-
-
[求助]请问为什么在模块回调中，内存注入DLL总是会失败呢
-
2019-6-30 11:27
-
我现在要在某个时机注入我的DLL，然后选择了模块回调，当模块回调中某几个DLL加载后，我才会注入我的DLL，但是测试了N遍后发现，只有ntdll被加载后，才能注入我的DLL，其他DLL被加载后再注入，都会卡死到NtAllocateVirtualMemory（R0层的）这里，请问有没有人知道呢 
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
谢谢大表哥，刚刚就在看你的帖子，看你HOOK的是ZwTestAlert， 但既然是HOOK这个进程中的ZwTestAlert，你肯定要修改ZwTestAlert的首字节，然后跳转到你在这个进程中分配的内存中，而用NtAllocateVirtualMemory分配内存却会造成死锁，你是怎么处理的这个啊 |
|
|
我刚刚在分配内存前把AddressCreationLock的锁给自己去掉了，然后分配完内存后又自己加上了，有的程序会触发蓝屏 STACK_TEXT: fffff880`0d7ca7e0 fffff800`04332a89 : fffff880`0d7caa40 00000000`00000010 00000000`00000000 fffff880`0d7caa38 : nt!MmCreateSection+0x641 fffff880`0d7ca9f0 fffff800`040f3ad3 : fffffa80`13db2440 00000000`0e82e7c8 fffff880`0d7caa88 00000000`00000000 : nt!NtCreateSection+0x171 fffff880`0d7caa70 00000000`772c9d2a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0e82e7a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772c9d2a
最后于 2019-6-30 15:06
被一二三六编辑
，原因：
|
|
|
|
|
|
你是怎么去掉锁的？ |
|
|
这是WRK的做法 //
// Get the address creation mutex to block multiple threads
// creating or deleting address space at the same time.
//
LOCK_ADDRESS_SPACE (Process); 它是这里加的锁
//
// Make sure the address space was not deleted, if so, return an error.
//
if (Process->Flags & PS_PROCESS_FLAGS_VM_DELETED) {
status = STATUS_PROCESS_IS_TERMINATING;
goto ErrorReturn;
}
//
// Map the view base on the type.
//
if (ControlArea->u.Flags.PhysicalMemory) {
// 这个函数发起的模块回调
status = MiMapViewOfPhysicalSection (ControlArea,
Process,
CapturedBase,
SectionOffset,
CapturedViewSize,
ProtectionMask,
ZeroBits,
AllocationType);
}
else if (ControlArea->u.Flags.Image) {
if (AllocationType & MEM_RESERVE) {
status = STATUS_INVALID_PARAMETER_9;
}
else if (Win32Protect & PAGE_WRITECOMBINE) {
status = STATUS_INVALID_PARAMETER_10;
}
else {
ImageCommitment = Section->Segment->u1.ImageCommitment;
status = MiMapViewOfImageSection (ControlArea,
Process,
CapturedBase,
SectionOffset,
CapturedViewSize,
Section,
InheritDisposition,
ZeroBits,
AllocationType,
ImageCommitment);
}
}
else {
//
// Not an image section, therefore it is a data section.
//
if (Win32Protect & PAGE_WRITECOMBINE) {
status = STATUS_INVALID_PARAMETER_10;
}
else {
status = MiMapViewOfDataSection (ControlArea,
Process,
CapturedBase,
SectionOffset,
CapturedViewSize,
Section,
InheritDisposition,
ProtectionMask,
CommitSize,
ZeroBits,
AllocationType);
}
}
ErrorReturn:
UNLOCK_ADDRESS_SPACE (Process); 这里解锁 我的做法是直接把这个锁的值提前读出来，然后置零，完成注入DLL后，再恢复， 但是这样可能会出问题，所以不建议使用 |
|
|
不要去尝试直接操作内核，应该尽量调用函数，就不会蓝屏 看一下LOCK_ADDRESS_SPACE和UNLOCK_ADDRESS_SPACE的定义 |
|
|
|
|
|
|
|
|
|
hzqst
