所以我正在研究网络安全,我们遇到的一个主题是 DLL 注入。因此,作为一个小实验,我花时间在我拥有的游戏中创建自己的 DLL 注入。
所以语法明智的一切运行顺利,以及编译器,我正在做正如文档所说的 createRemoteThread,连接到 DLLMAIN api,我什至添加了一个消息框来提醒我 DLL 附件成功,但没有。这是我的源代码
#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
switch (ul_reason_for_call) {
case DLL_PROCESS_ATTACH:
MessageBoxA(NULL, "Successfully connected to DLL!", "DLL Injector", MB_OK);
break;
case DLL_THREAD_ATTACH:
MessageBoxA(NULL, "it worked", "k", MB_OK);
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
int getProcId(const char* target){
DWORD pID = 0;
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
wchar_t wideTarget[MAX_PATH];
MultiByteToWideChar(CP_UTF8, 0, target, -1, wideTarget, MAX_PATH);
do {
wchar_t wideExeFile[MAX_PATH];
MultiByteToWideChar(CP_UTF8, 0, pe32.szExeFile, -1, wideExeFile, MAX_PATH);
if (wcscmp(wideExeFile, wideTarget) == 0) {
CloseHandle(hSnapshot);
pID = pe32.th32ProcessID;
break;
}
} while (Process32Next(hSnapshot, &pe32));
CloseHandle(hSnapshot);
return pID;
}
int injectDLL(int pID, const char* dllPath) {
HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, pID);
if (hProcess == NULL) {
return 1;
}
LPVOID pRemotePath = VirtualAllocEx(hProcess, NULL, strlen(dllPath) + 1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if (pRemotePath == NULL) {
CloseHandle(hProcess);
return 2;
}
if (!WriteProcessMemory(hProcess, pRemotePath, dllPath, strlen(dllPath) + 1, NULL)) {
VirtualFreeEx(hProcess, pRemotePath, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 3;
}
HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
FARPROC pLoadLibraryA = GetProcAddress(hKernel32, "LoadLibraryA");
HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pLoadLibraryA, pRemotePath, 0, NULL);
if (hRemoteThread == NULL) {
VirtualFreeEx(hProcess, pRemotePath, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 4;
}
WaitForSingleObject(hRemoteThread, INFINITE);
VirtualFreeEx(hProcess, pRemotePath, 0, MEM_RELEASE);
CloseHandle(hRemoteThread);
CloseHandle(hProcess);
return 0;
}
int main(int argc, char* argv[]) {
const char* process = "Left 4 dead 2 - Direct3D 9";
const char* dllPath = "Engine.dll";
int pID = getProcId(process);
if (pID == 0) {
// Process not found
return 1;
}
int result = injectDLL(pID, dllPath);
if (result == 0) {
printf("success");// Injection succeeded
} else {
printf("not successful"); // Injection failed
}
return 0;
}