利用DLL劫持内存补丁技术注入

最新推荐文章于 2024-08-18 10:35:22 发布
weixin_30404405
最新推荐文章于 2024-08-18 10:35:22 发布
阅读量716
点赞数
文章标签： c#
原文链接：http://www.cnblogs.com/plug/p/8665616.html
版权
当一个可执行文件运行时，Windows加载器将可执行模块映射到进程的地址空间中，加载器分析可执行模块的输入表，并设法找出任何需要的DLL，并将它们映射到进程的地址空间中。由于输入表中只包含DLL名而没有它的路径名，因此加载程序必须在磁盘上搜索DLL文件。首先会尝试从当前程序所在的目录加载DLL，如果没找到，则在Windows系统目录查找，最后是在环境变量中列出的各个目录下查找。利用这个特点，先伪造一个系统同名的DLL，提供同样的输出表，每个输出函数转向真正的系统DLL。程序调用系统DLL时会先调用当前目录下伪造的DLL，完成相关功能后，再跳到系统DLL同名函数里执行。这个过程用个形象的词来描述就是系统DLL被劫持
（hijack）了。
示例DELPHI源码：
Library USP10;  
 
  uses 
 
  Windows,   
 
  SysUtils,   
 
  Classes;   
 
  {$R *.res} 
 
  ModHandle:  
  Cardinal 
  ;   
 
  POldLpkPresent:  
  Pointer 
  ;   
 
  POldScriptApplyDigitSubstitution:  
  Pointer 
  ;   
 
  POldScriptApplyLogicalWidth:  
  Pointer 
  ;   
 
  POldScriptBreak:  
  Pointer 
  ;   
 
  POldScriptCPtoX:  
  Pointer 
  ;   
 
  POldScriptCacheGetHeight:  
  Pointer 
  ;   
 
  POldScriptFreeCache:  
  Pointer 
  ;   
 
  POldScriptGetCMap:  
  Pointer 
  ;   
 
  POldScriptGetFontProperties:  
  Pointer 
  ;   
 
  POldScriptGetGlyphABCWidth:  
  Pointer 
  ;   
 
  POldScriptGetLogicalWidths:  
  Pointer 
  ;   
 
  POldScriptGetProperties:  
  Pointer 
  ;   
 
  POldScriptIsComplex:  
  Pointer 
  ;   
 
  POldScriptItemize:  
  Pointer 
  ;   
 
  POldScriptJustify:  
  Pointer 
  ;   
 
  POldScriptLayout:  
  Pointer 
  ;   
 
  POldScriptPlace:  
  Pointer 
  ;   
 
  POldScriptRecordDigitSubstitution:  
  Pointer 
  ;   
 
  POldScriptShape:  
  Pointer 
  ;   
 
  POldScriptStringAnalyse:  
  Pointer 
  ;   
 
  POldScriptStringCPtoX:  
  Pointer 
  ;   
 
  POldScriptStringFree:  
  Pointer 
  ;   
 
  POldScriptStringGetLogicalWidths:  
  Pointer 
  ;   
 
  POldScriptStringGetOrder:  
  Pointer 
  ;   
 
  POldScriptStringOut:  
  Pointer 
  ;   
 
  POldScriptStringValidate:  
  Pointer 
  ;   
 
  POldScriptStringXtoCP:  
  Pointer 
  ;   
 
  POldScriptString_pLogAttr:  
  Pointer 
  ;   
 
  POldScriptString_pSize:  
  Pointer 
  ;   
 
  POldScriptString_pcOutChars:  
  Pointer 
  ;   
 
  POldScriptTextOut:  
  Pointer 
  ;   
 
  POldScriptXtoCP:  
  Pointer 
  ;   
 
  POldUspAllocCache:  
  Pointer 
  ;   
 
  POldUspAllocTemp:  
  Pointer 
  ;   
 
  POldUspFreeMem:  
  Pointer 
  ;   
 
  procedure  
  LpkPresent;  
  asm  
  jmp POldLpkPresent  
  end 
  ;   
 
  procedure  
  ScriptApplyDigitSubstitution;  
  asm  
  jmp POldScriptApplyDigitSubstitution  
  end 
  ;   
 
  procedure  
  ScriptApplyLogicalWidth;  
  asm  
  jmp POldScriptApplyLogicalWidth  
  end 
  ;   
 
  procedure  
  ScriptBreak;  
  asm  
  jmp POldScriptBreak  
  end 
  ;   
 
  procedure  
  ScriptCPtoX;  
  asm  
  jmp POldScriptCPtoX  
  end 
  ;   
 
  procedure  
  ScriptCacheGetHeight;  
  asm  
  jmp POldScriptCacheGetHeight  
  end 
  ;   
 
  procedure  
  ScriptFreeCache;  
  asm  
  jmp POldScriptFreeCache  
  end 
  ;   
 
  procedure  
  ScriptGetCMap;  
  asm  
  jmp POldScriptGetCMap  
  end 
  ;   
 
  procedure  
  ScriptGetFontProperties;  
  asm  
  jmp POldScriptGetFontProperties  
  end 
  ;   
 
  procedure  
  ScriptGetGlyphABCWidth;  
  asm  
  jmp POldScriptGetGlyphABCWidth  
  end 
  ;   
 
  procedure  
  ScriptGetLogicalWidths;  
  asm  
  jmp POldScriptGetLogicalWidths  
  end 
  ;   
 
  procedure  
  ScriptGetProperties;  
  asm  
  jmp POldScriptGetProperties  
  end 
  ;   
 
  procedure  
  ScriptIsComplex;  
  asm  
  jmp POldScriptIsComplex  
  end 
  ;   
 
  procedure  
  ScriptItemize;  
  asm  
  jmp POldScriptItemize  
  end 
  ;   
 
  procedure  
  ScriptJustify;  
  asm  
  jmp POldScriptJustify  
  end 
  ;   
 
  procedure  
  ScriptLayout;  
  asm  
  jmp POldScriptLayout  
  end 
  ;   
 
  procedure  
  ScriptPlace;  
  asm  
  jmp POldScriptPlace  
  end 
  ;   
 
  procedure  
  ScriptRecordDigitSubstitution;  
  asm  
  jmp POldScriptRecordDigitSubstitution  
  end 
  ;   
 
  procedure  
  ScriptShape;  
  asm  
  jmp POldScriptShape  
  end 
  ;   
 
  procedure  
  ScriptStringAnalyse;  
  asm  
  jmp POldScriptStringAnalyse  
  end 
  ;   
 
  procedure  
  ScriptStringCPtoX;  
  asm  
  jmp POldScriptStringCPtoX  
  end 
  ;   
 
  procedure  
  ScriptStringFree;  
  asm  
  jmp POldScriptStringFree  
  end 
  ;   
 
  procedure  
  ScriptStringGetLogicalWidths;  
  asm  
  jmp POldScriptStringGetLogicalWidths  
  end 
  ;   
 
  procedure  
  ScriptStringGetOrder;  
  asm  
  jmp POldScriptStringGetOrder  
  end 
  ;   
 
  procedure  
  ScriptStringOut;  
  asm  
  jmp POldScriptStringOut  
  end 
  ;   
 
  procedure  
  ScriptStringValidate;  
  asm  
  jmp POldScriptStringValidate  
  end 
  ;   
 
  procedure  
  ScriptStringXtoCP;  
  asm  
  jmp POldScriptStringXtoCP  
  end 
  ;   
 
  procedure  
  ScriptString_pLogAttr;  
  asm  
  jmp POldScriptString_pLogAttr  
  end 
  ;   
 
  procedure  
  ScriptString_pSize;  
  asm  
  jmp POldScriptString_pSize  
  end 
  ;   
 
  procedure  
  ScriptString_pcOutChars;  
  asm  
  jmp POldScriptString_pcOutChars  
  end 
  ;   
 
  procedure  
  ScriptTextOut;  
  asm  
  jmp POldScriptTextOut  
  end 
  ;   
 
  procedure  
  ScriptXtoCP;  
  asm  
  jmp POldScriptXtoCP  
  end 
  ;   
 
  procedure  
  UspAllocCache;  
  asm  
  jmp POldUspAllocCache  
  end 
  ;   
 
  procedure  
  UspAllocTemp;  
  asm  
  jmp POldUspAllocTemp  
  end 
  ;   
 
  procedure  
  UspFreeMem;  
  asm  
  jmp POldUspFreeMem  
  end 
  ;   
 
  exports 
 
  LpkPresent,   
 
  ScriptApplyDigitSubstitution,   
 
  ScriptApplyLogicalWidth,   
 
  ScriptBreak,   
 
  ScriptCPtoX,   
 
  ScriptCacheGetHeight,   
 
  ScriptFreeCache,   
 
  ScriptGetCMap,   
 
  ScriptGetFontProperties,   
 
  ScriptGetGlyphABCWidth,   
 
  ScriptGetLogicalWidths,   
 
  ScriptGetProperties,   
 
  ScriptIsComplex,   
 
  ScriptItemize,   
 
  ScriptJustify,   
 
  ScriptLayout,   
 
  ScriptPlace,   
 
  ScriptRecordDigitSubstitution,   
 
  ScriptShape,   
 
  ScriptStringAnalyse,   
 
  ScriptStringCPtoX,   
 
  ScriptStringFree,   
 
  ScriptStringGetLogicalWidths,   
 
  ScriptStringGetOrder,   
 
  ScriptStringOut,   
 
  ScriptStringValidate,   
 
  ScriptStringXtoCP,   
 
  ScriptString_pLogAttr,   
 
  ScriptString_pSize,   
 
  ScriptString_pcOutChars,   
 
  ScriptTextOut,   
 
  ScriptXtoCP,   
 
  UspAllocCache,   
 
  UspAllocTemp,   
 
  UspFreeMem;   
 
  begin 
 
  ModHandle:= LoadLibrary( 
  'C:\WINDOWS\system32\usp10.dll' 
  );   
 
  if  
  ModHandle >  
  0  
  then 
 
  begin 
 
  POldLpkPresent:= GetProcAddress(ModHandle,  
  'LpkPresent' 
  );   
 
  POldScriptApplyDigitSubstitution:= GetProcAddress(ModHandle, 
  'ScriptApplyDigitSubstitution' 
  );   
 
  POldScriptApplyLogicalWidth:= GetProcAddress(ModHandle, 
  'ScriptApplyLogicalWidth' 
  );   
 
  POldScriptBreak:= GetProcAddress(ModHandle,  
  'ScriptBreak' 
  );   
 
  POldScriptCPtoX:= GetProcAddress(ModHandle,  
  'ScriptCPtoX' 
  );   
 
  POldScriptCacheGetHeight:= GetProcAddress(ModHandle,  
  'ScriptCacheGetHeight' 
  );   
 
  POldScriptFreeCache:= GetProcAddress(ModHandle,  
  'ScriptFreeCache' 
  );   
 
  POldScriptGetCMap:= GetProcAddress(ModHandle,  
  'ScriptGetCMap' 
  );   
 
  POldScriptGetFontProperties:= GetProcAddress(ModHandle, 
  'ScriptGetFontProperties' 
  );   
 
  POldScriptGetGlyphABCWidth:= GetProcAddress(ModHandle,  
  'ScriptGetGlyphABCWidth' 
  );   
 
  POldScriptGetLogicalWidths:= GetProcAddress(ModHandle,  
  'ScriptGetLogicalWidths' 
  );   
 
  POldScriptGetProperties:= GetProcAddress(ModHandle,  
  'ScriptGetProperties' 
  );   
 
  POldScriptIsComplex:= GetProcAddress(ModHandle,  
  'ScriptIsComplex' 
  );   
 
  POldScriptItemize:= GetProcAddress(ModHandle,  
  'ScriptItemize' 
  );   
 
  POldScriptJustify:= GetProcAddress(ModHandle,  
  'ScriptJustify' 
  );   
 
  POldScriptLayout:= GetProcAddress(ModHandle,  
  'ScriptLayout' 
  );   
 
  POldScriptPlace:= GetProcAddress(ModHandle,  
  'ScriptPlace' 
  );   
 
  POldScriptRecordDigitSubstitution:= GetProcAddress(ModHandle, 
  'ScriptRecordDigitSubstitution' 
  );   
 
  POldScriptShape:= GetProcAddress(ModHandle,  
  'ScriptShape' 
  );   
 
  POldScriptStringAnalyse:= GetProcAddress(ModHandle,  
  'ScriptStringAnalyse' 
  );   
 
  POldScriptStringCPtoX:= GetProcAddress(ModHandle,  
  'ScriptStringCPtoX' 
  );   
 
  POldScriptStringFree:= GetProcAddress(ModHandle,  
  'ScriptStringFree' 
  );   
 
  POldScriptStringGetLogicalWidths:= GetProcAddress(ModHandle, 
  'ScriptStringGetLogicalWidths' 
  );   
 
  POldScriptStringGetOrder:= GetProcAddress(ModHandle,  
  'ScriptStringGetOrder' 
  );   
 
  POldScriptStringOut:= GetProcAddress(ModHandle,  
  'ScriptStringOut' 
  );   
 
  POldScriptStringValidate:= GetProcAddress(ModHandle,  
  'ScriptStringValidate' 
  );   
 
  POldScriptStringXtoCP:= GetProcAddress(ModHandle,  
  'ScriptStringXtoCP' 
  );   
 
  POldScriptString_pLogAttr:= GetProcAddress(ModHandle,  
  'ScriptString_pLogAttr' 
  );   
 
  POldScriptString_pSize:= GetProcAddress(ModHandle,  
  'ScriptString_pSize' 
  );   
 
  POldScriptString_pcOutChars:= GetProcAddress(ModHandle, 
  'ScriptString_pcOutChars' 
  );   
 
  POldScriptTextOut:= GetProcAddress(ModHandle,  
  'ScriptTextOut' 
  );   
 
  POldScriptXtoCP:= GetProcAddress(ModHandle,  
  'ScriptXtoCP' 
  );   
 
  POldUspAllocCache:= GetProcAddress(ModHandle,  
  'UspAllocCache' 
  );   
 
  POldUspAllocTemp:= GetProcAddress(ModHandle,  
  'UspAllocTemp' 
  );   
 
  POldUspFreeMem:= GetProcAddress(ModHandle,  
  'UspFreeMem' 
  );   
 
  end 
  ;   
 
  begin 
 
  //添加自己的补丁内容！ 
 
  end 
  ;   
 
  end 
  .