注入（二）：修改导入表(c++）

导入表注入：修改游戏EXE依赖dll树上找个结点，程序运行前加载，加载修改回导入表。
 优：游戏依赖库多，不易用完整性来查验，同时客户端版本不同，更易躲过检测
 缺点：文件操作明显，易被ProcessMonitor检测到

//BeModeImportTableExe.exe
void main(void)
{
	int i = 0;
	while(true)
	{
		__asm{
		mov eax,i
		inc eax
		}
	}
}

 

//修改导入表的exe
#include <Windows.h>

DWORD PEAlign(DWORD dwTarNum,DWORD dwAlignTo)
{	
	return(((dwTarNum+dwAlignTo-1)/dwAlignTo)*dwAlignTo);
}

//
//增加导入表项
//
BOOL AddNewSection(LPCTSTR lpStrModulePath, DWORD dwNewSectionSize)
{
	bool   bSuccess = false;
	LPVOID lpMemModule = NULL;
	LPBYTE lpData = NULL;
	HANDLE hFile = INVALID_HANDLE_VALUE, hFileMapping = INVALID_HANDLE_VALUE;
	PIMAGE_NT_HEADERS pNtHeader = NULL;
	PIMAGE_SECTION_HEADER pNewSection = NULL, pLastSection = NULL;

	OutputDebugString("[!] AddNewSection Enter!\n");

	//TODO:可能还涉及关闭windows文件保护
	__try
	{
		//pe文件映射到内存
		hFile = CreateFile(
			     lpStrModulePath,
				 GENERIC_READ | GENERIC_WRITE,
				 FILE_SHARE_READ | FILE_SHARE_WRITE,
				 NULL,
				 OPEN_EXISTING,
				 FILE_ATTRIBUTE_NORMAL,
				 NULL
				 );
		if ( INVALID_HANDLE_VALUE == hFile )
		{
			OutputDebugString("[-] AddNewSection CreateFile fail!\n");
			goto _EXIT_;
		}

		DWORD dwFileSize = GetFileSize(hFile, NULL);
		hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE/* | SEC_IMAGE*/, 0, dwFileSize, "WINSUN_MAPPING_FILE");
		if ( NULL == hFileMapping )
		{
			
			OutputDebugString("[-] AddNewSection CreateFileMapping fail!\n");
			goto _EXIT_;

		}

		lpMemModule = MapViewOfFile(hFileMapping, FILE_MAP_ALL_ACCESS, 0, 0, dwFileSize);
		if ( NULL == lpMemModule )
		{
			OutputDebugString("[-] AddNewSection MapViewOfFile fail!\n");
			goto _EXIT_;
		}

		lpData = (LPBYTE)lpMemModule;
		//判断是否是PE文件
        if (((PIMAGE_DOS_HEADER)lpData)->e_magic != IMAGE_DOS_SIGNATURE )
        {
			OutputDebugString("[-] AddNewSection PE Header MZ error!\n");
			goto _EXIT_;
        }

		pNtHeader = (PIMAGE_NT_HEADERS)(lpData + ((PIMAGE_DOS_HEADER)(lpData))->e_lfanew);
		if ( pNtHeader->Signature != IMAGE_NT_SIGNATURE )
		{
			OutputDebugString("[-] AddNewSection PE Header PE error!\n");
			goto _EXIT_;
		}
		
		//判断是否可以增加一个新节
		if ( ((pNtHeader->FileHeader.NumberOfSections + 1) * sizeof(IMAGE_SECTION_HEADER)) > (pNtHeader->OptionalHeader.SizeOfHeaders) )
		{
			OutputDebugString("[-] AddNewSection cannot add a new section!\n");
			goto _EXIT_;
		}

        pNewSection  = (PIMAGE_SECTION_HEADER)(pNtHeader+1) + pNtHeader->FileHeader.NumberOfSections;
		pLastSection = pNewSection - 1;

		
		DWORD rsize,vsize,roffset,voffset;
		//对齐偏移和RVA
		rsize=PEAlign(dwNewSectionSize,
				pNtHeader->OptionalHeader.FileAlignment);

		roffset=PEAlign(pLastSection->PointerToRawData+pLastSection->SizeOfRawData,
				pNtHeader->OptionalHeader.FileAlignment);
		
		vsize=PEAlign(dwNewSectionSize,
				pNtHeader->OptionalHeader.SectionAlignment);

		voffset=PEAlign(pLastSection->VirtualAddress+pLastSection->Misc.VirtualSize,
				pNtHeader->OptionalHeader.SectionAlignment);

		//填充新节表
		memcpy(pNewSection->Name, "WINSUN", strlen("WINSUN"));
		pNewSection->VirtualAddress = voffset;
		pNewSection->PointerToRawData = roffset;
		pNewSection->Misc.VirtualSize = vsize;
		pNewSection->SizeOfRawData = rsize;
		pNewSection->Characteristics = IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE;

		//修改IMAGE_NT_HEADERS，增加新节表
		pNtHeader->FileHeader.NumberOfSections++;
		pNtHeader->OptionalHeader.SizeOfImage += vsize;
		pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0;
		pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0;

		//增加新节到文件尾部
		DWORD dwWriteBytes;
		SetFilePointer(hFile,0,0,FILE_END);
		PBYTE pbNewSectionContent = new BYTE[rsize];
		ZeroMemory(pbNewSectionContent, rsize);
		bSuccess = WriteFile(hFile, pbNewSectionContent, rsize, &dwWriteBytes, NULL);
		if (!bSuccess)
		{
			MessageBox(NULL,"新增节失败","error",MB_OK);
			goto _EXIT_;
		}
		
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
        OutputDebugString("[-] AddImportTableItem  Exception!\n");
		return false;
	}
  OutputDebugString("[!] AddNewSection Exit!\n");
	bSuccess = true;
_EXIT_:

	if ( hFile )
	{
         CloseHandle(hFile);
	}

	if ( lpMemModule)
	{
		UnmapViewOfFile(lpMemModule);
	}

	if ( hFileMapping )
	{
		CloseHandle(hFileMapping);
	}
	return true;
}

//
PIMAGE_SECTION_HEADER ImageRVA2Section(PIMAGE_NT_HEADERS pImgNTHeader, DWORD dwRVA)
{
	int i;
	PIMAGE_SECTION_HEADER pSectionHeader  = (PIMAGE_SECTION_HEADER)(pImgNTHeader+1);
	for(i=0;i<pImgNTHeader->FileHeader.NumberOfSections;i++)
	{
		if((dwRVA>=(pSectionHeader+i)->VirtualAddress) && (dwRVA<=((pSectionHeader+i)->VirtualAddress+(pSectionHeader+i)->SizeOfRawData)))
		{
			return ((PIMAGE_SECTION_HEADER)(pSectionHeader+i));
		}
	}
	return(NULL);
}


//
// calulates the Offset from a RVA
// Base    - base of the MMF
// dwRVA - the RVA to calculate
// returns 0 if an error occurred else the calculated Offset will be returned
DWORD RVA2Offset(PIMAGE_NT_HEADERS pImgNTHeader, DWORD dwRVA)
{
	DWORD _offset;
	PIMAGE_SECTION_HEADER section;
	section=ImageRVA2Section(pImgNTHeader,dwRVA);//ImageRvaToSection(pimage_nt_headers,Base,dwRVA);
	if(section==NULL)
	{
		return(0);
	}
	_offset=dwRVA+section->PointerToRawData-section->VirtualAddress;
	return(_offset);
}

BOOL AddNewImportDescriptor(const char * szPEFilePath,char * szInjectDllName, char *szImportFuncName)
{
	BOOL bSuccess = FALSE;
	LPVOID lpMemModule = NULL;
	LPBYTE lpData = NULL;
	HANDLE hFile = INVALID_HANDLE_VALUE, hFileMapping = INVALID_HANDLE_VALUE;
	PIMAGE_NT_HEADERS pNtHeader = NULL;
	PIMAGE_IMPORT_DESCRIPTOR pstImportTable = NULL;
	PIMAGE_SECTION_HEADER    pstSectionHeader = NULL;
	__try
	{
			//pe文件映射到内存
		hFile = CreateFile(
			     szPEFilePath,
				 GENERIC_READ | GENERIC_WRITE,
				 FILE_SHARE_READ | FILE_SHARE_WRITE,
				 NULL,
				 OPEN_EXISTING,
				 FILE_ATTRIBUTE_NORMAL,
				 NULL
				 );
		if ( INVALID_HANDLE_VALUE == hFile )
		{
			OutputDebugString("[-] AddNewImportDescriptor CreateFile fail!\n");
			goto _EXIT_;
		}

		DWORD dwFileSize = GetFileSize(hFile, NULL);
		hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE/* | SEC_IMAGE*/, 0, dwFileSize, "WINSUN_MAPPING_FILE");
		if ( NULL == hFileMapping )
		{
			
			OutputDebugString("[-] AddNewImportDescriptor CreateFileMapping fail!\n");
			goto _EXIT_;

		}

		lpMemModule = MapViewOfFile(hFileMapping, FILE_MAP_ALL_ACCESS, 0, 0, dwFileSize);
		if ( NULL == lpMemModule )
		{
			OutputDebugString("[-] AddNewImportDescriptor MapViewOfFile fail!\n");
			goto _EXIT_;
		}

		lpData = (LPBYTE)lpMemModule;
		//判断是否是PE
        if (((PIMAGE_DOS_HEADER)lpData)->e_magic != IMAGE_DOS_SIGNATURE )
        {
			OutputDebugString("[-] AddNewImportDescriptor PE Header MZ error!\n");
			goto _EXIT_;
        }

		pNtHeader = (PIMAGE_NT_HEADERS)(lpData + ((PIMAGE_DOS_HEADER)(lpData))->e_lfanew);
		if ( pNtHeader->Signature != IMAGE_NT_SIGNATURE )
		{
			OutputDebugString("[-] AddNewImportDescriptor PE Header PE error!\n");
			goto _EXIT_;
		}
		pstImportTable = (PIMAGE_IMPORT_DESCRIPTOR)(lpData + RVA2Offset(pNtHeader,pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress));
		BOOL bBoundImport = FALSE;
		if (pstImportTable->Characteristics == 0 && pstImportTable->FirstThunk != 0)
		{
			bBoundImport = TRUE;
			pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0;
			pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0;
		}
		
		pstSectionHeader = (PIMAGE_SECTION_HEADER)(pNtHeader+1)+pNtHeader->FileHeader.NumberOfSections-1;
		PBYTE pbNewSection = pstSectionHeader->PointerToRawData + lpData;
		int i = 0;
		while(pstImportTable->FirstThunk != 0)
		{
			memcpy(pbNewSection, pstImportTable, sizeof(IMAGE_IMPORT_DESCRIPTOR));
			pstImportTable++;
			pbNewSection += sizeof(IMAGE_IMPORT_DESCRIPTOR);
			i++;
		}
		memcpy(pbNewSection, (pbNewSection-sizeof(IMAGE_IMPORT_DESCRIPTOR)), sizeof(IMAGE_IMPORT_DESCRIPTOR));
	

		
		DWORD dwDelt = pstSectionHeader->VirtualAddress - pstSectionHeader->PointerToRawData;
		
		//avoid import not need table
		PIMAGE_THUNK_DATA pImgThunkData = (PIMAGE_THUNK_DATA)(pbNewSection + sizeof(IMAGE_IMPORT_DESCRIPTOR)*2);
		


		//import dll name
		PBYTE pszDllNamePosition = (PBYTE)(pImgThunkData + 2);
		memcpy(pszDllNamePosition, szInjectDllName, strlen(szInjectDllName));
		pszDllNamePosition[strlen(szInjectDllName)] = 0;

		//确定IMAGE_IMPORT_BY_NAM的位置
		PIMAGE_IMPORT_BY_NAME pImgImportByName = (PIMAGE_IMPORT_BY_NAME)(pszDllNamePosition + strlen(szInjectDllName) + 1);
		

		//init IMAGE_THUNK_DATA
		pImgThunkData->u1.Ordinal = dwDelt + (DWORD)pImgImportByName - (DWORD)lpData ;


		//init IMAGE_IMPORT_BY_NAME
		pImgImportByName->Hint = 1;
		memcpy(pImgImportByName->Name, szImportFuncName, strlen(szImportFuncName)); //== dwDelt + (DWORD)pszFuncNamePosition - (DWORD)lpData ;
		pImgImportByName->Name[strlen(szImportFuncName)] = 0;
		//init OriginalFirstThunk
		if (bBoundImport)
		{
			((PIMAGE_IMPORT_DESCRIPTOR)pbNewSection)->OriginalFirstThunk = 0;
		}
		else
			((PIMAGE_IMPORT_DESCRIPTOR)pbNewSection)->OriginalFirstThunk = dwDelt + (DWORD)pImgThunkData - (DWORD)lpData;
		//init FirstThunk
		((PIMAGE_IMPORT_DESCRIPTOR)pbNewSection)->FirstThunk = dwDelt + (DWORD)pImgThunkData - (DWORD)lpData;
		//init Name
		((PIMAGE_IMPORT_DESCRIPTOR)pbNewSection)->Name = dwDelt + (DWORD)pszDllNamePosition-(DWORD)lpData;

		//改变导入表
		pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress =  pstSectionHeader->VirtualAddress; 
		pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size			 =  (i+1)*sizeof(IMAGE_IMPORT_DESCRIPTOR);
		
		
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
        OutputDebugString("[-] AddNewImportDescriptor  Exception!\n");
		return false;
	}

	_EXIT_:

	if ( hFile )
	{
         CloseHandle(hFile);
	}

	if ( lpMemModule)
	{
		UnmapViewOfFile(lpMemModule);
	}

	if ( hFileMapping )
	{
		CloseHandle(hFileMapping);
	}
	return true;
}

BOOL AddImportTable(const char * szPEFilePath, char * szInjectDllName,char *szFuncName)
{
	BOOL bSuccess = FALSE;
	try
	{
		//增加一个叫"WINSUN"的节
		bSuccess = AddNewSection(szPEFilePath, 256);
		if (!bSuccess)
		{
			MessageBox(NULL,"add new section fail", "error", MB_OK);
			return bSuccess;
		}
		//增加一个导入表
		AddNewImportDescriptor(szPEFilePath, szInjectDllName,szFuncName);
	}
	catch ( ... )//CException* e)
	{
		return bSuccess;
	}
	return bSuccess;
}

void BackupPE(char * pszPeFilePath)
{

	   CHAR szPath[MAX_PATH] = {0};
	   PCHAR pszPath = pszPeFilePath;

		pszPath = strrchr(pszPath, '\\');
		*pszPath = '\0';
		strcpy_s(szPath, strlen(pszPeFilePath)+1,pszPeFilePath);
		strcat_s(szPath, strlen("\\backup_")+1,"\\backup_");
		strcat_s(szPath, strlen(pszPath+1)+1,pszPath+1);
		*pszPath = '\\';

		CopyFile(pszPeFilePath, szPath, FALSE);
		strncpy(pszPeFilePath, szPath, MAX_PATH);
		return;
}

void main(int argc, char **argv)
{
	AddImportTable("BeModeImportTableExe.exe","WaiGua.dll","InjectFunc");
}

//WaiGua.dll
// dllmain.cpp : Defines the entry point for the DLL application.
#include <Windows.h>
#ifdef __cplusplus
extern "C"
{
#endif	

__declspec (dllexport) void InjectFunc(void);

#ifdef __cplusplus
}
#endif
 void InjectFunc(void)
 {
	  MessageBoxA(NULL, "Dll export Inject Success", "Dll Inject", MB_OKCANCEL);
 }
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		MessageBoxA(NULL, "the simple inject success", "Dll Inject", MB_OKCANCEL);
		break;
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

注入没问题，运行有问题，还有待调试。