内存加载SkinH.dll，不释放文件

最新推荐文章于 2024-08-08 16:18:58 发布

oceanark

最新推荐文章于 2024-08-08 16:18:58 发布

阅读量724

点赞数

文章标签： C++

美化程序经常要加皮肤，而各种皮肤控件（.dll）总是赤裸裸的强奸我们的视觉神经，非常的让人厌恶。

百度了下，发现牛人已经给出代码：

//---------------------------------------------------------------------------------------------------------------------------------------------

//DllFromMem.cpp

// DllFromMem.cpp: implementation of the CDllFromMem class.
//
//

#include "stdafx.h"
#include "DllFromMem.h"

//
// Construction/Destruction
//

CDllFromMem::CDllFromMem()
{
m_hBaseAddress=NULL;
m_hInstance=NULL;
m_ntHead=NULL;
}

CDllFromMem::~CDllFromMem()
{

if (m_hBaseAddress)
{

  m_dllMain(m_hInstance,DLL_PROCESS_DETACH,NULL);
  VirtualFree(m_hBaseAddress,0,MEM_RELEASE);
}

}
HANDLE CDllFromMem::LoadLibraryFromRs(HINSTANCE hInstance,LPCTSTR lpType,LPCTSTR lpName)
{
m_hInstance=hInstance;
HRSRC hrec=FindResource(NULL,lpName,lpType);
HRSRC hResLoad=(HRSRC)LoadResource(NULL,hrec);
unsigned char *LockRes=(unsigned char *)LockResource(hResLoad);
IMAGE_DOS_HEADER *dosHead;
dosHead=(IMAGE_DOS_HEADER*)LockRes;
m_ntHead=(IMAGE_NT_HEADERS *)(dosHead->e_lfanew+(int)dosHead);
if(dosHead->e_magic!=0x5a4d&&m_ntHead->Signature!=0x4550)
{
MessageBox(NULL,"指定的资源不是有效的DLL文件!","装入动态链接库出错",MB_OK|MB_ICONERROR);
return NULL;
}

int SizeOfImage=m_ntHead->OptionalHeader.SizeOfImage;
m_hBaseAddress=VirtualAlloc((LPVOID)(m_ntHead->OptionalHeader.ImageBase),SizeOfImage,/*MEM_COMMIT*/MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if (!m_hBaseAddress)
{
  m_hBaseAddress=VirtualAlloc(NULL,SizeOfImage,MEM_RESERVE,PAGE_EXECUTE_READWRITE);
}
VirtualAlloc(m_hBaseAddress,SizeOfImage,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

int SizeOfHeaders=m_ntHead->OptionalHeader.SizeOfHeaders;
int FileAlignment=m_ntHead->OptionalHeader.FileAlignment;
memcpy(m_hBaseAddress,LockRes,SizeOfHeaders);
IMAGE_SECTION_HEADER *sectionHead=(IMAGE_SECTION_HEADER *)(sizeof(IMAGE_NT_HEADERS)+(int)m_ntHead);
int NumberOfSections=m_ntHead->FileHeader.NumberOfSections;
LPVOID desc,src;
int iSize;
for (int i=0;i<NumberOfSections;i++) //拷贝区段
{
  src=LockRes+sectionHead[i].PointerToRawData;
  if(sectionHead[i].SizeOfRawData==0) continue;
  desc=(LPVOID)((DWORD)m_hBaseAddress+sectionHead[i].VirtualAddress);
  if (i<NumberOfSections-1)
   iSize=sectionHead[i+1].PointerToRawData-sectionHead[i].PointerToRawData;
  else
   iSize=sectionHead[i].SizeOfRawData;
  memcpy(desc,src,iSize);
}
//以下是重定位

DWORD *tmp;
if (m_ntHead->OptionalHeader.DataDirectory[5].VirtualAddress) //如果没有重定位表表示不用重定位，跳过重定位代码
{
  DWORD relocation=(DWORD)m_hBaseAddress-m_ntHead->OptionalHeader.ImageBase;
  IMAGE_BASE_RELOCATION *relocationAddress=(IMAGE_BASE_RELOCATION*)(m_ntHead->OptionalHeader.DataDirectory[5].VirtualAddress+(DWORD)m_hBaseAddress);

  while (relocationAddress->VirtualAddress!=0)
  {
   LPVOID rva=(LPVOID)((DWORD)m_hBaseAddress+relocationAddress->VirtualAddress);
   DWORD BlockNum=(relocationAddress->SizeOfBlock-8)/2;
   if (BlockNum==0) break;
   WORD *Offset=(WORD *)((DWORD)relocationAddress+8);
   for (int i=0;i<(int)BlockNum;i++)
   {
    if((Offset[i]&0xF000)!=0x3000) continue;
    tmp=(DWORD*)((Offset[i]&0xFFF)+(DWORD)rva);
    *tmp=(*tmp)+relocation;
   }
   relocationAddress=(IMAGE_BASE_RELOCATION*)((DWORD)relocationAddress+relocationAddress->SizeOfBlock);

  }

}
//重定位结束

//以下是重建IAT

char MsgError[256]={0};
if (m_ntHead->OptionalHeader.DataDirectory[1].VirtualAddress) //如果没用导入表则跳过
{
  HMODULE lib;
  IMAGE_THUNK_DATA *IAT,*INTable;
  IMAGE_IMPORT_BY_NAME *IatByName;
  IMAGE_IMPORT_DESCRIPTOR *importAdd=(IMAGE_IMPORT_DESCRIPTOR *)((DWORD)m_hBaseAddress+m_ntHead->OptionalHeader.DataDirectory[1].VirtualAddress);

  while(importAdd->Name)//(importAdd->FirstThunk)
  {
   lib=LoadLibrary((char *)(importAdd->Name+(DWORD)m_hBaseAddress));
   if (lib==NULL) //装载库出错
   {
    wsprintf(MsgError,"装入动态链接库%s出错!",(char *)(importAdd->Name+(DWORD)m_hBaseAddress));
    MessageBox(NULL,MsgError,"错误",MB_OK|MB_ICONERROR);
    return NULL;
   }
   IAT=(IMAGE_THUNK_DATA *)(importAdd->FirstThunk+(DWORD)m_hBaseAddress);
   INTable=(IMAGE_THUNK_DATA *)((importAdd->OriginalFirstThunk?importAdd->OriginalFirstThunk:importAdd->FirstThunk)+(DWORD)m_hBaseAddress);
   while (INTable->u1.AddressOfData)
   {
    if (((DWORD)INTable->u1.Function&0x800000)==0)
    {
     IatByName=(IMAGE_IMPORT_BY_NAME *)((DWORD)INTable->u1.AddressOfData+(DWORD)m_hBaseAddress);
     IAT->u1.Function=(DWORD)GetProcAddress(lib,(char *)(IatByName->Name));
    }
    else
    {
     IAT->u1.Function=(DWORD)GetProcAddress(lib,(LPCSTR)(INTable->u1.Ordinal^0x7FFFFF));

    }
    INTable++;
    IAT++;
   }
   importAdd++;
  }
}
//重建IAT结束
//调用dll的入口函数
m_dllMain=(myDllMain)(m_ntHead->OptionalHeader.AddressOfEntryPoint+(DWORD)m_hBaseAddress);
m_dllMain(m_hInstance,DLL_PROCESS_ATTACH,NULL);
PatchData();//给dll打补丁，如果不需要打补丁，这行可以注释掉;
return m_hBaseAddress;
}
FARPROC CDllFromMem::GetProcAddressFromRs(LPCSTR lpProcName)
{
IMAGE_EXPORT_DIRECTORY *ExportTable=(IMAGE_EXPORT_DIRECTORY *)(m_ntHead->OptionalHeader.DataDirectory[0].VirtualAddress+(DWORD)m_hBaseAddress);
DWORD *ExportNameAddress=(DWORD*)(ExportTable->AddressOfNames+(DWORD)m_hBaseAddress);
WORD *AddressOfNameOrdinals=(WORD*)(ExportTable->AddressOfNameOrdinals+(DWORD)m_hBaseAddress);
DWORD *AddressOfFunction=(DWORD*)(ExportTable->AddressOfFunctions+(DWORD)m_hBaseAddress);
char *ExportName;

int j=0;//要判断是否是以序号查找的
int i=ExportTable->NumberOfNames;
if((DWORD)lpProcName>0xFFFF) //以名字查找
{
  for (j=0;j<i;j++)
  {
   ExportName=(char *)((DWORD)*ExportNameAddress+(DWORD)m_hBaseAddress);
   if (!strcmpi(lpProcName,ExportName))
    return (FARPROC)(AddressOfFunction[AddressOfNameOrdinals[j]]+(DWORD)m_hBaseAddress);
   ExportNameAddress++;
  }
  return NULL;
}
else //以序号查找;
{
  j=(DWORD)lpProcName-ExportTable->Base;
  if (j>=ExportTable->NumberOfFunctions) return NULL;
  return (FARPROC)(AddressOfFunction[j]+(DWORD)m_hBaseAddress);
}
return NULL;
}

void CDllFromMem::PatchData()
{
DWORD PatchContent[][2]={0x0002CA94,0x0};//rva,patchdata;
int i=sizeof(PatchContent)/(sizeof(DWORD)*2);
for (int j=0;j<i;j++)
{
*(char*)((char*)m_hBaseAddress+PatchContent[j][0])=(char)PatchContent[j][1];
}
}

//---------------------------------------------------------------------------------------------------------------------------------------------

//DllFromMem.h

// DllFromMem.h: interface for the CDllFromMem class.
//
//

#if !defined(AFX_DLLFROMMEM_H__233D9B97_BA88_48C7_AC00_03525B40C7F1__INCLUDED_)
#define AFX_DLLFROMMEM_H__233D9B97_BA88_48C7_AC00_03525B40C7F1__INCLUDED_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

typedef BOOL (WINAPI *myDllMain)(
         HINSTANCE hinstDLL, // handle to the DLL module
         DWORD fdwReason,     // reason for calling function
         LPVOID lpvReserved   // reserved
);

class CDllFromMem
{
public:
CDllFromMem();
virtual ~CDllFromMem();
HANDLE LoadLibraryFromRs(HINSTANCE hInstance,LPCTSTR lpType,LPCTSTR lpName);
FARPROC GetProcAddressFromRs(LPCSTR lpProcName);
void PatchData();
private:
HANDLE m_hBaseAddress;
HINSTANCE m_hInstance;
IMAGE_NT_HEADERS *m_ntHead;
myDllMain m_dllMain;

};

#endif // !defined(AFX_DLLFROMMEM_H__233D9B97_BA88_48C7_AC00_03525B40C7F1__INCLUDED_)

//---------------------------------------------------------------------------------------------------------------------------------------------

代码已经比较完整，只要稍微改动就可以使用