
HANDLE hProcess = OpenProcess(
PROCESS_QUERY_INFORMATION | // Required by Alpha
PROCESS_CREATE_THREAD | // For CreateRemoteThread
PROCESS_VM_OPERATION | // For VirtualAllocEx/VirtualFreeEx
PROCESS_VM_WRITE, // For WriteProcessMemory
FALSE, dwProcessId);
if (hProcess == NULL)
{
return 0;
}
HMODULE hUser32 = GetModuleHandle(_T("User32.dll"));
if (hProcess == NULL)
{
return 0;
}
FARPROC MsgAddr = GetProcAddress(hUser32,"MessageBoxW");
ProcStruct PS;
PS.MsgAddr =MsgAddr;
_tcscpy(PS.strMsg,_T("This is Message!"));
_tcscpy(PS.strTitle,_T("Title"));
//开辟存储变量的内存空间
void * pMemProcStruct = VirtualAllocEx(hProcess,NULL,sizeof(ProcStruct),MEM_COMMIT,PAGE_READWRITE);
if (!pMemProcStruct)
{
return 0;
}
//复制参数内容
if (!WriteProcessMemory(hProcess,pMemProcStruct,&PS,sizeof(ProcStruct),NULL))
{
return 0;
}
//开辟存储调用函数的空间
DWORD FuncLen = (DWORD)OffsetFunc - (DWORD)ThreadFunc;
void * pMemFunction = VirtualAllocEx(hProcess,NULL,FuncLen,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if (!pMemFunction)
{
return 0;
}
//复制函数内容
if (!WriteProcessMemory(hProcess,pMemFunction,ThreadFunc,FuncLen,NULL))
{
return 0;
}
//启动线程函数注入进程
HANDLE hRemoteThread = CreateRemoteThread(hProcess,NULL,NULL,(LPTHREAD_START_ROUTINE)pMemFunction,pMemProcStruct,NULL,NULL);
if (!hRemoteThread)
{
return 0;
}
//等待线程结束
WaitForSingleObject(hRemoteThread,INFINITE);
//释放参数内容
VirtualFreeEx(hProcess,pMemProcStruct,sizeof(ProcStruct),MEM_RELEASE);
//释放函数内容
VirtualFreeEx(hProcess,pMemFunction,FuncLen,MEM_RELEASE);
}
catch (...)
{
return -1;
}
return 0;
}
// “注入”框的消息处理程序。
INT_PTR CALLBACK Inject(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
UNREFERENCED_PARAMETER(lParam);
switch (message)
{
case WM_INITDIALOG:
return (INT_PTR)TRUE;
case WM_COMMAND:
if (LOWORD(wParam) == IDCANCEL)
{
EndDialog(hDlg, LOWORD(wParam));
return (INT_PTR)TRUE;
}
else if (LOWORD(wParam) == IDOK)
{
DWORD dwProcessId = GetDlgItemInt(hDlg, IDC_INJECTTOREMOTEPROCESS, NULL, FALSE);
if (dwProcessId == 0) {
// A process ID of 0 causes everything to take place in the
// local process; this makes things easier for debugging.
dwProcessId = GetCurrentProcessId();
}
if (!InjectFunctionToProcess(dwProcessId))
{
MessageBox(NULL,_T("DLL Injection/Ejection successful."),_T("Title"),0);
}
else
{
MessageBox(NULL,_T("DLL Injection/Ejection failed."),_T("Error"),0);
}
}
break;
}
return (INT_PTR)FALSE;
}
作者：eagleatustb 发表于2013-1-29 23:13:46 原文链接
阅读：53 评论：0 查看评论