输入法注入QQ游戏

现在的游戏做了很多保护措施

通常的注入办法有

@1 写驱动注入：难度稍微大点 暂时没有接触驱动

 

@2 系统dll替换：常见的情况就是替换掉ws2_32.dll

 

@3 输入法注入: 其实输入法注入也就是dll的换种的一种方法之一

     只不过了 替换系统dll后某些游戏会去检测系统dll的md5值 发现不对他就退出

     而输入法则不一定回去检测（游戏运营商不知道你会安装何种输入法）

 

下面的代码使用输入法注入（测试发现注入后dnf仍然会扫描到非法模块 但是能过qq飞车的检测）

cpp文件：

#include <windows.h> #include <stdio.h> #include <imm.h> #include <string.h> //函数在dll中的偏移 用depends查到的 #define H_DllCanUnloadNow 0xf430 #define H_DllGetClassObject 0xf450 #define H_DllRegisterServer 0xf2b0 #define H_DllUnregisterServer 0xf2b0 #define H_ImeConfigure 0x5cd50 #define H_ImeConversionList 0x5cdc0 #define H_ImeDestroy 0x5cdd0 #define H_ImeEnumRegisterWord 0x5cdc0 #define H_ImeEscape 0x5cde0 #define H_ImeGetRegisterWordStyle 0x5cff0 #define H_ImeInquire 0x5ccf0 #define H_ImeProcessKey 0x5ce30 #define H_ImeRegisterWord 0x5cfe0 #define H_ImeSelect 0x5ce70 #define H_ImeSetActiveContext 0x5cf60 #define H_ImeSetCompositionString 0x5d000 #define H_ImeToAsciiEx 0x5ce70 #define H_ImeUnregisterWord 0x5cfe0 #define H_NotifyIME 0x5cfb0 HMODULE hModule, hDllModule; FARPROC func; FILE *stream; typedef struct { DWORD dwPrivateDataSize; DWORD fdwProperty; DWORD fdwConversionCaps; // fdwConverstionCaps DWORD fdwSentenceCaps; DWORD fdwUICaps; DWORD fdwSCSCaps; DWORD fdwSelectCaps; } IMEINFO, *LPIMEINFO; LPSTR cmd = NULL; LPCSTR dnf = "地下城与勇士//DNF.exe"; LPCSTR speed = "GameApp.exe"; char * pch = NULL; HANDLE hThread; BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID pvReserved) { switch (dwReason) { case DLL_PROCESS_ATTACH: //加载dll AllocConsole(); freopen_s(&stream, "CONIN$", "r+t", stdin); freopen_s(&stream, "CONOUT$", "a+t", stdout); cmd = GetCommandLineA(); printf("%s/r/n", cmd);//打印程序的命令行参数 （通过这个命令含参数可以知道该进程是哪个程序） hModule = LoadLibraryA("GooglePinyin2.dll"); if (!hModule) return FALSE; //---------可在此处开一线程 break; case DLL_PROCESS_DETACH: //卸载DLL FreeLibrary(hModule); if(hDllModule) { FreeLibrary(hDllModule); } printf("free my dll/r/n"); printf("============================================================/r/n/r/n"); fclose(stream); FreeConsole(); break; } return TRUE; } STDAPI DllGetClassObject(REFCLSID rclsid, REFIID riid, void **ppvObj) { //func = (FARPROC)((int)hModule->unused + 0xf450); func = GetProcAddress(hModule, "ImeInquire"); printf("DllGetClassObject is run/r/n"); HRESULT r; _asm { push ppvObj; push riid; push rclsid; call func; //invoke func ppvObj, riid, erclsid mov r, eax; } printf("init station = %l/r/n", r); return r; } STDAPI DllCanUnloadNow(void) { func = (FARPROC)((int)hModule->unused + H_DllCanUnloadNow); printf("DllCanUnloadNow is run/r/n"); HRESULT r; _asm { call func; mov r, eax; } return r; } STDAPI DllRegisterServer(void) { func = (FARPROC)((int)hModule->unused + H_DllRegisterServer); printf("DllRegisterServer is run/r/n"); HRESULT r; _asm { call func; mov r, eax; } return r; } STDAPI DllUnregisterServer(void) { func = (FARPROC)((int)hModule->unused + H_DllUnregisterServer); printf("DllUnregisterServer is run/r/n"); HRESULT r; _asm { call func; mov r, eax; } return r; } extern "C" BOOL WINAPI ImeInquire(LPIMEINFO imeInfo, LPTSTR uiWndClass, DWORD systemInfo) { func = (FARPROC)((int)hModule + H_ImeInquire); printf("ImeInquire :%p is run/r/n",func); BOOL r; _asm { push systemInfo; push uiWndClass; push imeInfo; call func; //invoke func imeInfo, uiWndClass, systemInfo mov r, eax; } return r; } extern "C" DWORD WINAPI ImeConversionList(HIMC hImc, LPCTSTR src, LPCANDIDATELIST dest, DWORD bufLen, UINT flag) { func = (FARPROC)((int)hModule->unused + H_ImeConversionList); printf("ImeConversionList is run/r/n"); DWORD r; _asm { push flag; push bufLen; push dest; push src; push hImc; call func //invoke func hImc, src,dest, bufLen, flag mov r, eax; } return r; } extern "C" BOOL WINAPI ImeConfigure(HKL kl, HWND wnd, DWORD mode, LPVOID data) { func = (FARPROC)((int)hModule->unused + H_ImeConfigure); printf("ImeConfigure is run/r/n"); BOOL r; _asm { push data; push mode; push wnd; push kl; call func; //invoke func kl, wnd, mode, data mov r, eax; } return r; } extern "C" BOOL WINAPI ImeDestroy(UINT reserved) { func = (FARPROC)((int)hModule->unused + H_ImeDestroy); printf("ImeDestroy is run/r/n"); BOOL r; _asm { push reserved; call func; //invoke func reserved; mov r, eax; } return r; } extern "C" LRESULT WINAPI ImeEscape(HIMC hImc, UINT escape, LPVOID data) { func = (FARPROC)((int)hModule->unused + H_ImeConfigure); printf("ImeEscape is run/r/n"); LRESULT r; _asm { push data; push escape; push hImc; call func; //invoke func hImc, escape, data; mov r, eax; } return r; } extern "C" BOOL WINAPI ImeProcessKey(HIMC hImc, UINT virtKey, LPARAM lParam, CONST LPBYTE keyState) { func = (FARPROC)((int)hModule->unused + H_ImeProcessKey); printf("ImeProcessKey is run/r/n"); BOOL r; _asm { push keyState; push lParam; push virtKey; push hImc; call func; //invoke func hImc, virtKey, lParam, keyStat; mov r, eax; } return r; } extern "C" UINT WINAPI ImeToAsciiEx(UINT virtKey, UINT scanCode, CONST LPBYTE keyState, /*LPTRANSMSGLIST*/LPVOID transMsgList, UINT state, HIMC hImc) { func = (FARPROC)((int)hModule->unused + H_ImeToAsciiEx); printf("ImeToAsciiEx is run/r/n"); UINT r; _asm { push hImc; push state; push transMsgList; push keyState; push scanCode; push virtKey; call func; //invoke func virtKey, scanCode, keyState, transMsgList, state, hImc mov r, eax; } return r; } extern "C" BOOL WINAPI NotifyIME(HIMC hImc, DWORD action, DWORD index, DWORD value) { func = (FARPROC)((int)hModule->unused + H_NotifyIME); printf("NotifyIME is run/r/n"); BOOL r; _asm { push value; push index; push action; push hImc; call func; //invoke func hImc, action, index, value; mov r, eax; } return r; } extern "C" BOOL WINAPI ImeSelect(HIMC hImc, BOOL select) { func = (FARPROC)((int)hModule->unused + H_ImeSelect); printf("ImeSelect is run/r/n"); BOOL r; _asm { push select; push hImc; call func; //invoke func hImc, select; mov r, eax; } return r; } extern "C" BOOL WINAPI ImeSetActiveContext(HIMC hImc, BOOL activate) { func = (FARPROC)((int)hModule->unused + H_ImeSetActiveContext); printf("ImeSetActiveContext is run/r/n"); BOOL r; _asm { push activate; push hImc; call func; //invoke func hImc, activate; mov r, eax; } return r; } extern "C" BOOL WINAPI ImeSetCompositionString(HIMC hImc, DWORD index, LPVOID comp, DWORD compLen, LPVOID read, DWORD readLen) { func = (FARPROC)((int)hModule->unused + H_ImeSetCompositionString); printf("ImeSetCompositionString is run/r/n"); BOOL r; _asm { push readLen; push read; push compLen; push comp; push index; push hImc; call func; //invoke func hImc, index, comp,compLen, read, readLen; mov r, eax; } return r; } extern "C" BOOL WINAPI ImeRegisterWord(LPCTSTR reading, DWORD style, LPCTSTR string) { func = (FARPROC)((int)hModule->unused + H_ImeRegisterWord); printf("ImeRegisterWord is run/r/n"); BOOL r; _asm { push string; push style; push reading; call func; //invoke func reading, style, string; mov r, eax; } return r; } extern "C" BOOL WINAPI ImeUnregisterWord(LPCTSTR reading, DWORD style, LPCTSTR string) { func = (FARPROC)((int)hModule->unused + H_ImeUnregisterWord); printf("ImeUnregisterWord is run/r/n"); BOOL r; _asm { push string; push style; push reading; call func; //invoke func reading, style, string; mov r, eax; } return r; } extern "C" UINT WINAPI ImeGetRegisterWordStyle(UINT item, LPSTYLEBUF styleBuf) { func = (FARPROC)((int)hModule->unused + H_ImeGetRegisterWordStyle); printf("ImeGetRegisterWordStyle is run/r/n"); UINT r; _asm { push styleBuf; push item; call func; //invoke func item, styleBuf; mov r, eax; } return r; } extern "C" UINT WINAPI ImeEnumRegisterWord(REGISTERWORDENUMPROC enumProc, LPCTSTR reading, DWORD style, LPCTSTR string, LPVOID data) { func = (FARPROC)((int)hModule->unused + H_ImeEnumRegisterWord); printf("ImeEnumRegisterWord is run/r/n"); UINT r; _asm { push data; push string; push style; push reading; push enumProc; call func; //invoke func enumProc, reading, style, string, data; mov r, eax; } return r; }

 

def文件：

 LIBRARY "Your dll name.IME" EXPORTS DllCanUnloadNow @1 PRIVATE DllGetClassObject @2 PRIVATE DllRegisterServer @3 PRIVATE DllUnregisterServer @4 PRIVATE ImeConfigure @5 ImeConversionList @6 ImeDestroy @7 ImeEnumRegisterWord @8 ImeEscape @9 ImeGetRegisterWordStyle @10 ImeInquire @11 ImeProcessKey @12 ImeRegisterWord @13 ImeSelect @14 ImeSetActiveContext @15 ImeSetCompositionString @16 ImeToAsciiEx @17 ImeUnregisterWord @18 NotifyIME @19