《Windows PE》6.4.2 远程注入DLL

实验四十七：远程注入DLL

写一个窗口程序，将一个dll通过远程注入的方法，注入到第三章的示例程序PEHeader.exe中，支持32位和64位PE。

●dll.c

/*------------------------------------------------------------------------FileName:dll.c实验47：远程注入(DLL)(c) bcdaren, 2024
-----------------------------------------------------------------------*/
#include <Windows.h>//入口和退出点
int WINAPI DllMain(HINSTANCE hInstance, DWORD fdwReason, PVOID pvReserved)
{switch (fdwReason){case DLL_PROCESS_ATTACH:{MessageBox(NULL, L"Welcome to PE!", L"Hello", MB_OK);break;}case DLL_THREAD_ATTACH:break;case DLL_THREAD_DETACH:break;case DLL_PROCESS_DETACH:break;}return TRUE;  
}

●resource.h（略）

●remoteThread.rc（略）

●remoteThread.c

/*------------------------------------------------------------------------FileName:remoteThread.c实验46：远程线程注入演示程序功能：目标是在进程PEHeader.exe中远程注入一个DLL，运行并显示"Welcome to PE!"对话框。测试步骤：当PEHeader.exe运行时，运行remoteThread.exe，文件菜单---插入到PEHeader.exe(c) bcdaren, 2024
-----------------------------------------------------------------------*/
#include <windows.h>
#include <strsafe.h>	//StringCchCopy
#include <commctrl.h>
#pragma comment(lib,"comctl32.lib")
#include <Richedit.h>
#include <tchar.h>
#include <string.h>
#include "resource.h"//使用typedef给函数指针类型一个别名,函数指针存储函数地址
typedef FARPROC(__stdcall *_ApiSuspend)(HANDLE);
typedef HMODULE(__stdcall *_ApiResume)(HANDLE);
_ApiSuspend _suspendProcess;
_ApiResume _resumeProcess;BOOL CALLBACK ProcDlgMain(HWND, UINT, WPARAM, LPARAM);
BOOL _patchPEInfo();
void _Init();
void ShowErrMsg();HANDLE hInstance;
HWND hWinMain, hWinEdit;int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int nCmdShow)
{const TCHAR	szDllEdit[] = TEXT("RichEd20.dll");const TCHAR	szClassEdit[] = TEXT("RichEdit20W");//peinfo.rc中定义const TCHAR	szNtdll[] = TEXT("ntdll.dll");const CHAR	szSuspend[] = "ZwSuspendProcess";//函数名需要定义为ASCII字符const CHAR	szResume[] = "ZwResumeProcess";const TCHAR	szErr3[] = TEXT("Error happend when getting address.");HMODULE hRichEdit, hNtdll;hRichEdit = LoadLibrary((LPCWSTR)&szDllEdit);hNtdll = LoadLibrary((LPCWSTR)&szNtdll);_suspendProcess = (_ApiSuspend)GetProcAddress(hNtdll, szSuspend);if (!_suspendProcess)MessageBox(NULL, szErr3, NULL, MB_OK);_resumeProcess = (_ApiResume)GetProcAddress(hNtdll, szResume);if (!_resumeProcess)MessageBox(NULL, szErr3, NULL, MB_OK);hInstance = GetModuleHandle(NULL);DialogBoxParam(hInstance, MAKEINTRESOURCE(DLG_MAIN), NULL, (DLGPROC)ProcDlgMain, (LPARAM)0);FreeLibrary(hRichEdit);return 0;
}BOOL CALLBACK ProcDlgMain(HWND hWnd, UINT wMsg, WPARAM wParam, LPARAM lParam)
{switch (wMsg){case WM_CLOSE:EndDialog(hWnd, 0);return TRUE;case WM_INITDIALOG:hWinMain = hWnd;_Init();	//初始化return TRUE;case WM_COMMAND:switch (wParam){case IDM_EXIT:EndDialog(hWnd, 0);return TRUE;case IDM_OPEN:		//停止_patchPEInfo();return TRUE;}}return FALSE;
}void _Init()
{CHARFORMAT stCf;static TCHAR szClassEdit[] = TEXT("RichEdit20W");	//UNICODE版本//static TCHAR szClassEdit[] = TEXT("RichEdit20A");	//ASCII码版本static TCHAR szFont[] = TEXT("宋体");//设置编辑控件hWinEdit = GetDlgItem(hWinMain, IDC_INFO);SendMessage(hWinEdit, EM_SETTEXTMODE, TM_PLAINTEXT, 0);RtlZeroMemory(&stCf, sizeof(stCf));stCf.cbSize = sizeof(stCf);stCf.yHeight = 9 * 20;stCf.dwMask = CFM_FACE | CFM_SIZE | CFM_BOLD;StringCchCopy((LPTSTR)&stCf.szFaceName, lstrlen(szFont) + 1, (LPCTSTR)&szFont);SendMessage(hWinEdit, EM_SETCHARFORMAT, 0, (LPARAM)&stCf);SendMessage(hWinEdit, EM_EXLIMITTEXT, 0, -1);
}/*
;--------------------
; 将远程线程打到进程PEHeader.exe中
; 测试方法：首先运行PEHeader.exe
; 启动该程序,单击第一个菜单的第一项
; 会发现桌面上弹出"Welcome to PE!"对话框
;--------------------
*/
BOOL _patchPEInfo()
{HANDLE phwnd, hProcess, hCreate;DWORD parent, hProcessID;static TCHAR strTitle[256];static TCHAR szBuffer[256];const TCHAR szTitle[] = TEXT("PE文件头中几个关键地址的定位：");const TCHAR szErr1[] = TEXT("Error happend when openning.");const TCHAR szErr2[] = TEXT("Error happend when VirtualAllocEx.");static int dwProcessID, dwThreadID;PVOID lpLoadLibrary, lpDllName;static CHAR szMyDllFull[MAX_PATH];//注意：写入内存中的字符都是ANSI字符const TCHAR szDllKernel[] = TEXT("Kernel32.dll");const CHAR szLoadLibrary[] = "LoadLibraryA";//注意：写入内存中的字符都是ANSI字符const CHAR szMyDll[] = "\\DLL.dll";//注意：写入内存中的字符都是ANSI字符//准备工作：获取dll的全路径文件名、获取LoadLibrary函数地址等GetCurrentDirectoryA(MAX_PATH, szMyDllFull);//获取应用程序的当前工作目录strcat_s(szMyDllFull, MAX_PATH, szMyDll);//添加后缀名int nLen = sizeof(CHAR)*(strlen(szMyDllFull) + 1);//获取Kernel32.dll句柄，LoadLibrary函数地址lpLoadLibrary = GetProcAddress(GetModuleHandle(szDllKernel), (LPCSTR)szLoadLibrary);//通过标题获得进程的handleparent = 0;	//复位标志phwnd = GetWindow(GetWindow(GetDesktopWindow(), GW_CHILD), GW_HWNDFIRST);if (!GetParent(phwnd))parent = 1;while (phwnd){if (parent){parent = 0;	//复位标志//得到窗口标题文字GetWindowText(phwnd, strTitle, sizeof(strTitle));if (!_tcscmp(szTitle, strTitle))break;}//寻找这个窗口的下一个兄弟窗口phwnd = GetWindow(phwnd, GW_HWNDNEXT);if (!GetParent(phwnd)){if (IsWindowVisible(phwnd))parent = 1;}}//根据窗口句柄获取进程IDGetWindowThreadProcessId(phwnd, &hProcessID);//1.打开本地进程hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, hProcessID);if (!hProcess){MessageBox(NULL, szErr1, NULL, MB_OK);return FALSE;}//2.分配空间,以页为单位lpDllName = VirtualAllocEx(hProcess, NULL, nLen, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);if (!lpDllName){MessageBox(NULL, szErr2, NULL, MB_OK);return FALSE;}//3.写入线程代码,注意：写入内存中的字符都是ANSI字符SIZE_T dwWrite = 0;if (!WriteProcessMemory(hProcess, lpDllName, szMyDllFull, nLen, &dwWrite)){MessageBox(NULL, L"写入内存失败！\n", NULL, MB_OK);return FALSE;}//4.创建一个在另一个进程的虚拟地址空间中运行的线程hCreate = CreateRemoteThread(hProcess, NULL, 0, lpLoadLibrary, lpDllName, 0, NULL);//5.等待线程结束返回,释放资源WaitForSingleObject(hCreate, -1);CloseHandle(hCreate);VirtualFreeEx(hProcess, lpDllName, 0, MEM_FREE);CloseHandle(hProcess);return TRUE;
}

●运行