注入方法之介绍
事实上dll注入很简单,无非就是调用virtualAllocEx,WriteProcessMemory,OpenProcess,CreateRemoteThread等API函数,因为我是学c#的,所以也想看一下c# dll注入这方面的文章,但在网上找了半天,没有找到一篇,也许是c#刚兴起的缘故,学c#的并不多,没办法,只好自己移植一下,因为凡是用到API函数,所有的编程的语言都是相同的,这就为我们的移植带来了方便,学c#的一般应该对API的调用概念很淡,因为c#通常不会去调用API函数,因为这些已经被封装了,在vb,vc++等语言中要结束一个进程,首先就必须要得到这个进程的句柄,然后才能进行相应的关闭进程等操作,得到句柄要用到OpenProcess API函数,结束进程要用到TerminateProcess API函数,但是在c#中你根本不需要知道这些API函数就能完成同样的功能,所以你要是想了解一下API的相关知识,学一点vb是一个很好的选择。好了!下面就开始我们的c# dll注入之旅吧!
首先需要加入以下API函数:
- [DllImport("kernel32.dll")]
- public
static extern int VirtualAllocEx(IntPtr inthwnd, lpaddress, intsize, inttype, inttect); - [DllImport("kernel32.dll")]
- public
static extern int WriteProcessMemory(IntPtr inthwnd, baseaddress, stringbuffer, intnsize, intfilewriten ); - [DllImport("kernel32.dll")]
- public
static extern int GetProcAddress( inthwnd, stringlpname); - [DllImport("kernel32.dll")]
- public
static extern int GetModuleHandleA( stringname); - [DllImport("kernel32.dll")]
- public
static extern int CreateRemoteThread(IntPtr inthwnd, attrib, intsize, intaddress, intpar, intflags, intthreadid); -
C#声明API比较复杂,因为是调用非托管的dll,所以要用到DllImport来调用非托管的dll,他还有很多属性在这就不多说了,网上有很介绍,可以去查一下,不过c#调用自身的变得动态链接库是倒是很方便,直接加个引用就ok了,调用dll要用的一个引用:using System.Runtime.InteropServices;这个不要忘了加上,下面是编好的所有代码:
- using
System; - using
System.Collections.Generic; - using
System.ComponentModel; - using
System.Data; - using
System.Drawing; - using
System.Text; - using
System.Windows.Forms; - using
System.Runtime.InteropServices; - using
System.Diagnostics; - namespace
dllinject - {
- public
partial classForm1 : Form - {
- [DllImport("kernel32.dll")]
//声明API函数 - public
static extern int VirtualAllocEx(IntPtr inthwnd, lpaddress, intsize, inttype, inttect); - [DllImport("kernel32.dll")]
- public
static extern int WriteProcessMemory(IntPtr inthwnd, baseaddress, stringbuffer, intnsize, intfilewriten ); - [DllImport("kernel32.dll")]
- public
static extern int GetProcAddress( inthwnd, stringlpname); - [DllImport("kernel32.dll")]
- public
static extern int GetModuleHandleA( stringname); - [DllImport("kernel32.dll")]
- public
static extern int CreateRemoteThread(IntPtr inthwnd, attrib, intsize, intaddress, intpar, intflags, intthreadid); - public
Form1() - {
- InitializeComponent();
- }
-
- private
void button1_Click( objectsender, EventArgs e) - {
- int
ok1; - //int
ok2; - //int
hwnd; - int
baseaddress; - int
temp=0; - int
hack; - int
yan; - string
dllname; - dllname
= "c:\\dll.dll"; - int
dlllength; - dlllength
= dllname.Length + 1; - Process[]
pname //取得所有进程= Process.GetProcesses(); - foreach
(Process inname pname) //遍历进程 - {
- //MessageBox.Show(name.ProcessName.ToLower());
- if
(name.ProcessName.ToLower().IndexOf( "notepad")!= //所示记事本,那么下面开始注入-1) - {
-
- baseaddress
= //申请内存空间VirtualAllocEx(name.Handle, 0, dlllength , 4096, 4); - if
(baseaddress //返回0则操作失败,下面都是== 0) - {
- MessageBox.Show("申请内存空间失败!!");
- Application.Exit();
- }
- ok1
= //写内存WriteProcessMemory(name.Handle, baseaddress, dllname, dlllength, temp); - if
(ok1 == 0) - {
-
- MessageBox.Show("写内存失败!!");
- Application.Exit();
- }
- hack
= "Kernel32"),GetProcAddress(GetModuleHandleA( "LoadLibraryA"); //取得loadlibarary在kernek32.dll地址 - if
(hack == 0) - {
- MessageBox.Show("无法取得函数的入口点!!");
- Application.Exit();
- }
- yan
= //创建远程线程。CreateRemoteThread(name.Handle, 0, 0, hack, baseaddress, 0, temp); - if
(yan == 0) - {
- MessageBox.Show("创建远程线程失败!!");
- Application.Exit();
- }
- else
- {
- MessageBox.Show("已成功注入dll!!");
- }
-
- }
-
- }
-
- }
- }
至此,我们的C# DLL注入之旅就圆满结束了。