最近在学习写DLL进程注入，刚好在看黑客编程那本书。
里面有个实例。自己改了代码XP,WIN7下注入也不行。
源例子注入也不行，请懂的人来看看。
Dll code:
#include "stdafx.h"
#include <stdio.h>
#include <winsock2.h>
#pragma comment(lib, "ws2_32")
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch(ul_reason_for_call)
{
//DLL被加载到内存时
case DLL_PROCESS_ATTACH:
{
MessageBox(NULL,"Hello word",NULL,MB_OK);
break;
}
default:break;
}
return TRUE;
}注入程序代码:
#include "stdafx.h"
#include <Windows.h>
#include <tlhelp32.h>
#include <stdio.h>
int EnableDebugPriv(const char * name)
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
LUID luid;
//打开进程令牌环
if(!OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,
&hToken) )
{
printf("OpenProcessToken error\n");
return 1;
}
//获得进程本地唯一ID
if(!LookupPrivilegeValue(NULL,name,&luid))
{
printf("LookupPrivilege error!\n");
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes =SE_PRIVILEGE_ENABLED;
tp.Privileges[0].Luid = luid;
//调整进程权限
if(!AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL) )
{
printf("AdjustTokenPrivileges error!\n");
return 1;
}
return 0;
}
BOOL InjectDll(const char *DllFullPath, const DWORD dwRemoteProcessId)
{
HANDLE hRemoteProcess;
//获得调试权限
if(EnableDebugPriv(SE_DEBUG_NAME))
{
printf("add privilege error");
return FALSE;
}
//打开目标进程
if((hRemoteProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwRemoteProcessId))==NULL)
{
printf("OpenProcess error\n");
return FALSE;
}
char *pszLibFileRemote;
//申请存放dll文件名的路径
pszLibFileRemote=(char *)VirtualAllocEx( hRemoteProcess,
NULL, lstrlen(DllFullPath)+1,
MEM_COMMIT, PAGE_READWRITE);
if(pszLibFileRemote==NULL)
{
printf("VirtualAllocEx error\n");
return FALSE;
}
//把dll的完整路径写入到内存，
if(WriteProcessMemory(hRemoteProcess,
pszLibFileRemote,(void *)DllFullPath,lstrlen(DllFullPath)+1,NULL) == 0)
{
printf("WriteProcessMemory error\n");
return FALSE;
}
//得到LoadLibraryA函数地址
PTHREAD_START_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE)
GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");
if(pfnStartAddr == NULL)
{
printf("GetProcAddress error\n");
return FALSE;
}
HANDLE hRemoteThread;
//启动远程线程
if( (hRemoteThread = CreateRemoteThread(hRemoteProcess,NULL,0,
pfnStartAddr,pszLibFileRemote,0,NULL))==NULL)
{
printf("CreateRemoteThread error\n");
return FALSE;
}
return TRUE;
}
DWORD GetProcessID(char *ProcessName)
{
PROCESSENTRY32 pe32;
pe32.dwSize=sizeof(pe32);
//获得系统内所有进程快照
HANDLE hProcessSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(hProcessSnap==INVALID_HANDLE_VALUE)
{
printf("CreateToolhelp32Snapshot error");
return 0;
}
//枚举列表中的第一个进程
BOOL bProcess=Process32First(hProcessSnap,&pe32);
while(bProcess)
{
//比较找到的进程名和我们要查找的进程名，一样则返回进程id
if(strcmp(strupr(pe32.szExeFile),strupr(ProcessName))==0)
return pe32.th32ProcessID;
//继续查找
bProcess=Process32Next(hProcessSnap,&pe32);
}
CloseHandle(hProcessSnap);
return 0;
}
int main(int argc,char *argv[])
{
char Dllpath[255];
GetCurrentDirectory(sizeof(Dllpath),Dllpath);
strcat(Dllpath,"\\test.dll");
printf("Current path is :%s\r\n",Dllpath);
Sleep(2000);
DWORD Pid = GetProcessID("iexplore.exe");
InjectDll(Dllpath,Pid);
MessageBox(NULL,"inject process susscess",NULL,MB_OK);
return 0;
}
一运行就报错，不知道哪儿的问题。还请懂的大牛看看。 谢谢。
[课程]FART 脱壳王！加量不加价！FART作者讲授！
