远程注入代码，一些过时的ring3技术(ASM、VC++、Delphi) (非Dll注入)

ASM：                                                                                             

include b.inc

.code

;/
;///
;/// 说明: 显示一个消息
;/// 参数:
;/// 返回:
;///
;/
ShowTip proc

    invoke GetModuleHandle, $CTA0("user32.dll")
     invoke GetProcAddress, eax, offset $CTA0("MessageBoxA")

    push 64d
    push 0
    push $CTA0("显示一个消息")
    push 0
    call eax
  
    ret

ShowTip endp

;/
;///
;/// 说明: 插入EXE
;/// 参数: Pid = 进程PID
;/// 返回: 成功True,否则False
;///
;/
InjectExe proc uses ebx esi edi Pid

    LOCAL status
    LOCAL hMod: HMODULE
    LOCAL hNHOffset: DWORD
    LOCAL cbImage: DWORD
    LOCAL hProcess: HANDLE, hThread: HANDLE
    LOCAL pBaseAddr: DWORD

    mov status, 0

    invoke GetModuleHandle, NULL
    mov hMod, eax

    mov esi, eax
    assume esi: ptr IMAGE_DOS_HEADER
    push [esi].e_lfanew
    pop hNHOffset
    assume esi: Nothing

    mov eax, hMod
    add eax, hNHOffset
    mov esi, eax
    assume esi: ptr IMAGE_NT_HEADERS
    push [esi].OptionalHeader.SizeOfImage
    pop cbImage
    assume esi: Nothing

    invoke OpenProcess, PROCESS_ALL_ACCESS, FALSE, Pid
    .if eax == NULL
         jmp Err
    .endif
    mov hProcess, eax

    ;//给我释放
    invoke VirtualFreeEx, hProcess, hMod, 0, MEM_RELEASE

    ;//是我的终究是我的
    invoke VirtualAllocEx, hProcess, hMod, cbImage, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE
    .if eax == NULL
         jmp Err
    .endif
    mov pBaseAddr, eax

    ;//可以写进去了
    invoke WriteProcessMemory, hProcess, pBaseAddr, hMod, cbImage, NULL
    .if eax == NULL
        jmp Err
    .endif

    ;//OK,插进去..
    invoke CreateRemoteThread, hProcess, NULL, NULL, offset ShowTip, NULL, NULL, NULL
    .if eax == NULL
        jmp Err
    .endif
    mov hThread, eax
    invoke WaitForSingleObject, hThread, INFINITE
    invoke CloseHandle, hThread

    mov status, 1

Err:

    .if pBaseAddr != NULL
        invoke VirtualFreeEx, hProcess, pBaseAddr, 0, MEM_RELEASE
    .endif

    .if hProcess != NULL
        invoke CloseHandle, hProcess
    .endif

    mov eax, status
    ret

InjectExe endp

;/
;///
;///
;/// PE 入口
;///
;///
;/
start:

    invoke InjectExe,   (you pid?)
    .if eax
        invoke MessageBox, NULL, $CTA0("OK"), NULL, MB_OK
    .endif

    invoke ExitProcess, NULL
end start

 

VC++：                                                                                             

 

#include <windows.h>
#include <tchar.h>

#pragma comment(linker, "/BASE:0x14000000")

typedef int (__stdcall *fnMessageBoxA)(HWND, LPCSTR, LPCSTR, UINT);

//
///
///说明: 显示一个消息
///参数:
///返回:
///
//
void __stdcall ShowTip()
{
     HMODULE hMod;
     fnMessageBoxA myMessageBoxA;

     hMod = GetModuleHandle(L"user32.dll");
     myMessageBoxA = (fnMessageBoxA)GetProcAddress(hMod, (LPCSTR)"MessageBoxA");

     myMessageBoxA(NULL, "显示一个消息", NULL, 64);
}

//
///
///说明: 插入代码
///参数: Pid = 进程PID
///返回: 成功True,否则False
///
//
bool InjectExe(DWORD Pid)
{
     bool status = false;
     LPVOID pBaseAddr = NULL;
     HMODULE hMod = GetModuleHandle(NULL);
     LONG hNHOffset = PIMAGE_DOS_HEADER(hMod)->e_lfanew;
     DWORD cbImage = PIMAGE_NT_HEADERS((DWORD)hMod + (DWORD)hNHOffset)->OptionalHeader.SizeOfImage;

     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, Pid);
     if (hProcess == NULL)
     {
          goto Err;
     }

     //给我释放哈..
     VirtualFreeEx(hProcess, LPVOID(hMod), 0, MEM_RELEASE);

     //给我哈
     pBaseAddr = VirtualAllocEx(hProcess, LPVOID(hMod), cbImage, MEM_COMMIT | MEM_RESERVE,
          PAGE_EXECUTE_READWRITE);
     if (pBaseAddr == NULL)
     {
          goto Err;
     }

     //写进去
     if (!WriteProcessMemory(hProcess, pBaseAddr, LPCVOID(hMod), cbImage, NULL))
     {
          goto Err;
     }

     //可以插进去了..
     HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)&ShowTip, NULL, NULL, NULL);
     if (hThread == NULL)
     {
          goto Err;
     }

     WaitForSingleObject(hThread, INFINITE);
     CloseHandle(hThread);

     status = true;

Err:

     if (pBaseAddr != NULL)
     {
          VirtualFreeEx(hProcess, pBaseAddr, 0, MEM_RELEASE);
     }

     if (hProcess != NULL)
     {
          CloseHandle(hProcess);
     }

     return status;
}

//
///
///
///PE入口
///
///
//
int APIENTRY _tWinMain(HINSTANCE hInstance,
        HINSTANCE hPrevInstance,
        LPTSTR lpCommandLine,
        int nCmdShow)
{

     if (InjectExe(you exe pid))
     {
          MessageBox(NULL, L"OK", NULL, 64);
     }
     return 0;
}

Delphi：                                                                                             

 

program Project1;

{$IMAGEBASE $14000000}

uses
Windows, SysUtils;

///
///
///说明: 显示消息
///参数:
///返回值:
///
///
procedure ShowTip; stdcall;
type
    TMessageBoxA = function (hWnd: HWND; lpText, lpCaption: PChar; uType: UINT): Integer; stdcall;
var
    hMod: HMODULE;
    pFuncAddr: Pointer;
begin
    hMod := GetModuleHandle(PChar('user32.dll'));
    pFuncAddr := GetProcAddress(hMod, PChar('MessageBoxA'));
    if pFuncAddr <> nil then
    begin
        TMessageBoxA(pFuncAddr)(0, PChar('显示一个消息而已'), PChar('当然成功啦'), 64);
    end;
end;

///
///
///说明: 插入代码
///参数: Pid=进程PID
///返回: 成功True,否则False
///
///
function InjectExe(Pid: DWORD): Boolean;
label
    Err;
var
    hMod: HMODULE;
    hNHOffset: Integer;
    cbImage: DWORD;
    hProcess, hThread: THandle;
    pBaseAddr: Pointer;
    dwReserved: DWORD;//纯粹是保留的
begin
    Result := False;

    hMod := GetModuleHandle(nil);
    hNHOffset := PImageDosHeader(Pointer(hMod))^._lfanew;
    cbImage := PImageNtHeaders(Pointer(Integer(hMod) + hNHOffset))^.OptionalHeader.SizeOfImage;

    hProcess := OpenProcess(PROCESS_ALL_ACCESS, False, Pid);
    if hProcess = 0 then
        goto Err;

    //给我释放
    VirtualFreeEx(hProcess, Pointer(hMod), 0, MEM_RELEASE);
    //分配一下内存咯
    pBaseAddr := VirtualAllocEx(hProcess, Pointer(hMod), cbImage, MEM_COMMIT or MEM_RESERVE,
                              PAGE_EXECUTE_READWRITE);
    if pBaseAddr = nil then
        goto Err;

    //写进去
    if not WriteProcessMemory(hProcess, pBaseAddr, Pointer(hMod), cbImage, dwReserved) then
        goto Err;

    //最后一步,插入线程
    hThread := CreateRemoteThread(hProcess, nil, 0, Pointer(@ShowTip), nil, 0, dwReserved);
    if hThread = 0 then
        goto Err;

    WaitForSingleObject(hThread, INFINITE);
    CloseHandle(hThread);

    Result := True;

Err:

    if pBaseAddr <> nil then VirtualFreeEx(hProcess, pBaseAddr, 0, MEM_RELEASE);
    if hProcess <> 0 then CloseHandle(hProcess);
end;

///
///
///PE入口
///
///
begin
    if InjectExe(you exe pid) then
        MessageBox(0, PChar('Success'), PChar('插入成功'), 64);
end.

 

    至于VB的已经发过了，上一篇帖子中就有。。。另外ASM生成时需要Link下 /BASE，嗯嗯。。想信这个地球人都会的。

    较早前的代码了，所以发出来看看有没有谁需要用哈？？

转载于：http://hi.baidu.com/cxwr/blog/item/8f1cc494f3199b1dd31b7066.html