-
-
[旧帖] [原创]汇编源码-线程注入DLL 0.00雪花
-
2012-11-13 10:47
-
;主要功能：让exe启动的时候加载我们自己的DLL
;感谢蓝天师傅和CK牛，帮了我不少，刚学汇编，大多都是API，代码不规范，希望大家指点一下，小菜好学，哪个大牛好心收了我吧
;QQ：897701810
;留个QQ，说不定哪个大牛好心就收下我了，嘿嘿
.386
.model flat, stdcall
option casemap:none
include windows.inc
include user32.inc
include kernel32.inc
includelib user32.lib
includelib kernel32.lib
.data?
stStartUp STARTUPINFO <?>
stProcInfo PROCESS_INFORMATION <?>
hMemory dd ?
hh dd ?
.data
szDllKernel db 'Kernel32.dll',0
szLoadLibrary db 'LoadLibraryA',0
szFile db 'test.exe',0
szDll db 'Patch.dll',0
szCaption db '错误！！',0
szText db '进程创建失败，请确认文件存在',0
.code
Main:
invoke GetStartupInfo,offset stStartUp
invoke CreateProcess,offset szFile,NULL,NULL,NULL,NULL,CREATE_SUSPENDED,NULL,NULL, offset stStartUp,offset stProcInfo
cmp eax,0
jz exit
invoke VirtualAllocEx,stProcInfo.hProcess,NULL,12,MEM_COMMIT,PAGE_EXECUTE_READWRITE
mov hMemory,eax
invoke lstrlen,offset szDll
inc eax
invoke WriteProcessMemory,stProcInfo.hProcess,hMemory,offset szDll,eax,NULL
invoke GetModuleHandle,offset szDllKernel
invoke GetProcAddress,eax,offset szLoadLibrary
mov hh,eax
invoke CreateRemoteThread,stProcInfo.hProcess,NULL,1000H,hh,hMemory,NULL,NULL
invoke ResumeThread,stProcInfo.hThread
invoke CloseHandle,stProcInfo.hProcess
invoke CloseHandle,stProcInfo.hThread
invoke ExitProcess,0
exit: invoke MessageBox,NULL,offset szText,offset szCaption,MB_OK
invoke ExitProcess,NULL
end Main
;感谢蓝天师傅和CK牛，帮了我不少，刚学汇编，大多都是API，代码不规范，希望大家指点一下，小菜好学，哪个大牛好心收了我吧
;QQ：897701810
;留个QQ，说不定哪个大牛好心就收下我了，嘿嘿
.386
.model flat, stdcall
option casemap:none
include windows.inc
include user32.inc
include kernel32.inc
includelib user32.lib
includelib kernel32.lib
.data?
stStartUp STARTUPINFO <?>
stProcInfo PROCESS_INFORMATION <?>
hMemory dd ?
hh dd ?
.data
szDllKernel db 'Kernel32.dll',0
szLoadLibrary db 'LoadLibraryA',0
szFile db 'test.exe',0
szDll db 'Patch.dll',0
szCaption db '错误！！',0
szText db '进程创建失败，请确认文件存在',0
.code
Main:
invoke GetStartupInfo,offset stStartUp
invoke CreateProcess,offset szFile,NULL,NULL,NULL,NULL,CREATE_SUSPENDED,NULL,NULL, offset stStartUp,offset stProcInfo
cmp eax,0
jz exit
invoke VirtualAllocEx,stProcInfo.hProcess,NULL,12,MEM_COMMIT,PAGE_EXECUTE_READWRITE
mov hMemory,eax
invoke lstrlen,offset szDll
inc eax
invoke WriteProcessMemory,stProcInfo.hProcess,hMemory,offset szDll,eax,NULL
invoke GetModuleHandle,offset szDllKernel
invoke GetProcAddress,eax,offset szLoadLibrary
mov hh,eax
invoke CreateRemoteThread,stProcInfo.hProcess,NULL,1000H,hh,hMemory,NULL,NULL
invoke ResumeThread,stProcInfo.hThread
invoke CloseHandle,stProcInfo.hProcess
invoke CloseHandle,stProcInfo.hThread
invoke ExitProcess,0
exit: invoke MessageBox,NULL,offset szText,offset szCaption,MB_OK
invoke ExitProcess,NULL
end Main
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
