我有一个简单的 DLL,我将它注入到记事本中,仅用于测试目的。我的注射器代码是这样的:
uses
Windows;
var
BytesWritten: cardinal;
PID, Process, Thread, ThreadId, hKernel: dword;
pLoadLibrary, Paramaters: pointer;
DLL: AnsiString;
begin
DLL := 'C:\test.dll'; // Must be full path name.
PID := 3160;
Process := OpenProcess(PROCESS_ALL_ACCESS,
False,
PID);
Paramaters := VirtualAllocEx(Process,
nil,
Length(DLL),
MEM_COMMIT,
PAGE_EXECUTE_READWRITE);
WriteProcessMemory(Process,
Paramaters,
PAnsiChar(DLL),
Length(DLL),
BytesWritten);
hKernel := GetModuleHandle('KERNEL32.DLL');
pLoadLibrary := GetProcAddress(hKernel,
'LoadLibraryA');
Thread := CreateRemoteThread(Process,
nil,
0,
pLoadLibrary,
Paramaters,
0,
ThreadId);
WaitForSingleObject(Thread, INFINITE);
VirtualFreeEx(Process,
Paramaters,
0,
MEM_RELEASE);
CloseHandle(Thread);
CloseHandle(Process);
end.
我的 DLL 代码很简单,如下所示:
uses
SysUtils,
Classes,
Windows;
{$R *.res}
procedure EntryPoint(Reason: dword); stdcall;
begin
if Reason = DLL_PROCESS_ATTACH then
begin
MessageBox(0, 'DLL Injected', 'DLL Injected', 0);
end;
end;
begin
DLLProc:= @EntryPoint;
EntryPoint(DLL_PROCESS_ATTACH);
end.
当我在记事本进程中注入 dll 时,我得到 MessageBox 说 DLL Injected,但几秒钟后它崩溃说: 00FFE102 模块 test.dll 中的异常 EAccessViolation。地址 00FFF102 的访问冲突。写入地址 00FFF102。 我使用的是 Delphi 2010,Windows 7 x64,管理员权限,没有 UAC,记事本和 dll 都是 x32...