C++向目标进程PEB模块链添加自己的DLL

有时候为了让内存注入的DLL现身, 就需要用到这个方法了
	auto lppeb = reinterpret_cast<PPEB>(AppBase::GetPEBAddress());
	if (NtGetModule(_T("QQManager.dll")) == NULL)
	{
		String StartupPath = String(BaseDllDir) + _T("QQManager.dll");
		BaseDllPEB.DllBase = BaseDllPEB.EntryPoint = pimage;
		RtlInitUnicodeString(&BaseDllPEB.FullDllName, StartupPath);
		RtlInitUnicodeString(&BaseDllPEB.BaseDllName, StartupPath);
		BaseDllPEB.InInitializationOrderLinks.Blink = &lppeb->Ldr->InInitializationOrderModuleList;
		BaseDllPEB.InMemoryOrderLinks.Blink = &lppeb->Ldr->InMemoryOrderModuleList;
		InsertTailList(<span style="font-family: Arial, Helvetica, sans-serif;">lppeb</span>->Ldr->InLoadOrderModuleList.Blink, &BaseDllPEB.InMemoryOrderLinks);
	} //if


  • 0
    点赞
  • 2
    收藏
    觉得还不错? 一键收藏
  • 10
    评论
PEB(Process Environment Block)是Windows操作系统中的一个重要结构体,它包含了当前进程的环境信息。通过PEB,我们可以获取当前进程模块信息,包括模块的基地址、模块的名称等。 在x64和wow64下,PEB结构体的定义并没有变化,但是由于x64和wow64的指针长度不同,所以在使用PEB时需要注意指针长度的问题。 以下是通过PEB遍历进程模块的代码示例: ```c++ #include <windows.h> #include <winternl.h> #include <iostream> typedef struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } UNICODE_STRING, *PUNICODE_STRING; typedef struct _PEB_LDR_DATA { ULONG Length; BOOLEAN Initialized; PVOID SsHandle; LIST_ENTRY InLoadOrderModuleList; LIST_ENTRY InMemoryOrderModuleList; LIST_ENTRY InInitializationOrderModuleList; } PEB_LDR_DATA, *PPEB_LDR_DATA; typedef struct _LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; LIST_ENTRY InMemoryOrderLinks; LIST_ENTRY InInitializationOrderLinks; PVOID DllBase; PVOID EntryPoint; ULONG SizeOfImage; UNICODE_STRING FullDllName; UNICODE_STRING BaseDllName; ULONG Flags; USHORT LoadCount; USHORT TlsIndex; union { LIST_ENTRY HashLinks; struct { PVOID SectionPointer; ULONG CheckSum; }; }; union { ULONG TimeDateStamp; PVOID LoadedImports; }; PVOID EntryPointActivationContext; PVOID PatchInformation; LIST_ENTRY ForwarderLinks; LIST_ENTRY ServiceTagLinks; LIST_ENTRY StaticLinks; } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; typedef struct _PEB { BOOLEAN InheritedAddressSpace; BOOLEAN ReadImageFileExecOptions; BOOLEAN BeingDebugged; BOOLEAN Spare; HANDLE Mutant; PVOID ImageBaseAddress; PPEB_LDR_DATA LoaderData; PVOID ProcessParameters; PVOID SubSystemData; PVOID ProcessHeap; PVOID FastPebLock; PVOID AtlThunkSListPtr; PVOID IFEOKey; PVOID CrossProcessFlags; PVOID UserSharedInfoPtr; ULONG SystemReserved; ULONG AtlThunkSListPtr32; PVOID ApiSetMap; ULONG TlsExpansionCounter; PVOID TlsBitmap; ULONG TlsBitmapBits[2]; PVOID ReadOnlySharedMemoryBase; PVOID HotpatchInformation; PVOID ReadOnlyStaticServerData; PVOID AnsiCodePageData; PVOID OemCodePageData; PVOID UnicodeCaseTableData; ULONG NumberOfProcessors; ULONG NtGlobalFlag; LARGE_INTEGER CriticalSectionTimeout; ULONG_PTR HeapSegmentReserve; ULONG_PTR HeapSegmentCommit; ULONG_PTR HeapDeCommitTotalFreeThreshold; ULONG_PTR HeapDeCommitFreeBlockThreshold; ULONG_PTR NumberOfHeaps; ULONG_PTR MaximumNumberOfHeaps; PVOID ProcessHeaps; PVOID GdiSharedHandleTable; PVOID ProcessStarterHelper; PVOID GdiDCAttributeList; PVOID LoaderLock; ULONG OSMajorVersion; ULONG OSMinorVersion; USHORT OSBuildNumber; USHORT OSCSDVersion; ULONG OSPlatformId; ULONG ImageSubsystem; ULONG ImageSubsystemMajorVersion; ULONG ImageSubsystemMinorVersion; ULONG_PTR ImageProcessAffinityMask; ULONG_PTR GdiHandleBuffer[34]; PVOID PostProcessInitRoutine; PVOID TlsExpansionBitmap; ULONG TlsExpansionBitmapBits[32]; ULONG SessionId; ULARGE_INTEGER AppCompatFlags; ULARGE_INTEGER AppCompatFlagsUser; PVOID pShimData; PVOID AppCompatInfo; UNICODE_STRING CSDVersion; PVOID ActivationContextData; PVOID ProcessAssemblyStorageMap; PVOID SystemDefaultActivationContextData; PVOID SystemAssemblyStorageMap; ULONG_PTR MinimumStackCommit; } PEB, *PPEB; void EnumerateProcessModules(HANDLE hProcess) { PEB peb; ZeroMemory(&peb, sizeof(PEB)); // 获取PEB地址 BOOL bRet = ReadProcessMemory(hProcess, &NtCurrentTeb()->ProcessEnvironmentBlock, &peb, sizeof(PEB), NULL); if (!bRet) { std::cout << "ReadProcessMemory failed!" << std::endl; return; } // 遍历模块列表 PPEB_LDR_DATA pLdrData = peb.LoaderData; if (pLdrData == NULL) { std::cout << "LoaderData is NULL!" << std::endl; return; } PLIST_ENTRY pListHead = &pLdrData->InMemoryOrderModuleList; PLIST_ENTRY pListEntry = pListHead->Flink; while (pListEntry != pListHead) { PLDR_DATA_TABLE_ENTRY pLdrEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); if (pLdrEntry->DllBase != NULL) { // 获取模块基地址和名称 wchar_t szModule[MAX_PATH] = { 0 }; bRet = ReadProcessMemory(hProcess, pLdrEntry->FullDllName.Buffer, szModule, pLdrEntry->FullDllName.Length, NULL); if (bRet) { std::wcout << L"Module Base: " << pLdrEntry->DllBase << L", Module Name: " << szModule << std::endl; } } pListEntry = pListEntry->Flink; } } int main(int argc, char* argv[]) { DWORD dwProcessId = 0; if (argc > 1) { dwProcessId = atoi(argv[1]); } HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId); if (hProcess == NULL) { std::cout << "OpenProcess failed!" << std::endl; return 0; } EnumerateProcessModules(hProcess); CloseHandle(hProcess); return 0; } ``` 需要注意的是,以上代码中使用了一些Windows内部的结构体和函数,如`UNICODE_STRING`、`LIST_ENTRY`、`NtCurrentTeb()`等,需要包含相应的头文件,并且这些结构体和函数都不是官方公开的API,可能会在未来的操作系统版本中发生变化。因此,开发者在使用这些结构体和函数时需要特别注意。

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 10
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值