使用远程线程注入DLL

使用远程线程注入DLL

总览

注入

1. OpenProcess()
2. VirtualAllocEx()
3. WriteProcessMemory()
4. GetProcessAddress() -> LoadLibrary
5. CreateRemoteThread() -> LoadLibrary() -> DLLMain()

注出

1. CreateToolhelp2Snapshot()
2. Module2FirstW Module2extW
3. OpenProcess()
4. GetProcessAddress -> FreeLibrary()
5. CreateRemoteThread() -> FreeLibrary()

注入

BOOL WIAPI injectLibW(DWORD pid, PCWSTR path) {
	BOOL bRet = FALSE;
	HADLE hProcess = ULL, hThread = ULL;
	PCWSTR pszLibFileRemote = ULL;
	CString test;

	//hProcess = OpenProcess(
	//	PROCESS_QUERY_IFORMATIO |
	//	PROCESS_CREATE_THREAD |
	//	PROCESS_VM_OPERATIO |
	//	PROCESS_VM_WRITE,
	//	FALSE,
	//	pid
	//);
	hProcess = OpenProcess(
		PROCESS_ALL_ACCESS,
		FALSE,
		pid);
	if (hProcess == ULL)	return FALSE;
	int pathLen = lstrlenW(path) + 1;
	int pathByteum = pathLen * sizeof(wchar_t);

	pszLibFileRemote = (PCWSTR)VirtualAllocEx(hProcess, ULL, pathByteum, MEM_COMMIT, PAGE_READWRITE);
	if (pszLibFileRemote == ULL)	return FALSE;
	if (!WriteProcessMemory(hProcess, (LPVOID)pszLibFileRemote, path, pathByteum, ULL))	return FALSE;
	PTHREAD_START_ROUTIE pLoadLib = (PTHREAD_START_ROUTIE)GetProcAddress(GetModuleHandle(_T("Kernel2")), "LoadLibraryW");
	if (pLoadLib == ULL)	return FALSE;
	AfxMessageBox(_T("OK"));
	hThread = CreateRemoteThread(hProcess, ULL, 0,
		pLoadLib,
		(LPTHREAD_START_ROUTIE)pszLibFileRemote,
		0,
		ULL);
	if (hThread == ULL) {
		test.Format(_T("%d"), GetLastError());
		AfxMessageBox(test);
		return FALSE;
	}
	AfxMessageBox(_T("OK"));
	WaitForSingleObject(hThread, IFIITE);

	bRet = TRUE;


	if (pszLibFileRemote != ULL)
	{
		VirtualFreeEx(hProcess, (LPVOID)pszLibFileRemote, 0, MEM_RELEASE);
	}
	if (hThread != ULL)
	{
		CloseHandle(hThread);
	}
	if (hProcess != ULL)
	{
		CloseHandle(hProcess);
	}

	return bRet;
}

BOOL WIAPI injectLibA(DWORD pid, PCSTR path) {
	SIZE_T size = lstrlenA(path);
	PWSTR pathw = (PWSTR)_alloca(size * sizeof(wchar_t));
	StringCchPrintfW(pathw, size, L"%s", path);
	return injectLibW(pid, pathw);
}

注出

BOOL WIAPI unInjectLibW(DWORD pid, PCWSTR path) {
	BOOL bRet = FALSE;
	HADLE hSnapshot = ULL;
	HADLE hProcess = ULL, hThead = ULL;

	hSnapshot = CreateToolhelp2Snapshot(TH2CS_SAPMODULE, pid);
	if (hSnapshot == ULL) return FALSE;
	MODULEETRY2W me = { sizeof(me) };
	BOOL bFound = FALSE;
	BOOL bMoreMods = Module2FirstW(hSnapshot, &me);
	for (;bMoreMods;bMoreMods = Module2extW(hSnapshot, &me))
	{
		bFound = (_wcsicmp(me.szModule, path) == 0 || _wcsicmp(me.szExePath, path) == 0);
		if (bFound)
		{
			break;
		}
	}
	if (!bFound) {
		AfxMessageBox(L"到到你要卸载的dll");
		return FALSE;
	}

	hProcess = OpenProcess(
		PROCESS_ALL_ACCESS,
		FALSE,
		pid
	);

	PTHREAD_START_ROUTIE psrThread = (PTHREAD_START_ROUTIE)GetProcAddress(GetModuleHandle(TEXT("Kernel2")), "FreeLibrary");
	if (psrThread == ULL)
	{
		AfxMessageBox(L"freelibrary失败");
		return FALSE;
	}
	hThead = CreateRemoteThread(hProcess, ULL, 0, psrThread, , 0, ULL);
	if (hThead == ULL)
	{
		AfxMessageBox(L"CreateRemoteThread失败");
		return FALSE;
	}
	WaitForSingleObject(hThead, IFIITE);
	bRet = TRUE;
	if (hSnapshot != ULL)
	{
		CloseHandle(hSnapshot);
	}
	if (hThead != ULL)
	{
		CloseHandle(hThead);
	}
	if (hProcess != ULL)
	{
		CloseHandle(hProcess);
	}

	return bRet;

}