R0注入DLL到R3进程

R0注入DLL到R3，貌似没有必要，也的确没有必要。以下代码只是为了验证R0调用NtQueueApcThread来注入DLL到R3进程中，没有什么神秘的东西，博大家一笑





#include <ntddk.h>

 

PVOID pfn_BaseDispatchApc = NULL;

PVOID pfn_LoadLibraryA = NULL;

PVOID pszText_Kernel32 = NULL;

 

NTSTATUS (NTAPI* pfn_NtQueueApcThread)(

     __in HANDLE     ThreadHandle,

     __in PVOID      ApcRoutine,

     __in_opt PVOID  ApcArgument1,

     __in_opt PVOID  ApcArgument2,

     __in_opt PVOID  ApcArgument3

     );

     

VOID LoadImageNotifyRoutine (

     IN PUNICODE_STRING  FullImageName,

     IN HANDLE  ProcessId, // where image is mapped

     IN PIMAGE_INFO  ImageInfo

     )

{   

     PWSTR ptr = FullImageName->Buffer + FullImageName->Length/ sizeof ( WCHAR )-4;

     

     if ( ptr > FullImageName->Buffer && _wcsicmp( ptr, L ".exe" ) == 0 )

     {

         ptr -= 8;           

         if ( ptr > FullImageName->Buffer && _wcsicmp( ptr, L "\\notepad.exe" ) == 0 );

         {

             pfn_NtQueueApcThread( ZwCurrentThread(),

                 pfn_BaseDispatchApc,

                 pfn_LoadLibraryA,

                 pszText_Kernel32,

                 NULL );

         }

     }       

}

 

VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)

{

     PsRemoveLoadImageNotifyRoutine( LoadImageNotifyRoutine );

}

 

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)

{

     //just for winxp

     KdBreakPoint();

     

     //填写kernel32!BaseDispatchApc//win7上是ntdll!RtlDispatchAPC

     ( PVOID )pfn_BaseDispatchApc = ( PVOID )0x7c82c0f6;

     

     //填写kernel32!LoadLibraryA

     ( PVOID )pfn_LoadLibraryA = ( PVOID )0x7c801d7b;

     

     //保证待Load的DLL的名称为text.dll，可以放到system目录下

     //填写kernel32的头部text字符的位置

     ( PVOID )pszText_Kernel32 = ( PVOID )0x7c8001e9;

     

     //填写nt!NtQueueApcThread   

     ( PVOID )pfn_NtQueueApcThread = ( PVOID )0x805d3756;

     

     DriverObject->DriverUnload = DriverUnload;

     

     return PsSetLoadImageNotifyRoutine( LoadImageNotifyRoutine );

}