1

我正在尝试将 dll 注入现有进程。我正在尝试使用 CreateRemoteThread LoadLibrary 方式。我理解它是如何工作的，但我无法弄清楚为什么 CreateRemoteThread 返回 null（失败）......我在 Windows 7 上，所以这可能是原因，但我不确定是否是......也许我需要设置权限？我的代码如下：

#define DLL_NAME "message.dll"

void main()
{
    InjectDLL(1288, DLL_NAME);
}

BOOL InjectDLL(DWORD dwProcessId, LPCSTR lpszDLLPath)
{

    HANDLE  hProcess, hThread;
    LPVOID  lpBaseAddr, lpFuncAddr;
    DWORD   dwMemSize, dwExitCode;
    BOOL    bSuccess = FALSE;
    HMODULE hUserDLL;

    if((hProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_QUERY_INFORMATION|PROCESS_VM_OPERATION
        |PROCESS_VM_WRITE|PROCESS_VM_READ, FALSE, dwProcessId)))
    {
        dwMemSize = lstrlen(lpszDLLPath) + 1;
        if(lpBaseAddr = VirtualAllocEx(hProcess, NULL, dwMemSize, MEM_COMMIT, PAGE_READWRITE))
        {
            if(WriteProcessMemory(hProcess, lpBaseAddr, lpszDLLPath, dwMemSize, NULL))
            {
                if(hUserDLL = LoadLibrary(TEXT("kernel32.dll")))
                {
                    if(lpFuncAddr = GetProcAddress(hUserDLL, TEXT("LoadLibraryA")))
                    {
                        if(hThread = CreateRemoteThread(hProcess, NULL, 0, lpFuncAddr, lpBaseAddr, 0, NULL))
                        {
                            WaitForSingleObject(hThread, INFINITE);
                            if(GetExitCodeThread(hThread, &dwExitCode)) {
                                bSuccess = (dwExitCode != 0) ? TRUE : FALSE;
                            }
                            CloseHandle(hThread);
                        }
                    }
                    FreeLibrary(hUserDLL);
                }
            }
            VirtualFreeEx(hProcess, lpBaseAddr, 0, MEM_RELEASE);
        }
        CloseHandle(hProcess);
    }

    return bSuccess;
}
4

1 回答 1

1

是的，您在打开进程之前需要特权，这是代码：


 int GimmePrivileges(){ 
HANDLE Token;  
TOKEN_PRIVILEGES tp;      
if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &Token)    
{ 
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);     
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL);    
}      
}

另一件事......这段代码令人困惑！你需要合成！

于 2011-06-15T16:54:51.577 回答