欢迎来到天天文库
浏览记录
ID:6140525
大小:35.00 KB
页数:4页
时间:2018-01-04
《dll注入经典方法完整版》由会员上传分享,免费在线阅读,更多相关内容在应用文档-天天文库。
1、Dll注入经典方法完整版1,OpenProcess获得要注入进程的句柄2,VirtualAllocEx在远程进程中开辟出一段内存,长度为strlen(dllname)+1;3,WriteProcessMemory将Dll的名字写入第二步开辟出的内存中。4,CreateRemoteThread将LoadLibraryA作为线程函数,参数为Dll的名称,创建新线程5,CloseHandle关闭线程句柄卸载Dll:1,CreateRemoteThread将GetModuleHandle注入到远程进程中,参数为被注入的Dll名2,GetExitCodeThread将线程退出的退出码
2、作为Dll模块的句柄值。3,CloseHandle关闭线程句柄3,CreateRemoteThread将FreeLibraryA注入到远程进程中,参数为第二步获得的句柄值。4,WaitForSingleObject等待对象句柄返回5,CloseHandle关闭线程及进程句柄。1.#include 2.#include 3.#include 4. 5. 6.DWORD getProcessHandle(LPCTSTR lpProcessName)//根据进程名查找进程PID 7.{ 1. DWORD
3、dwRet = 0; 2. HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); 3. if(hSnapShot == INVALID_HANDLE_VALUE) 4. { 5. printf("获得进程快照失败%d",GetLastError()); 6. return dwRet; 7. } 8. 9. PROCESSENTRY32 pe32;//声明进程入口对象 10. pe32.dwSize = sizeof(PROCE
4、SSENTRY32);//填充进程入口对象大小 11. Process32First(hSnapShot,&pe32);//遍历进程列表 12. do 13. { 14. if(!lstrcmp(pe32.szExeFile,lpProcessName))//查找指定进程名的PID 15. { 16. dwRet = pe32.th32ProcessID; 17. break; 18. } 19. } while (Process32Next(hSnapShot,
5、&pe32)); 20. CloseHandle(hSnapShot); 21. return dwRet;//返回 22.} 23. 24.INT main(INT argc,CHAR * argv[]) 25.{ 26. DWORD dwPid = getProcessHandle((LPCTSTR)argv[1]); 27. LPCSTR lpDllName = "EvilDll.dll"; 28. HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION
6、PROCESS_VM_WRITE,FA
7、LSE,dwPid); 29. if(hProcess == NULL) 30. { 31. printf("获取进程句柄错误%d",GetLastError()); 32. return -1; 33. } 34. DWORD dwSize = strlen(lpDllName)+1; 35. DWORD dwHasWrite; 36. LPVOID lpRemoteBuf = VirtualAllocEx(hProcess,NULL,dwSize,MEM_COMMIT,PAGE_READWRITE);
8、 1. if(WriteProcessMemory(hProcess,lpRemoteBuf,lpDllName,dwSize,&dwHasWrite)) 2. { 3. if(dwHasWrite != dwSize) 4. { 5. VirtualFreeEx(hProcess,lpRemoteBuf,dwSize,MEM_COMMIT); 6. CloseHandle(hProcess); 7. retu
此文档下载收益归作者所有