zoukankan      html  css  js  c++  java
  • 绕过LoadLibrary 加载DLL

    #include <Windows.h>
    typedef struct _UNICODE_STRING { // UNICODE_STRING structure
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
    } UNICODE_STRING;
    typedef UNICODE_STRING *PUNICODE_STRING;
     
    typedef NTSTATUS (WINAPI *fLdrLoadDll) //LdrLoadDll function prototype
    (
    IN PWCHAR PathToFile OPTIONAL,
    IN ULONG Flags OPTIONAL,
    IN PUNICODE_STRING ModuleFileName,
    OUT PHANDLE ModuleHandle
    );
     
    typedef VOID (WINAPI *fRtlInitUnicodeString) //RtlInitUnicodeString function prototype
    (
    PUNICODE_STRING DestinationString,
    PCWSTR SourceString
    );
     
    HMODULE hntdll;
    fLdrLoadDll _LdrLoadDll;
    fRtlInitUnicodeString _RtlInitUnicodeString;
     
    HMODULE LoadDll( LPCSTR lpFileName) -
    {
    if (hntdll == NULL) { hntdll = GetModuleHandleA("ntdll.dll"); }
    if (_LdrLoadDll == NULL) { _LdrLoadDll = (fLdrLoadDll) GetProcAddress ( hntdll, "LdrLoadDll"); }
    if (_RtlInitUnicodeString == NULL)
    { _RtlInitUnicodeString = (fRtlInitUnicodeString) GetProcAddress ( hntdll, "RtlInitUnicodeString"); }
    int StrLen = lstrlenA(lpFileName);
    BSTR WideStr = SysAllocStringLen(NULL, StrLen);
    MultiByteToWideChar(CP_ACP, 0, lpFileName, StrLen, WideStr, StrLen);
    UNICODE_STRING usDllName;
    _RtlInitUnicodeString(&usDllName, WideStr);
    SysFreeString(WideStr);
    HANDLE DllHandle;
    _LdrLoadDll(0, 0, &usDllName, &DllHandle);
    return (HMODULE)DllHandle;
    }
    typedef void (* _u)();
    int main()
    {
    HMODULE hMydll = LoadDll("C:\ww.dll");
    _u ss = (_u)GetProcAddress(hMydll,"tt");
    ss();
    return 0;
    }

  • 相关阅读:
    [好好学习]在VMware中安装Oracle Enterprise Linux (v5.7)
    [冲昏头脑]IDEA中的maven项目中学习log4j的日志操作
    [烧脑时刻]EL表达式1分钟完事
    Sublime2 破解教程
    全脑瘫IT时代(八)
    全脑瘫IT时代(九)
    迁移完成
    USB Debug Cable (一)
    一个不是很常见的.Net Interop问题
    全脑瘫IT时代(十二)
  • 原文地址:https://www.cnblogs.com/iTaoqi/p/3465605.html
Copyright © 2011-2022 走看看