1.简介:
代码注入和远程线程注入dll类似,但是隐蔽性更好,因为不产生文件.但是可靠性差,更加复杂
代码注入时注入的代码部分是从本进程空间复制过去的,所以不能出现依赖于本进程的数据存在.
所以注入的代码中数据,地址都是动态生成的, 因此可以考虑将这些数据作为参数传递给注入的代码.
将代码和数据都注入到目标进程中
(注意,该代码要以release模式编译才能运行成功,因为debug模式的编译的结构的函数调用是个jmp,而不是直接调用)
//声明需要用到的函数 typedef HMODULE(WINAPI *lpLoadLibraryA)(char* filename); typedef FARPROC(WINAPI *lpGetProcAddress)(HMODULE hModule, char* funcName); typedef int(WINAPI *lpMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType); typedef struct _thread_param { lpLoadLibraryA loadFunc; lpGetProcAddress GetPFunc; char data[4][100]; //保存所有参数 }thread_param; DWORD WINAPI threadProc(LPVOID param) { thread_param* tparam = (thread_param*)param; HMODULE hd = tparam->loadFunc(tparam->data[0]); //data的第一个item是user32.dll lpMessageBoxA msg = (lpMessageBoxA)tparam->GetPFunc(hd, tparam->data[1]);//data的第2个参数是MessageBoxA msg(0, tparam->data[2], tparam->data[3], 0);//data后2个参数是messagebox的参数 } DWORD codeInject(DWORD pid) { HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid); if (hProcess==0||hProcess==INVALID_HANDLE_VALUE) { return 0; } thread_param param = { 0 }; param.loadFunc = (lpLoadLibraryA)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA"); param.GetPFunc = (lpGetProcAddress)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetProcAddress"); memcpy(¶m.data[0], "user32.dll", 11); memcpy(¶m.data[1], "MessageBoxA", 12); memcpy(¶m.data[2], "freesec", 8); memcpy(¶m.data[3], "inject", 7); DWORD codesize = (DWORD)codeInject - (DWORD)threadProc; //计算线程函数的代码大小 LPVOID database = VirtualAllocEx(hProcess, 0, sizeof(thread_param), MEM_COMMIT, PAGE_READWRITE); DWORD written; HANDLE hThread; if (database==0) { CloseHandle(hProcess); return 0; } WriteProcessMemory(hProcess, database, ¶m, sizeof(thread_param), &written); LPVOID codebase = VirtualAllocEx(hProcess, 0, codesize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); if (codebase == 0) { VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE); CloseHandle(hProcess); return 0; } WriteProcessMemory(hProcess, codebase, threadProc, codesize, &written); if ((hThread=CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)codebase, database, 0, 0))!=0) { VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE); VirtualFreeEx(hProcess, codebase, codesize, MEM_FREE); CloseHandle(hThread); CloseHandle(hProcess); return 1; } VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE); VirtualFreeEx(hProcess, codebase, codesize, MEM_FREE); CloseHandle(hProcess); return 0; }