0

嘿，我试图将 dll 注入到进程中，即 lsass.exe 以获取哈希值。它有点 hacky 但不能帮助我的项目。我有一个 dll 注入代码，但在 Visual C++ 中它会给出错误，例如..

在 TEXT("LoadLibraryA"))))---->>>argument const wchar 与 LPCSTR 不兼容

在 lpFuncAddr------------>>>参数类型“LPVOID”与参数类型“LPTHREAD_START ROUTINE”不兼容

代码：

BOOL InjectDLL(DWORD dwProcessId, LPCSTR lpszDLLPath)
{
   HANDLE  hProcess, hThread;
   LPVOID  lpBaseAddr, lpFuncAddr;
   DWORD   dwMemSize, dwExitCode;
   BOOL    bSuccess = FALSE;
   HMODULE hUserDLL;


   //convert char to wchar
    char *lpszDLLPath = "hash.dll";
          size_t origsize = strlen(orig) + 1;
          const size_t newsize = 100;
          size_t convertedChars = 0;
          wchar_t dllpath[newsize];
          mbstowcs_s(&convertedChars, dllpath, origsize, orig, _TRUNCATE); 

   if((hProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_QUERY_INFORMATION|PROCESS_VM_OPERATION
       |PROCESS_VM_WRITE|PROCESS_VM_READ, FALSE, dwProcessId)))
   {
       dwMemSize = wcslen(dllpath) + 1;
       if((lpBaseAddr = VirtualAllocEx(hProcess, NULL, dwMemSize, MEM_COMMIT, PAGE_READWRITE)))
       {
           if(WriteProcessMemory(hProcess, lpBaseAddr, lpszDLLPath, dwMemSize, NULL))
           {
               if((hUserDLL = LoadLibrary(TEXT("kernel32.dll"))))
               {
                   if((lpFuncAddr = GetProcAddress(hUserDLL, TEXT("LoadLibraryA"))))
                   {
                       if((hThread = CreateRemoteThread(hProcess, NULL, 0, lpFuncAddr, lpBaseAddr, 0, NULL)))
                       {
                           WaitForSingleObject(hThread, INFINITE);
                           if(GetExitCodeThread(hThread, &dwExitCode)) {
                               bSuccess = (dwExitCode != 0) ? TRUE : FALSE;
                            }
                           CloseHandle(hThread);
                       }
                   }
                   FreeLibrary(hUserDLL);
                }
            }
           VirtualFreeEx(hProcess, lpBaseAddr, 0, MEM_RELEASE);
       }
       CloseHandle(hProcess);
   }
   return bSuccess;
}

int WINAPI WinMain(HINSTANCE hThisInstance, HINSTANCE hPrevInstance, LPSTR lpszCmdLine, int nCmdShow)
{
    if(InjectDLL(PROCESSID, "hash.dll")) {
        MessageBox(NULL, TEXT("DLL Injected!"), TEXT("DLL Injector"), MB_OK);
    }else {
        MessageBox(NULL, TEXT("Couldn't inject DLL"), TEXT("DLL Injector"), MB_OK | MB_ICONERROR);
    }

    return 0;
}

我是 dll 和 Windows 编程的初学者，因此将感谢您的帮助。

4

1 回答 1

2

看起来您的函数需要 LPCSTR 而不是 LPCTSTR。丢失 TEXT() 宏，应该没问题。

对于第二个错误，您应该能够使用简单的静态转换将 lpFuncAddr 转换为 LPTHREAD_START_ROUTINE。

 if((hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpFuncAddr, lpBaseAddr, 0, NULL)))
于 2011-01-10T16:18:07.633 回答