隐藏 LoadLibrary() 函数

#include <Windows.h> typedef struct _UNICODE_STRING { // UNICODE_STRING structure USHORT Length; USHORT MaximumLength; PWSTR Buffer; } UNICODE_STRING; typedef UNICODE_STRING *PUNICODE_STRING; typedef NTSTATUS (WINAPI *fLdrLoadDll) //LdrLoadDll function prototype ( IN PWCHAR PathToFile OPTIONAL, IN ULONG Flags OPTIONAL, IN PUNICODE_STRING ModuleFileName, OUT PHANDLE ModuleHandle ); typedef VOID (WINAPI *fRtlInitUnicodeString) //RtlInitUnicodeString function prototype ( PUNICODE_STRING DestinationString, PCWSTR SourceString ); HMODULE hntdll; fLdrLoadDll _LdrLoadDll; fRtlInitUnicodeString _RtlInitUnicodeString; HMODULE LoadDll( LPCSTR lpFileName) //Coded by Viotto - http://viotto-security.net { if (hntdll == NULL) { hntdll = GetModuleHandleA("ntdll.dll"); } if (_LdrLoadDll == NULL) { _LdrLoadDll = (fLdrLoadDll) GetProcAddress ( hntdll, "LdrLoadDll"); } if (_RtlInitUnicodeString == NULL) { _RtlInitUnicodeString = (fRtlInitUnicodeString) GetProcAddress ( hntdll, "RtlInitUnicodeString"); } int StrLen = lstrlenA(lpFileName); BSTR WideStr = SysAllocStringLen(NULL, StrLen); MultiByteToWideChar(CP_ACP, 0, lpFileName, StrLen, WideStr, StrLen); UNICODE_STRING usDllName; _RtlInitUnicodeString(&usDllName, WideStr); SysFreeString(WideStr); HANDLE DllHandle; _LdrLoadDll(0, 0, &usDllName, &DllHandle); return (HMODULE)DllHandle; } typedef void (* _u)(); int main() { HMODULE hMydll = LoadDll("C:\\ww.dll"); _u ss = (_u)GetProcAddress(hMydll,"tt"); ss(); return 0; }

网上看到的，先收藏了，说不定会用到

关于LdrLoadDll


调用过程：LoadLibraryA->LoadLibraryW->LdrLoadDll……
针对有些未加载kernel32.dll的进程，可以用ShellCode+LdrLoadDll进行DLL注入
还有就是可以用LdrGetProcedureAddress代替GetProcAddress