【windows核心编程】使用远程线程注入DLL

 

前言

该技术是指通过在【目标进程】中创建一个【远程线程】来达到注入的目的。

创建的【远程线程】函数为LoadLibrary， 线程函数的参数为DLL名字， 想要做的工作在DLL中编写。

 

 示意图如下:

 

 

 

 相关API

1、创建远程线程

//该函数除了第一个参数为目标进程句柄外 //其他参数均和CreateThread一样
HANDLE hThread = CreateRemoteThread( __in HANDLE hProcess, //目标进程句柄
 __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, __in SIZE_T dwStackSize, //线程栈初始预定空间=Max(/STACK, dwStackSize, 初始调拨大小=(dwStackSize == 0? /STACK, dwStackSize)
 __in LPTHREAD_START_ROUTINE lpStartAddress, //线程函数 __in_opt LPVOID lpParameter, //线程函数参数
                __in DWORD dwCreationFlags,     //标志
                __out_opt LPDWORD lpThreadId    //线程ID
 )

 

 

 失败返回NULL

 

 

2、根据进程ID获取进程句柄，并且传入相应权限标志，自定义函数

//根据进程ID获取进程句柄
HANDLE GetProcessHandle(DWORD deProcessID) { HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION //查询进程句柄
        | PROCESS_VM_OPERATION     //PROCESS_VM_WRITE + PROCESS_VM_READ + x 
        | PROCESS_CREATE_THREAD    //创建线程
        | PROCESS_VM_WRITE,        //WriteProcessMemory
        FALSE,                     //不继承
        deProcessID                //进程句柄
 ); return hProcess; }

 

 

 

3、获得LoadLibrary函数地址

由于LoadLibrary是个宏，而非实际的函数，因此需要使用GetProcAddress并传入LoadLibraryW 或 LoadLibraryA来获取真实地址

 

 4、从目标进程申请内存

当把Dll名字作为线程函数LoadLibraryW(A)的参数传给他时，由于此时的线程是运行在其他进程地址空间中的，因此当把本地进程中的字符串指针传给CreateRemoteThread函数时会引起访问违例，因此需要从目标进程地址空间中申请内存，并将本地Dll名字符串写入远程进程，然后使用远程进程中的地址作为CreateRemoteThread函数的参数。

//该函数除了第一个参数为进程句柄外 //其他参数和VirtualAlloc一样
LPVOID WINAPI VirtualAllocEx( __in HANDLE hProcess, //进程句柄
  __in_opt  LPVOID lpAddress,   //地址，为NULL自动找一个合适的地址
  __in      SIZE_T dwSize,           //内存块大小，单位为字节
  __in      DWORD flAllocationType, //分配类型，预定或调拨
  __in      DWORD flProtect             //保护属性
);

 

 

 

5、往远程进程中写输入， 即把本地DLL名字字符串 写入 远程进程地址空间中

BOOL WINAPI WriteProcessMemory( __in HANDLE hProcess, //进程句柄
  __in   LPVOID lpBaseAddress, //写入地址
  __in   LPCVOID lpBuffer,          //源缓冲区
  __in   SIZE_T nSize,                 //缓冲区大小，单位为字节
  __out  SIZE_T *lpNumberOfBytesWritten  //实际写入的字节数
);

 

 

 

 

No code you say a XX

本demo的作用是将一个DLL注入一个窗口标题为"Endl"的目标进程，该DLL的作用是在DLL_PROCESS_ATTACH中ExitProcess，即强制退出目标进程。

 

开发进程代码

//根据进程ID获取进程句柄
HANDLE GetProcessHandle(DWORD deProcessID) { HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION //查询进程句柄
        | PROCESS_VM_OPERATION     //PROCESS_VM_WRITE + PROCESS_VM_READ + x 
        | PROCESS_CREATE_THREAD    //创建线程
        | PROCESS_VM_WRITE,        //WriteProcessMemory
        FALSE,                     //不继承
        deProcessID                //进程句柄
 ); return hProcess; } int _tmain(int argc, _TCHAR* argv[]) { DWORD dwErrCode = 0; //获取进程ID //HWND hWnd = FindWindow(NULL, _T("计算器"));
    HWND hWnd = FindWindow(NULL, _T("Endl")); DWORD dwProcessID = 0; GetWindowThreadProcessId(hWnd, &dwProcessID); HANDLE hDestProcess = GetProcessHandle(dwProcessID); if(NULL == hDestProcess) { cerr<<"打开进程句柄失败"<<endl; return 0; } //获取KERNER32.DLL 模块句柄
    HMODULE hModule = GetModuleHandle(_T("kernel32.dll")); if(NULL == hModule) { cerr<<"获取kernel32.dll句柄失败"<<endl; return -1; } //线程函数，kernerl32.dll被映射到所有进程内相同的地址
    LPTHREAD_START_ROUTINE lpThreadStartRoutine = 
                         (LPTHREAD_START_ROUTINE)GetProcAddress(hModule, "LoadLibraryW");
 if(NULL == lpThreadStartRoutine) { cerr<<"获取LoadLibraryW地址失败"<<endl; return -2; } //从目标进程内申请堆内存
    LPVOID lpMemory = VirtualAllocEx(
                     hDestProcess, NULL, MAX_PATH, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); if(NULL == lpMemory) { cerr<<"申请目标进程内存失败"<<endl; return -3; } //注入DLL
    LPCTSTR lpDLLName = _T("DLLForRemoteThread.dll"); //把DLL名字写入目标进程
    BOOL bWriteMemory = WriteProcessMemory( hDestProcess, lpMemory, lpDLLName, (_tcslen(lpDLLName) + 1) * sizeof(lpDLLName[0]), NULL); if(FALSE == bWriteMemory) { cerr<<"WriteProcessMemory失败"<<endl; dwErrCode = GetLastError(); VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT); return -4; } //创建远程线程
    HANDLE hThread = CreateRemoteThread( hDestProcess, NULL, 0, lpThreadStartRoutine, lpMemory, 0, NULL); if (NULL == hThread || INVALID_HANDLE_VALUE == hThread) { cerr<<"创建远程线程CreateRomoteThread失败"<<endl; VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT); return -5; } VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT); return 0; }

 

 

 

 

 待注入DLL代码

BOOL APIENTRY DllMain( HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ) { switch(ul_reason_for_call) { case DLL_PROCESS_ATTACH: #if defined _DEBUG OutputDebugString(TEXT("\r\n*************DLL_PROCESS_ATTACH*************")); #endif ExitProcess(1); break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; case DLL_PROCESS_DETACH: break; } return TRUE; }