初探DLL注入

DLL被加载到进程后会自动运行DLLMain()函数，用户可以把想执行的代码放到DLLMain()函数，每当加载DLL时，添加的代码就会得到执行。利用这种特性可以修复程序Bug以及添加新功能

DllMain 函数是DLL模块的默认 入口点。当Windows加载DLL模块时调用这一函数。系统首先调用全局对象的 构造函数，然后调用 全局函数DLLMain。DLLMain 函数不仅在将DLL链接加载到进程时被调用，在DLL模块与进程分离时（以及其它时候）也被调用。 BOOL APIENTRY DllMain( HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved){　switch (ul_reason_for_call)　{　　case DLL_PROCESS_ATTACH:      //添加想要执行的代码      //当dll被进程加载时DLLMain被调用　　　//printf(" process attach of dll");　　　break;　　case DLL_THREAD_ATTACH:      //添加想要执行的代码      //当有线程被创建时，DLLMain被调用　　　printf(" thread attach of dll");　　　break;　　case DLL_THREAD_DETACH:      //添加想要执行的代码      //当有线程结束时，DLLMain被调用　　　printf(" thread detach of dll");　　　break;　　case DLL_PROCESS_DETACH:      //添加想要执行的代码      //当dll被进程卸载时，DLLMain被调用　　　printf(" process detach of dll");　　　break;　}　return TRUE;}

1.LoadLibraryA 和 LoadLibraryW 不同字符表示之前一直没有成功，没有使用L,但是使用了LoadLibraryW，导致加载dll失败，如果不使用L，请用LoadLibraryA 2.注册的时候注意DLL完整路径，除非被注入程序和dll在同一个文件夹InjectDll.exe 3480 D:testmyhack.dll

//myhack.cpp#include "windows.h"#include "tchar.h" #pragma comment(lib, "urlmon.lib") #define DEF_URL       (L"http://www.naver.com/index.html")#define DEF_FILE_NAME   (L"index.html") HMODULE g_hMod = NULL; DWORD WINAPI ThreadProc(LPVOID lParam){    TCHAR szPath[_MAX_PATH] = {0,};     if( !GetModuleFileName( g_hMod, szPath, MAX_PATH ) )        return FALSE;         TCHAR *p = _tcsrchr( szPath, '\' );    if( !p )        return FALSE;    //下载指定网站的index.html文件    _tcscpy_s(p+1, _MAX_PATH, DEF_FILE_NAME);     URLDownloadToFile(NULL, DEF_URL, szPath, 0, NULL);      return 0;} BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved){    HANDLE hThread = NULL;     g_hMod = (HMODULE)hinstDLL;     switch( fdwReason )    {    case DLL_PROCESS_ATTACH :  //加载时        OutputDebugString(L"<myhack.dll> Injection!!!"); //输出调试字符串        hThread = CreateThread(NULL, 0, ThreadProc, NULL, 0, NULL); //创建线程        CloseHandle(hThread);        break;    }     return TRUE;}

//InjectDLL.cpp#include "windows.h"#include "tchar.h" BOOL SetPrivilege(LPCTSTR lpszPrivilege, BOOL bEnablePrivilege) {    TOKEN_PRIVILEGES tp;    HANDLE hToken;    LUID luid;     if( !OpenProcessToken(GetCurrentProcess(),                          TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,                           &hToken) )    {        _tprintf(L"OpenProcessToken error: %un", GetLastError());        return FALSE;    }     if( !LookupPrivilegeValue(NULL,           // lookup privilege on local system                              lpszPrivilege,  // privilege to lookup                               &luid) )        // receives LUID of privilege    {        _tprintf(L"LookupPrivilegeValue error: %un", GetLastError() );         return FALSE;     }     tp.PrivilegeCount = 1;    tp.Privileges[0].Luid = luid;    if( bEnablePrivilege )        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;    else        tp.Privileges[0].Attributes = 0;     // Enable the privilege or disable all privileges.    if( !AdjustTokenPrivileges(hToken,                                FALSE,                                &tp,                                sizeof(TOKEN_PRIVILEGES),                                (PTOKEN_PRIVILEGES) NULL,                                (PDWORD) NULL) )    {         _tprintf(L"AdjustTokenPrivileges error: %un", GetLastError() );         return FALSE;     }      if( GetLastError() == ERROR_NOT_ALL_ASSIGNED )    {        _tprintf(L"The token does not have the specified privilege. n");        return FALSE;    }      return TRUE;} BOOL InjectDll(DWORD dwPID, LPCTSTR szDllPath){    HANDLE hProcess = NULL, hThread = NULL;    HMODULE hMod = NULL;    LPVOID pRemoteBuf = NULL;    DWORD dwBufSize = (DWORD)(_tcslen(szDllPath) + 1) * sizeof(TCHAR);    LPTHREAD_START_ROUTINE pThreadProc;     // #1. 使用 dwPID 获取目标进程(notepad.exe)句柄（PROCESS_ALL_ACCESS权限），然后就可以用 hProcess 控制进程.    if ( !(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID)) )    {        _tprintf(L"OpenProcess(%d) failed!!! [%d]n", dwPID, GetLastError());        return FALSE;    }     // #2. 在目标进程(notepad.exe) 内存中分配 szDllName 大小的内存，返回 pRemoteBuf 作为该缓冲区的地址.    pRemoteBuf = VirtualAllocEx(hProcess, NULL, dwBufSize, MEM_COMMIT, PAGE_READWRITE);     // #3. 将 myhack.dll 路径写入刚刚分配的缓冲区.    WriteProcessMemory(hProcess, pRemoteBuf, (LPVOID)szDllPath, dwBufSize, NULL);     // #4. 获取 LoadLibraryW() API 地址，kernel32.dll在每个进程中的加载地址相同（这个特性就是我们要利用的）.    hMod = GetModuleHandle(L"kernel32.dll");    pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(hMod, "LoadLibraryW");         // #5. 在 notepad.exe 中运行线程    hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, pRemoteBuf, 0, NULL); //CreateRemoteThread()驱使进程调用LoadLibrary()，进而加载指定的DLL文件    WaitForSingleObject(hThread, INFINITE);        CloseHandle(hThread);    CloseHandle(hProcess);     return TRUE;} int _tmain(int argc, TCHAR *argv[]){    if( argc != 3)    {        _tprintf(L"USAGE : %s <pid> <dll_path>n", argv[0]);        return 1;    }     // change privilege    if( !SetPrivilege(SE_DEBUG_NAME, TRUE) )        return 1;     // inject dll    if( InjectDll((DWORD)_tstol(argv[1]), argv[2]) )        _tprintf(L"InjectDll("%s") success!!!n", argv[2]);    else        _tprintf(L"InjectDll("%s") failed!!!n", argv[2]);     return 0;}

//获取目标的进程句柄hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID)

pRemoteBuf = VirtualAllocEx(hProcess, NULL, dwBufSize, MEM_COMMIT, PAGE_READWRITE);

提示：VirtualAllocEx()函数的返回值为分配所得缓冲区的地址。该地址不是程序自身进程(Inject.exe)的内存地址，而是hProcess句柄所指目标进程（notepad.exe）的内存地址。

 WriteProcessMemory(hProcess, pRemoteBuf, (LPVOID)szDllPath, dwBufSize, NULL);   //调用API //Windows操作系统提供了调试API，借助其可以访问其它进程的内存空间。 //例如：VirtualAllocEx()、 WriteProcessMemory等

//在windows中，kernel32.dll在每个进程中的加载地址是相同的。hMod = GetModuleHandle(L"kernel32.dll");pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(hMod, "LoadLibraryW");

hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, pRemoteBuf, 0, NULL);

HANDLE CreateRemoteThread(  // 进程句柄  hProcess,                            //  线程安全描述字，指向SECURITY_ATTRIBUTES结构的指针  LPSECURITY_ATTRIBUTES lpThreadAttributes,   SIZE_T dwStackSize,                       //  线程栈大小，以字节表示  LPTHREAD_START_ROUTINE lpStartAddress,    // 指向在远程进程中执行的函数地址  LPVOID lpParameter,                       // 传入参数  DWORD dwCreationFlags,                    // 创建线程的其它标志  LPDWORD lpThreadId                        // 线程身份标志，如果为NULL,则不返回);  HANDLE CreateThread(  LPSECURITY_ATTRIBUTES   lpThreadAttributes,  SIZE_T                  dwStackSize,  LPTHREAD_START_ROUTINE  lpStartAddress,  __drv_aliasesMem LPVOID lpParameter,  DWORD                   dwCreationFlags,  LPDWORD                 lpThreadId);

//调用 CreateRemoteThread 创建远程线程所需要的过程函数的标准形式为DWORD WINAPI ThreadProc(  _In_ LPVOID lpParameter); //Win32编程加载DLL的API为：HMODULE WINAPI LoadLibrary(  _In_ LPCTSTR lpFileName);

提示：FreeLibrary卸载dll的方法只适用于CreateRemoteThread注入

#include "windows.h"#include "tlhelp32.h"#include "tchar.h" #define DEF_PROC_NAME  (L"notepad.exe")#define DEF_DLL_NAME   (L"myhack.dll") DWORD FindProcessID(LPCTSTR szProcessName){    DWORD dwPID = 0xFFFFFFFF;    HANDLE hSnapShot = INVALID_HANDLE_VALUE;    PROCESSENTRY32 pe;     // Get the snapshot of the system    pe.dwSize = sizeof( PROCESSENTRY32 );    hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPALL, NULL );     // find process    Process32First(hSnapShot, &pe);    do    {        if(!_tcsicmp(szProcessName, (LPCTSTR)pe.szExeFile))        {            dwPID = pe.th32ProcessID;            break;        }    }    while(Process32Next(hSnapShot, &pe));     CloseHandle(hSnapShot);     return dwPID;} BOOL SetPrivilege(LPCTSTR lpszPrivilege, BOOL bEnablePrivilege) {    TOKEN_PRIVILEGES tp;    HANDLE hToken;    LUID luid;     if( !OpenProcessToken(GetCurrentProcess(),                          TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,                           &hToken) )    {        _tprintf(L"OpenProcessToken error: %un", GetLastError());        return FALSE;    }     if( !LookupPrivilegeValue(NULL,           // lookup privilege on local system                              lpszPrivilege,  // privilege to lookup                               &luid) )        // receives LUID of privilege    {        _tprintf(L"LookupPrivilegeValue error: %un", GetLastError() );         return FALSE;     }     tp.PrivilegeCount = 1;    tp.Privileges[0].Luid = luid;    if( bEnablePrivilege )        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;    else        tp.Privileges[0].Attributes = 0;     // Enable the privilege or disable all privileges.    if( !AdjustTokenPrivileges(hToken,                                FALSE,                                &tp,                                sizeof(TOKEN_PRIVILEGES),                                (PTOKEN_PRIVILEGES) NULL,                                (PDWORD) NULL) )    {         _tprintf(L"AdjustTokenPrivileges error: %un", GetLastError() );         return FALSE;     }      if( GetLastError() == ERROR_NOT_ALL_ASSIGNED )    {        _tprintf(L"The token does not have the specified privilege. n");        return FALSE;    }      return TRUE;} BOOL EjectDll(DWORD dwPID, LPCTSTR szDllName){    BOOL bMore = FALSE, bFound = FALSE;    HANDLE hSnapshot, hProcess, hThread;    HMODULE hModule = NULL;    MODULEENTRY32 me = { sizeof(me) };    LPTHREAD_START_ROUTINE pThreadProc;     // dwPID = notepad 进程 ID    // 使用 TH32CS_SNAPMODULE 参数，获取加载到 notepad 进程的 DLL名称    hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);     bMore = Module32First(hSnapshot, &me);    for( ; bMore ; bMore = Module32Next(hSnapshot, &me) )    {        if( !_tcsicmp((LPCTSTR)me.szModule, szDllName) ||             !_tcsicmp((LPCTSTR)me.szExePath, szDllName) )         {            bFound = TRUE;            break;        }    }     if( !bFound )    {        CloseHandle(hSnapshot);        return FALSE;    }     if ( !(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID)) ) //使用进程ID来获取目标进程的进程句柄    {        _tprintf(L"OpenProcess(%d) failed!!! [%d]n", dwPID, GetLastError());        return FALSE;    }        //获取加载到EjectDll.exe进程的kernel32.FreeLibrary地址（这个地址在所有进程中是一样的）    hModule = GetModuleHandle(L"kernel32.dll");    pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(hModule, "FreeLibrary");         //在目标进程中运行线程，pThreadProc是FreeLibrary地址，me.modBaseAddr是要卸载的DLL的加载地址    hThread = CreateRemoteThread(hProcess, NULL, 0,                                  pThreadProc, me.modBaseAddr,                                  0, NULL);    WaitForSingleObject(hThread, INFINITE);        CloseHandle(hThread);    CloseHandle(hProcess);    CloseHandle(hSnapshot);     return TRUE;} int _tmain(int argc, TCHAR* argv[]){    DWORD dwPID = 0xFFFFFFFF;      // find process    dwPID = FindProcessID(DEF_PROC_NAME);    if( dwPID == 0xFFFFFFFF )    {        _tprintf(L"There is no <%s> process!n", DEF_PROC_NAME);        return 1;    }     _tprintf(L"PID of "%s" is %dn", DEF_PROC_NAME, dwPID);     // change privilege    if( !SetPrivilege(SE_DEBUG_NAME, TRUE) )        return 1;     // eject dll    if( EjectDll(dwPID, DEF_DLL_NAME) )        _tprintf(L"EjectDll(%d, "%s") success!!!n", dwPID, DEF_DLL_NAME);    else        _tprintf(L"EjectDll(%d, "%s") failed!!!n", dwPID, DEF_DLL_NAME);     return 0;}

hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);//使用 Create Toolhelp32Snapshot0 API 可以获取加载到进程的模块（ DLL ）信息。//将获取的 hSnapshot 句柄传递给Module32First(Module32NextO函数后，//即可设置与MODULEENTRY32结构体相关的模块信息.

hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID)//使用pid获取目标进程的进程句柄

 hModule = GetModuleHandle(L"kernel32.dll"); pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(hModule, "FreeLibrary"); //若要驱使 notepad 进程自己调用 FreeLibrary API ，需要先得到 FreeLibrary的地址。 //然而代码获取的不是加载到 notepad.exe 进程中的Kernel32!FreeLibrary 地址，// 而是加载到 EjectDl . exei 程中的Kernel32! FreeLibrary 地址。

hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, me.modBaseAddr, 0, NULL);//pThreadProc 参数是 FreeLibrary API 的地址,//me.modBaseAddr 参数是要卸载的 DLL 的加载地址。//将线程函数指定为 FreeLibrary 函数，并把 DLL 加载地址传递给线程参数，//就在目称世中成功调用了 FreeLibraryO ) API 。

// myhack2.cpp #include "windows.h"#include "tchar.h" #define DEF_CMD  L"c:\Program Files\Internet Explorer\iexplore.exe" #define DEF_ADDR L"http://www.naver.com"#define DEF_DST_PROC L"notepad.exe" BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved){    TCHAR szCmd[MAX_PATH]  = {0,};    TCHAR szPath[MAX_PATH] = {0,};    TCHAR *p = NULL;    STARTUPINFO si = {0,};    PROCESS_INFORMATION pi = {0,};     si.cb = sizeof(STARTUPINFO);    si.dwFlags = STARTF_USESHOWWINDOW;    si.wShowWindow = SW_HIDE;     switch( fdwReason )    {    case DLL_PROCESS_ATTACH :         if( !GetModuleFileName( NULL, szPath, MAX_PATH ) )            break;            if( !(p = _tcsrchr(szPath, '\')) )            break;         if( _tcsicmp(p+1, DEF_DST_PROC) )            break;         wsprintf(szCmd, L"%s %s", DEF_CMD, DEF_ADDR);        if( !CreateProcess(NULL, (LPTSTR)(LPCTSTR)szCmd,                             NULL, NULL, FALSE,                             NORMAL_PRIORITY_CLASS,                             NULL, NULL, &si, &pi) )            break;         if( pi.hProcess != NULL )            CloseHandle(pi.hProcess);         break;    }        return TRUE;}

HHOOK SetWindowsHookEx( 　　int idHook, // 钩子的类型，即它处理的消息类型 　　HOOKPROC lpfn, //钩子子程的地址指针。如果dwThreadId参数为0 　　// 或是一个由别的进程创建的线程的标识， 　　// lpfn必须指向DLL中的钩子子程。 　　// 除此以外，lpfn可以指向当前进程的一段钩子子程代码。 　　//钩子函数的入口地址，当钩子钩到任何消息后便调用这个函数。 　　HINSTANCE hMod,     //应用程序实例的句柄。标识包含lpfn所指的子程的DLL。 　　// 如果dwThreadId 标识当前进程创建的一个线程， 　　// 而且子程代码位于当前进程，hMod必须为NULL。 　　// 可以很简单的设定其为本应用程序的实例句柄。 　　DWORD dwThreadId //与安装的钩子子程相关联的线程的标识符。 　　// 如果为0，钩子子程与所有的线程关联，即为全局钩子。 　　);

//HookMain.exe #include "stdio.h"#include "conio.h"#include "windows.h" #define DEF_DLL_NAME        "KeyHook.dll"#define DEF_HOOKSTART       "HookStart"#define DEF_HOOKSTOP        "HookStop" typedef void (*PFN_HOOKSTART)();typedef void (*PFN_HOOKSTOP)(); void main(){    HMODULE         hDll = NULL;    PFN_HOOKSTART   HookStart = NULL;    PFN_HOOKSTOP    HookStop = NULL;    char            ch = 0;     // 加载KeyHook.dll    hDll = LoadLibraryA(DEF_DLL_NAME);    if( hDll == NULL )    {        printf("LoadLibrary(%s) failed!!! [%d]", DEF_DLL_NAME, GetLastError());        return;    }     // 获取导出函数地址    HookStart = (PFN_HOOKSTART)GetProcAddress(hDll, DEF_HOOKSTART);    HookStop = (PFN_HOOKSTOP)GetProcAddress(hDll, DEF_HOOKSTOP);     // 开始    HookStart();     // “q”退出    printf("press 'q' to quit!n");    while( _getch() != 'q' )    ;     // 结束    HookStop();         // 卸载 KeyHook.dll     FreeLibrary(hDll);}

// KeyHook.dll #include "stdio.h"#include "windows.h" #define DEF_PROCESS_NAME       "notepad.exe" HINSTANCE g_hInstance = NULL;HHOOK g_hHook = NULL;HWND g_hWnd = NULL; BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpvReserved){    switch( dwReason )    {        case DLL_PROCESS_ATTACH:            g_hInstance = hinstDLL;            break;         case DLL_PROCESS_DETACH:            break;     }     return TRUE;} LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam){    char szPath[MAX_PATH] = {0,};    char *p = NULL;     if( nCode >= 0 )    {        // bit 31 : 0 => press, 1 => release        if( !(lParam & 0x80000000) ) //释放键盘按键时        {            GetModuleFileNameA(NULL, szPath, MAX_PATH);            p = strrchr(szPath, '\');             // 比较当前进程名称，如果是 notepad.exe 则消息不会传给应用程序            if( !_stricmp(p + 1, DEF_PROCESS_NAME) )                return 1;        }    }     //反之，调用 CallNextHookEx() 消息传给应用程序    return CallNextHookEx(g_hHook, nCode, wParam, lParam);} #ifdef __cplusplusextern "C" {#endif    __declspec(dllexport) void HookStart(){        g_hHook = SetWindowsHookEx(WH_KEYBOARD, KeyboardProc, g_hInstance, 0);    }     __declspec(dllexport) void HookStop(){        if( g_hHook )        {            UnhookWindowsHookEx(g_hHook);            g_hHook = NULL;        }    }#ifdef __cplusplus}#endif

1、逐行跟踪调试2、检索相关API3、搜索相关字符串

1、OD运行notepad.exe2、开启Break on new module(中断于新模块)选项3、运行HookMain.exe4、进行键盘输入，触发键盘消息事件5、dll被注入6、OD中设置钩子进程（KeyboardProc）断点