[分享]Wow64环境下32位程序注入64位DLL到64位进程-逆向工程-看雪安全社区

#include "wow64ext.h"

#pragma comment(lib, "wow64ext.lib")

//unsigned char injectCode[] = {
//    0x48, 0x83, 0xEC, 0x28,                      // sub rsp, 0x28
//    0x48, 0x31, 0xC9,                            // xor rcx, rcx // SearchPath = NULL
//    0x48, 0x31, 0xD2,                            // xor rdx, rdx // LoadFlags = 0
//    0x49, 0xB8, 0x00, 0x00, 0x00, 0x00, ...      // mov r8, ModuleFileName
//    0x49, 0xB9, 0x00, 0x00, 0x00, 0x00, ...      // mov r9, ModuleHandle
//    0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, ...      // mov rax, LdrLoadDll
//    0xFF, 0xD0,                                  // call rax
//    0x48, 0x31, 0xC9,                            // xor rcx, rcx // Status = STATUS_SUCCESS
//    0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, ...      // mov rax, RtlExitUserThread
//    0xFF, 0xD0,                                  // call rax
//};

#pragma pack(push, 1)
struct InjectCode {
    unsigned char code0[12] = { 0x48, 0x83, 0xEC, 0x28, 0x48, 0x31, 0xC9, 0x48, 0x31, 0xD2, 0x49, 0xB8 };
    DWORD64 moduleFileName = 0;
    unsigned char code1[2] = { 0x49, 0xB9 };
    DWORD64 moduleHandle = 0;
    unsigned char code2[2] = { 0x48, 0xB8 };
    DWORD64 ldrLoadDll = 0;
    unsigned char code3[7] = { 0xFF, 0xD0, 0x48, 0x31, 0xC9, 0x48, 0xB8 };
    DWORD64 rtlExitUserThread = 0;
    unsigned char code4[2] = { 0xFF, 0xD0 };
};

struct InjectMemory {
    InjectCode injectCode;
    DWORD64 moduleHandle = 0;
    _UNICODE_STRING_T<DWORD64> moduleFileNameUnicode = {};
    WCHAR moduleFileName[MAX_PATH] = {};
};
#pragma pack(pop)

BOOL Inject32To64(DWORD dwProcessId, PCWSTR moduleFileName) {
    BOOL result = FALSE;
    HANDLE hProcess;
    InjectMemory injectMemory;
    DWORD64 injectMemoryAddr;
    SIZE_T dwNumberOfBytesWritten;
    DWORD64 hRemoteThread = 0;
    UCHAR client_id[16] = { 0 };
    wcscpy_s(injectMemory.moduleFileName, MAX_PATH, moduleFileName);
    DWORD64 ntdll64 = GetModuleHandle64(L"ntdll.dll");
    DWORD64 ntdll_LdrLoadDll = GetProcAddress64(ntdll64, "LdrLoadDll");
    DWORD64 ntdll_RtlExitUserThread = GetProcAddress64(ntdll64, "RtlExitUserThread");
    DWORD64 ntdll_RtlCreateUserThread = GetProcAddress64(ntdll64, "RtlCreateUserThread");
    if (ntdll_LdrLoadDll == 0 || ntdll_RtlExitUserThread == 0 || ntdll_RtlCreateUserThread == 0)
        goto END_0;
    injectMemory.injectCode.ldrLoadDll = ntdll_LdrLoadDll;
    injectMemory.injectCode.rtlExitUserThread = ntdll_RtlExitUserThread;
    hProcess = OpenProcess(
        PROCESS_CREATE_THREAD | 
        PROCESS_QUERY_INFORMATION | 
        PROCESS_VM_OPERATION | 
        PROCESS_VM_WRITE | 
        PROCESS_VM_READ, FALSE, dwProcessId);
    if (!hProcess) goto END_0;
    injectMemoryAddr = VirtualAllocEx64(hProcess, NULL, sizeof(injectMemory), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (injectMemoryAddr == 0) goto END_1;
    injectMemory.injectCode.moduleHandle = injectMemoryAddr + offsetof(InjectMemory, moduleHandle);
    injectMemory.injectCode.moduleFileName = injectMemoryAddr + offsetof(InjectMemory, moduleFileNameUnicode);
    injectMemory.moduleFileNameUnicode.Length = (USHORT)(wcslen(moduleFileName) * sizeof(WCHAR));
    injectMemory.moduleFileNameUnicode.MaximumLength = (USHORT)(MAX_PATH * sizeof(WCHAR));
    injectMemory.moduleFileNameUnicode.Buffer = injectMemoryAddr + offsetof(InjectMemory, moduleFileName);
    if (!WriteProcessMemory64(hProcess, injectMemoryAddr, &injectMemory, sizeof(injectMemory), &dwNumberOfBytesWritten)) goto END_2;
    X64Call(ntdll_RtlCreateUserThread, 10,
        (DWORD64)hProcess,                  // ProcessHandle
        (DWORD64)NULL,                      // SecurityDescriptor
        (DWORD64)FALSE,                     // CreateSuspended
        (DWORD64)0,                         // StackZeroBits
        (DWORD64)NULL,                      // StackReserved
        (DWORD64)NULL,                      // StackCommit
        injectMemoryAddr,                   // StartAddress
        (DWORD64)NULL,                      // StartParameter
        (DWORD64)&hRemoteThread,            // ThreadHandle
        (DWORD64)&client_id);               // ClientID
    if (hRemoteThread == 0) goto END_2;
    CloseHandle((HANDLE)hRemoteThread);
    result = TRUE;
    goto END_1;

END_2:
    VirtualFreeEx64(hProcess, injectMemoryAddr, sizeof(injectMemory), MEM_RELEASE);
END_1:
    CloseHandle(hProcess);
END_0:
    return result;
}

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。