一个简单的dll注入demo

dll注入

dll注入就是在一个不需加载某dll的进程中，强行加载此dll（加入自己的代码），修改目标程序功能。应用有游戏辅助、输入法、安全软件拦截功能。

需要3个项目：

• dll文件 + 注入程序
• 目标文件

先说一下，32位dll只能注入到32位进程，64位dll也只能注入到64位进程。

1. 注入方式

几种常用方式：

• 远程线程注入
• 消息钩子注入
• 注册表注入
• APC注入
• 输入法注入
• ComRes注入
• 依赖可信进程注入
• 劫持进程注入

1.1 远程线程注入

注入程序流程：

1. 打开目标进程OpenProcess()；
2. 申请空间VirtualAllocEx()；
3. 写入dll路径WriteProcessMemory()；
4. CreateRemoteThread()，执行LoadLibrary(DLLPATH)；
5. 等待线程结束，释放空间。

DllMain在进程创建或退出时会执行，它并不算是个主函数。下面是msdn部分介绍：

it is called by the system when processes and threads are initialized and terminated, or upon calls to the LoadLibrary and FreeLibrary functions.

BOOL WINAPI DllMain(  HINSTANCE hinstDLL,  // handle to the DLL module
  DWORD fdwReason,     // reason for calling function
  LPVOID lpvReserved   // reserved);

fdwReason

[in] Specifies a flag indicating why the DLL entry-point function is being called.

1.2 消息钩子注入

这个放在hook部分整理。

2. 代码示例

bullet.dll

#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule,
	DWORD  ul_reason_for_call,
	LPVOID lpReserved
)
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
	{
		MessageBox(0, L"注入成功了", 0, 0);
		break;
	}

	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

inject.cpp

#include <windows.h>
#include <direct.h>
#include <string.h>
#include <stdio.h>
#include <Shlwapi.h>
#pragma comment(lib, "shlwapi.lib")

int main()
{
	char szDllPath[MAX_PATH] = { 0 };
	HMODULE hDll = NULL;
	DWORD dwPID = 0;
	HANDLE hProcess;
	LPVOID lpDllPathBuf = NULL;
	SIZE_T nSize = 0;
	HANDLE hThread = NULL;

	_getcwd(szDllPath, MAX_PATH);
	PathRemoveFileSpecA(szDllPath);
	strcat_s(szDllPath, MAX_PATH, "\\Debug\\bullet.dll");

	/*hDll = LoadLibraryA(szDllPath);*/
	printf("target pid:");
	scanf_s("%d", &dwPID);
	getchar();

	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);
	if (!hProcess) return 0;

	lpDllPathBuf = VirtualAllocEx(hProcess, 
		NULL,
		strlen(szDllPath) + 1,
		MEM_RESERVE | MEM_COMMIT,
		PAGE_EXECUTE_READWRITE);

	WriteProcessMemory(hProcess, 
		lpDllPathBuf, 
		szDllPath,
		strlen(szDllPath) + 1,
		&nSize);

	hThread = CreateRemoteThread(hProcess, 
		NULL,NULL,
		(LPTHREAD_START_ROUTINE)LoadLibraryA,
		lpDllPathBuf,
		0, 0);

	WaitForSingleObject(hThread, -1);
	VirtualFreeEx(hProcess, lpDllPathBuf, 0, MEM_RELEASE);
	CloseHandle(hProcess);
	CloseHandle(hThread);

	return 0;
}