利用NtCreateThreadEx注入
#include "x64Inject.h" HANDLE WINAPI ThreadProc(PTHREAD_DATA data) { data->fnRtlInitUnicodeString(&data->UnicodeString,data->DllName); data->fnLdrLoadDll(data->DllPath,data->Flags,&data->UnicodeString,&data->ModuleHandle); return data->ModuleHandle; } DWORD WINAPI ThreadProcEnd() { MyOutputDebugStringA("ThreadProcEnd"); return 0; } Cx64Inject::Cx64Inject(void) { } Cx64Inject::~Cx64Inject(void) { } //操作系统版本判断 BOOL Cx64Inject::IsVistaOrLater() { OSVERSIONINFO osvi; ZeroMemory(&osvi, sizeof(OSVERSIONINFO)); osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); GetVersionEx(&osvi); if( osvi.dwMajorVersion >= 6 ) return TRUE; return FALSE; } BOOL Cx64Inject::EnableDebugPrivilege() { HANDLE hToken; TOKEN_PRIVILEGES tkp; if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) return( FALSE ); LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid); tkp.PrivilegeCount = 1; tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0); if (GetLastError() != ERROR_SUCCESS) return FALSE; return TRUE; } //OD跟踪,发现最后调用的是NtCreateThreadEx,所以这里手动调用 HANDLE Cx64Inject::MyCreateRemoteThread(HANDLE hProcess, LPTHREAD_START_ROUTINE pThreadProc, LPVOID pRemoteBuf) { HANDLE hThread = NULL; FARPROC pFunc = NULL; if( IsVistaOrLater())// Vista, 7, Server2008 { pFunc = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtCreateThreadEx"); if( pFunc == NULL ) { MyOutputDebugStringA("MyCreateRemoteThread() : GetProcAddress(\"NtCreateThreadEx\") 调用失败!错误代码: [%d]", GetLastError()); return NULL; } ((_NtCreateThreadEx64)pFunc)(&hThread,0x1FFFFF,NULL,hProcess,pThreadProc,pRemoteBuf,FALSE,NULL,NULL,NULL,NULL); if( hThread == NULL ) { MyOutputDebugStringA("MyCreateRemoteThread() : NtCreateThreadEx() 调用失败!错误代码: [%d]", GetLastError()); return NULL; } } else// 2000, XP, Server2003 { hThread = CreateRemoteThread(hProcess,NULL,0,pThreadProc,pRemoteBuf,0,NULL); if( hThread == NULL ) { MyOutputDebugStringA("MyCreateRemoteThread() : CreateRemoteThread() 调用失败!错误代码: [%d]", GetLastError()); return NULL; } } if( WAIT_FAILED == WaitForSingleObject(hThread, INFINITE) ) { MyOutputDebugStringA("MyCreateRemoteThread() : WaitForSingleObject() 调用失败!错误代码: [%d]", GetLastError()); return NULL; } return hThread; } //在目标进程中创建线程并注入dll BOOL Cx64Inject::InjectDll(DWORD dwProcessId,LPCWSTR lpcwDllPath) { dwProcessId = 648; lpcwDllPath = L"C:\\MessageBox64.dll"; BOOL bRet = FALSE; HANDLE hProcess = NULL, hThread = NULL; LPVOID pCode = NULL; LPVOID pThreadData = NULL; __try { if(!EnableDebugPrivilege()) { MyOutputDebugStringA("InjectDll() : EnableDebugPrivilege() 调用失败!错误代码: [%d]", GetLastError()); return -1; } //打开目标进程; hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE, dwProcessId); DWORD dwError = GetLastError(); if (hProcess == NULL) __leave; //申请空间,把我们的代码和数据写入目标进程空间里; //写入数据; THREAD_DATA data; HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll"); data.fnRtlInitUnicodeString = (pRtlInitUnicodeString)GetProcAddress(hNtdll,"RtlInitUnicodeString"); data.fnLdrLoadDll = (pLdrLoadDll)GetProcAddress(hNtdll,"LdrLoadDll"); memcpy(data.DllName, lpcwDllPath, (wcslen(lpcwDllPath) + 1)*sizeof(WCHAR)); data.DllPath = NULL; data.Flags = 0; data.ModuleHandle = INVALID_HANDLE_VALUE; pThreadData = VirtualAllocEx(hProcess, NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); if (pThreadData == NULL) __leave; BOOL bWriteOK = WriteProcessMemory(hProcess, pThreadData,&data,sizeof(data), NULL); if (!bWriteOK) __leave; MyOutputDebugStringA("pThreadData = 0x%p", pThreadData); //写入代码; DWORD SizeOfCode = (DWORD)ThreadProcEnd - (DWORD)ThreadProc; pCode = VirtualAllocEx(hProcess, NULL, SizeOfCode, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); if (pCode == NULL) { MyOutputDebugStringA("InjectDll() : pCode = VirtualAllocEx() 调用失败!错误代码: [%d]", GetLastError()); __leave; } bWriteOK = WriteProcessMemory(hProcess, pCode, (PVOID)ThreadProc, SizeOfCode, NULL); if (!bWriteOK) __leave; MyOutputDebugStringA("pCode = 0x%p", pCode); //创建远程线程,把ThreadProc作为线程起始函数,pThreadData作为参数; hThread = MyCreateRemoteThread(hProcess, (LPTHREAD_START_ROUTINE)pCode, pThreadData); if (hThread == NULL) __leave; //等待完成; WaitForSingleObject(hThread, INFINITE); bRet = TRUE; } __finally { if (pThreadData != NULL) VirtualFreeEx(hProcess, pThreadData, 0, MEM_RELEASE); if (pCode != NULL) VirtualFreeEx(hProcess, pCode, 0, MEM_RELEASE); if (hThread != NULL) CloseHandle(hThread); if (hProcess != NULL) CloseHandle(hProcess); } return bRet; } #pragma once #include <windows.h> #include "MyOutputDebugString.h" //Native DLL L"C:\\Windows\\System32\\sfc.dll"; typedef struct _LSA_UNICODE_STRING{ USHORT Length; USHORT MaximumLength; PWSTR Buffer; } LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING; typedef NTSTATUS (NTAPI *pRtlInitUnicodeString)(PUNICODE_STRING,PCWSTR); typedef NTSTATUS (NTAPI *pLdrLoadDll)(PWCHAR,ULONG,PUNICODE_STRING,PHANDLE); typedef struct _THREAD_DATA { pRtlInitUnicodeString fnRtlInitUnicodeString; pLdrLoadDll fnLdrLoadDll; UNICODE_STRING UnicodeString; WCHAR DllName[260]; PWCHAR DllPath; ULONG Flags; HANDLE ModuleHandle; }THREAD_DATA,*PTHREAD_DATA; typedef VOID (WINAPI *fRtlInitUnicodeString)(PUNICODE_STRING DestinationString,PCWSTR ourceString); typedef NTSTATUS (WINAPI *fLdrLoadDll)(IN PWCHAR PathToFile OPTIONAL, IN ULONG Flags OPTIONAL, IN PUNICODE_STRING ModuleFileName, OUT PHANDLE ModuleHandle); typedef DWORD64 (WINAPI *_NtCreateThreadEx64)(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, LPVOID ObjectAttributes, HANDLE ProcessHandle, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, BOOL CreateSuspended, DWORD64 dwStackSize, DWORD64 dw1, DWORD64 dw2, LPVOID Unknown); class Cx64Inject { public: Cx64Inject(void); ~Cx64Inject(void); BOOL InjectDll(DWORD dwProcessId,LPCWSTR lpcwDllPath); private: BOOL EnableDebugPrivilege(); BOOL IsVistaOrLater(); HANDLE MyCreateRemoteThread(HANDLE hProcess, LPTHREAD_START_ROUTINE pThreadProc, LPVOID pRemoteBuf); }; //MyOutputDebugString.h #pragma once #define MYPRINT //MyOutputDebugString(_T("%d,%s"),123,_T("hello")); #ifdef _UNICODE #define MyOutputDebugString MyOutputDebugStringW #else #define MyOutputDebugString MyOutputDebugStringA #endif //MyOutputDebugStringA("%d,%s",123,"hello"); void MyOutputDebugStringA(const char * szOutputString,...); //MyOutputDebugStringW(L"%d,%s",456,L"world!"); void MyOutputDebugStringW(const wchar_t * szOutputString,...); //MyOutputDebugString.cpp #include "stdafx.h" #include <Windows.h> #include <stdlib.h> #include <stdio.h> #include <stdarg.h> #pragma warning(disable:4996) #define MYPRINT //MyOutputDebugStringA("%d,%s",123,"hello"); void MyOutputDebugStringA(const char * szOutputString,...) { #ifdef MYPRINT char szBuffer[4096]={0}; va_list vlArgs; va_start(vlArgs,szOutputString); _vsnprintf(szBuffer,sizeof(szBuffer)-1,szOutputString,vlArgs); //vsprintf(szBuffer,szOutputString,vlArgs); va_end(vlArgs); char szPrint[4096 + 100]={0}; char *szFilter = "[sunflover] "; strcpy(szPrint,szFilter); strcat(szPrint,szBuffer); OutputDebugStringA(szPrint); #endif } //MyOutputDebugStringW(L"%d,%s",456,L"world!"); void MyOutputDebugStringW(const wchar_t * szOutputString,...) { #ifdef MYPRINT wchar_t szBuffer[4096]={0}; va_list vlArgs; va_start(vlArgs,szOutputString); _vsnwprintf(szBuffer,sizeof(szBuffer)-2,szOutputString,vlArgs); //vswprintf(szBuffer,szOutputString,vlArgs); va_end(vlArgs); wchar_t szPrint[4096 + 100]={0}; wchar_t *szFilter = L"[sunflover] "; wcscpy(szPrint,szFilter); wcscat(szPrint,szBuffer); OutputDebugStringW(szPrint); #endif }
爱程序 不爱bug
爱生活 不爱黑眼圈
我和你们一样 我和你们不一样
我不是凡客 我要做geek