zoukankan      html  css  js  c++  java
  • 绕过LoadLibrary 加载DLL

    #include <Windows.h>
    typedef struct _UNICODE_STRING { // UNICODE_STRING structure
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
    } UNICODE_STRING;
    typedef UNICODE_STRING *PUNICODE_STRING;
     
    typedef NTSTATUS (WINAPI *fLdrLoadDll) //LdrLoadDll function prototype
    (
    IN PWCHAR PathToFile OPTIONAL,
    IN ULONG Flags OPTIONAL,
    IN PUNICODE_STRING ModuleFileName,
    OUT PHANDLE ModuleHandle
    );
     
    typedef VOID (WINAPI *fRtlInitUnicodeString) //RtlInitUnicodeString function prototype
    (
    PUNICODE_STRING DestinationString,
    PCWSTR SourceString
    );
     
    HMODULE hntdll;
    fLdrLoadDll _LdrLoadDll;
    fRtlInitUnicodeString _RtlInitUnicodeString;
     
    HMODULE LoadDll( LPCSTR lpFileName) -
    {
    if (hntdll == NULL) { hntdll = GetModuleHandleA("ntdll.dll"); }
    if (_LdrLoadDll == NULL) { _LdrLoadDll = (fLdrLoadDll) GetProcAddress ( hntdll, "LdrLoadDll"); }
    if (_RtlInitUnicodeString == NULL)
    { _RtlInitUnicodeString = (fRtlInitUnicodeString) GetProcAddress ( hntdll, "RtlInitUnicodeString"); }
    int StrLen = lstrlenA(lpFileName);
    BSTR WideStr = SysAllocStringLen(NULL, StrLen);
    MultiByteToWideChar(CP_ACP, 0, lpFileName, StrLen, WideStr, StrLen);
    UNICODE_STRING usDllName;
    _RtlInitUnicodeString(&usDllName, WideStr);
    SysFreeString(WideStr);
    HANDLE DllHandle;
    _LdrLoadDll(0, 0, &usDllName, &DllHandle);
    return (HMODULE)DllHandle;
    }
    typedef void (* _u)();
    int main()
    {
    HMODULE hMydll = LoadDll("C:\ww.dll");
    _u ss = (_u)GetProcAddress(hMydll,"tt");
    ss();
    return 0;
    }

  • 相关阅读:
    面向对象的三个基本特征
    OGRE启动过程详解(OGRE HelloWorld程序原理解析)
    Bullet核心类介绍(Bullet 2.82 HelloWorld程序及其详解,附程序代码)
    windows下Bullet 2.82编译安装(Bullet Physics开发环境配置)
    1303: Decimal
    分组背包,每组最多选1个
    椒盐效果
    自我介绍
    题目1539:师弟
    upper_bound()
  • 原文地址:https://www.cnblogs.com/iTaoqi/p/3465605.html
Copyright © 2011-2022 走看看