VOID LockAllModules()
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(
TH32CS_SNAPMODULE, GetCurrentProcessId());
if (hSnapshot != INVALID_HANDLE_VALUE) {
MODULEENTRY32 me = {sizeof(me)};
BOOL fOk = Module32First(hSnapshot, &me);
for (fOk = Module32Next(hSnapshot, &me); fOk; fOk = Module32Next(hSnapshot, &me)){ //跳过第一个;
LoadLibrary(me.szModule);
}
}
}
BOOL CopycatAndHide(HMODULE hDll)
{
IMAGE_DOS_HEADER * pDosHeader;
IMAGE_NT_HEADERS * pNtHeader;
IMAGE_OPTIONAL_HEADER * pOptionalHeader;
LPVOID lpBackMem = 0;
DWORD dwOldProtect;
DWORD dwCount = 30;
pDosHeader = (IMAGE_DOS_HEADER *)hDll;
pNtHeader = (IMAGE_NT_HEADERS *)(pDosHeader->e_lfanew + (DWORD)hDll);
pOptionalHeader = (IMAGE_OPTIONAL_HEADER *)&pNtHeader->OptionalHeader;
LockAllModules();
lpBackMem = VirtualAlloc(0 ,pOptionalHeader->SizeOfImage ,MEM_COMMIT|MEM_RESERVE ,PAGE_EXECUTE_READWRITE);
if(!lpBackMem)
return FALSE;
if(!VirtualProtect((LPVOID)hDll ,pOptionalHeader->SizeOfImage ,PAGE_EXECUTE_READWRITE ,&dwOldProtect))
return FALSE;
g_dwImageSize = pOptionalHeader->SizeOfImage;
memcpy(lpBackMem ,(LPVOID)hDll ,g_dwImageSize );
memset(lpBackMem , 0 ,0x200);
*((PBYTE)hDll + pOptionalHeader->AddressOfEntryPoint) = (BYTE)0xc3;
// DWORD dwRet =0;
do{
dwCount --;
}while(FreeLibrary(hDll) && dwCount);
g_lpNewImage = VirtualAlloc((LPVOID)hDll ,g_dwImageSize ,MEM_COMMIT|MEM_RESERVE ,PAGE_EXECUTE_READWRITE);
if(g_lpNewImage != (LPVOID)hDll)
return FALSE;
memcpy(g_lpNewImage , lpBackMem , g_dwImageSize);
VirtualFree(lpBackMem , 0, MEM_RELEASE);
return TRUE ;
}
支持
