#include <Windows.h>
typedef struct _UNICODE_STRING
{ // UNICODE_STRING structure
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef NTSTATUS (WINAPI *fLdrLoadDll) //LdrLoadDll function prototype
(
IN PWCHAR PathToFile OPTIONAL,
IN ULONG Flags OPTIONAL,
IN PUNICODE_STRING ModuleFileName,
OUT PHANDLE ModuleHandle
);
typedef VOID (WINAPI *fRtlInitUnicodeString) //RtlInitUnicodeString function prototype
(
PUNICODE_STRING DestinationString,
PCWSTR SourceString
);
HMODULE hntdll;
fLdrLoadDll _LdrLoadDll;
fRtlInitUnicodeString _RtlInitUnicodeString;
HMODULE LoadDll( LPCSTR lpFileName)
{
//by Viotto - http://breaking-security.net
if (hntdll == NULL) { hntdll = GetModuleHandleA("ntdll.dll"); }
if (_LdrLoadDll == NULL) { _LdrLoadDll = (fLdrLoadDll) GetProcAddress ( hntdll, "LdrLoadDll"); }
if (_RtlInitUnicodeString == NULL)
{ _RtlInitUnicodeString = (fRtlInitUnicodeString) GetProcAddress ( hntdll, "RtlInitUnicodeString"); }
int StrLen = lstrlenA(lpFileName);
BSTR WideStr = SysAllocStringLen(NULL, StrLen);
MultiByteToWideChar(CP_ACP, 0, lpFileName, StrLen, WideStr, StrLen);
UNICODE_STRING usDllName;
_RtlInitUnicodeString(&usDllName, WideStr);
SysFreeString(WideStr);
HANDLE DllHandle;
_LdrLoadDll(0, 0, &usDllName, &DllHandle);
return (HMODULE)DllHandle;
}
int main() //Usage example
{
HMODULE hmodule = LoadDll("Kernel32.dll");
//HMODULE hmodule = LoadLibraryA("Kernel32.dll");
return (int)hmodule;
}
C++ 替代LoadLibrary加载dll
最新推荐文章于 2023-11-23 17:26:41 发布