-1

我正在尝试做一些 dll 注入。我想我尽我所能，但不幸的是无法解决问题。我总是得到 ERROR CODE 127，这意味着 ERROR_PROC_NOT_FOUND。我正在使用 Windows 7 64 位。

#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>

using namespace std;

char FileToInject[] = "theDll.dll";
char ProcessName[] = "calc.exe";

typedef HINSTANCE (*fpLoadLibrary)(char*);

bool InjectDLL(DWORD processId);

int main() {
    DWORD processId = NULL;

    PROCESSENTRY32 pre32 = {sizeof(PROCESSENTRY32)};
    HANDLE hProcSnap;
    cout << "BEFORECreateToolhelo32Snapshot:" << GetLastError() <<endl;
    while(!processId) {

            system("CLS");
            cout << "Searching..." << endl;
            hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
            cout << "CreateToolhelo32Snapshot:" << GetLastError() <<endl;

            if(Process32First(hProcSnap, &pre32)) {

                    do {

                        if(!(strcmp(pre32.szExeFile, ProcessName))) {

                           processId = pre32.th32ProcessID;
                           break;

                        }

                    }
                    while(Process32Next(hProcSnap, &pre32));
            }
            Sleep(1000);
    }
    cout << GetLastError() <<endl;
    while(!InjectDLL(processId)) {
        cout << "DLL Injection failed" << endl;
        Sleep(1000);
    }

    cout << "DLL Injected successfully" << endl;
    getchar();
    CloseHandle(hProcSnap);

    return 0;
}

bool InjectDLL(DWORD processId) {

    HANDLE hProc;
    LPVOID paramAddr;
    cout << "START:" << GetLastError() <<endl;
    HINSTANCE hDll = LoadLibrary("KERNEL32");
    cout << "LoadLibrary:" << GetLastError() <<endl;

    fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");
    cout << "LoadLibraryArr:" << GetLastError() <<endl;
    hProc = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
    cout << "OpenProcess:" << GetLastError() <<endl;
    char DllPath[250] = "C:\\Hacks\test.dll";

    paramAddr = VirtualAllocEx(hProc, 0, strlen(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
    cout << "VirtualAlloxEx:" <<GetLastError() <<endl;
    bool MemoryWritten = WriteProcessMemory(hProc, paramAddr, DllPath, strlen(DllPath) + 1, NULL);
    cout << "WriteProcessMemory:" << GetLastError() <<endl;
    CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryAddr, paramAddr, 0, 0);
    cout << "CreateRemoteThread:" <<GetLastError() <<endl;
    CloseHandle(hProc);
    return MemoryWritten;
}

输出如下：

Searching...
CreateToolhelp32Snapshot: 18 ERROR_NO_MORE_FILES
LoadLibrary:18 ERROR_NO_MORE_FILES
LoadLibraryArr:127 ERROR_PROC_NOT_FOUND
OpenProcess:127 ERROR_PROC_NOT_FOUND
VirtualAlloxEx:127 ERROR_PROC_NOT_FOUND
WriteProcessMemory:127 ERROR_PROC_NOT_FOUND
CreateRemoteThread:5 ACCESS DENIED
DLL Injected successfully

该程序发现 calc.exe 是一个没有问题的进程，但之后出现问题。有人可以帮我吗？

谢谢，

塔马斯

4

2 回答 2

2

这是一个问题：

char DllPath[250] = "C:\\Hacks\test.dll";

最后一个反斜杠没有被转义。改成：

char DllPath[250] = "C:\\Hacks\\test.dll";

该函数被调用LoadLibraryA()，而不是LibraryLoadA()：

fpLoadLibrary LoadLibraryAddr =
    (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");

其他一些建议：

  • 只检查GetLastError()之前的 WINAPI 函数是否失败。
  • 仅当先前的 WINAPI 代码（或其他代码）成功时才继续处理。
于 2012-08-27T08:57:23.780 回答
1

在

fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");

你应该解决字符串LoadLibraryA。这

OpenProcess:127 ERROR_PROC_NOT_FOUND
VirtualAlloxEx:127 ERROR_PROC_NOT_FOUND (<-- sic)
WriteProcessMemory:127 ERROR_PROC_NOT_FOUND

错误是由于您正在使用而导致的，GetLastError即使这些功能甚至可能没有失败。因此在调用之前GetLastError，请确保这些函数产生错误返回值（NULL 等）。

于 2012-08-27T08:59:23.253 回答