DebugInject(dll)

標籤：data   char s   poi   檔案   load   lib   char   ado   log   

原理：
用到調試器附加的原理實現注入。

    bRet = CreateProcess(NULL,        m_strExePath.GetBuffer(0),        NULL,        NULL,        FALSE,        DEBUG_ONLY_THIS_PROCESS,        NULL,        NULL,        &si,        &pi);

// DebugInject.h

#pragma once#include "afxwin.h"// DebugInject 對話方塊class DebugInject : public CDialogEx{    DECLARE_DYNAMIC(DebugInject)public:    DebugInject(CWnd* pParent = NULL);   // 標準建構函式    virtual ~DebugInject();// 對話方塊資料    enum { IDD = IDD_DIALOG4 };protected:    virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV 支援    DECLARE_MESSAGE_MAP()public:    CString m_strExePath;    CString m_strDllPath;    afx_msg void OnBnClickedInject();    afx_msg void OnBnClickedButton4();    afx_msg void OnBnClickedButton3();};

// DebugInject.cpp

// DebugInject.cpp : 實現檔案//#include "stdafx.h"#include "MyInjectTool.h"#include "DebugInject.h"#include "afxdialogex.h"//結構必須位元組對齊!  #pragma pack(1)  typedef struct _INJECT_CODE{    BYTE  byMOV_EAX;          //mov eax, addr szDllpath    DWORD dwMOV_EAX_VALUE;    BYTE  byPUSH_EAX;         //push eax    BYTE  byMOV_ECX;          //mov ecx, LoadLibrary    DWORD dwMOV_ECX_VALUE;    WORD  wCALL_ECX;          //call ecx    BYTE  byINT3;             //int 3    CHAR  szDllPath[MAX_PATH];}INJECT_CODE, *PINJECT_CODE;#pragma pack()// DebugInject 對話方塊IMPLEMENT_DYNAMIC(DebugInject, CDialogEx)DebugInject::DebugInject(CWnd* pParent /*=NULL*/)    : CDialogEx(DebugInject::IDD, pParent)    , m_strExePath(_T(""))    , m_strDllPath(_T("")){}DebugInject::~DebugInject(){}void DebugInject::DoDataExchange(CDataExchange* pDX){    CDialogEx::DoDataExchange(pDX);    DDX_Text(pDX, IDC_EDIT1, m_strExePath);    DDX_Text(pDX, IDC_EDIT2, m_strDllPath);}BEGIN_MESSAGE_MAP(DebugInject, CDialogEx)    ON_BN_CLICKED(IDC_INJECT, &DebugInject::OnBnClickedInject)    ON_BN_CLICKED(IDC_BUTTON4, &DebugInject::OnBnClickedButton4)    ON_BN_CLICKED(IDC_BUTTON3, &DebugInject::OnBnClickedButton3)END_MESSAGE_MAP()// DebugInject 訊息處理常式void DebugInject::OnBnClickedInject(){    // TODO:  在此添加控制項通知處理常式代碼    BOOL bRet;    DWORD dwProcessId = 0;    LPVOID lpBaseAddress = NULL;    HANDLE hThread = NULL;    HANDLE hProcess = NULL;    DEBUG_EVENT dbgEvent = { 0 };    CONTEXT ctxOld = { CONTEXT_FULL };    CONTEXT ctxNew = { CONTEXT_FULL };    INJECT_CODE ic = { 0 };    STARTUPINFO si = { sizeof(si) };    PROCESS_INFORMATION pi = { 0 };    HMODULE hDll = NULL;    BOOL bIsSystemBp = TRUE;    DWORD dwOldEip = 0;    bRet = CreateProcess(NULL,        m_strExePath.GetBuffer(0),        NULL,        NULL,        FALSE,        DEBUG_ONLY_THIS_PROCESS,        NULL,        NULL,        &si,        &pi);    if (!bRet)    {        MessageBox("CreateProcess 失敗");        return;    }    //防止被調試進程和調試器一起關閉    bRet = DebugSetProcessKillOnExit(FALSE);    while (WaitForDebugEvent(&dbgEvent, INFINITE))    {        switch (dbgEvent.dwDebugEventCode)        {        case CREATE_PROCESS_DEBUG_EVENT:            hProcess = dbgEvent.u.CreateProcessInfo.hProcess;            hThread = dbgEvent.u.CreateProcessInfo.hThread;            //分配記憶體,填充注入指令              lpBaseAddress = VirtualAllocEx(hProcess,                NULL,                sizeof(INJECT_CODE),                MEM_COMMIT | MEM_RESERVE,                PAGE_EXECUTE_READWRITE);            if (NULL == lpBaseAddress)            {                MessageBox("VirtualAllocEx 失敗");                return;            }            //給ShellCode結構體賦值            ic.byMOV_EAX = 0xB8;            ic.dwMOV_EAX_VALUE = (DWORD)lpBaseAddress + offsetof(INJECT_CODE, szDllPath);            ic.byPUSH_EAX = 0x50;            ic.byMOV_ECX = 0xB9;            ic.dwMOV_ECX_VALUE = (DWORD)&LoadLibrary;            ic.wCALL_ECX = 0xD1FF;            ic.byINT3 = 0xCC;            memcpy(ic.szDllPath, m_strDllPath.GetBuffer(0), m_strDllPath.GetLength());            //寫入ShellCode            bRet = WriteProcessMemory(hProcess, lpBaseAddress, &ic, sizeof(ic), NULL);            if (!bRet)            {                MessageBox("WriteProcessMemory 失敗");                return;            }            //擷取當前線程上下文            bRet = GetThreadContext(hThread, &ctxOld);            if (!bRet)            {                MessageBox("GetThreadContext 失敗");                return;            }            ctxNew = ctxOld;#ifdef _WIN64            ctxNew.Rip = (DWORD)lpBaseAddress;            dwOldEip = ctxNew.Rip;#else             ctxNew.Eip = (DWORD)lpBaseAddress;            dwOldEip = ctxNew.Eip;#endif            bRet = SetThreadContext(hThread, &ctxNew);            if (!bRet)            {                MessageBox("SetThreadContext 失敗");                return;            }            break;        case EXCEPTION_DEBUG_EVENT:            if (dbgEvent.u.Exception.ExceptionRecord.ExceptionCode == EXCEPTION_BREAKPOINT)            {                //屏蔽掉系統斷點                if (bIsSystemBp)                {                    bIsSystemBp = FALSE;                    break;                }                //釋放記憶體                bRet = VirtualFreeEx(hProcess,                    lpBaseAddress,                    0,                    MEM_RELEASE                    );                if (!bRet)                {                    MessageBox("VirtualFreeEx 失敗");                    return;                }                //恢複到程式建立時的EIP                bRet = SetThreadContext(hThread, &ctxOld);                if (!bRet)                {                    MessageBox("SetThreadContext 失敗");                    return;                }                bRet = ContinueDebugEvent(dbgEvent.dwProcessId, dbgEvent.dwThreadId, DBG_CONTINUE);                if (!bRet)                {                    MessageBox("ContinueDebugEvent 失敗!!");                    return;                }                //退出本進程，讓被偵錯工具跑起來                //ExitProcess(0);                return;            }            break;        }        bRet = ContinueDebugEvent(dbgEvent.dwProcessId, dbgEvent.dwThreadId, DBG_EXCEPTION_NOT_HANDLED);        if (!bRet)        {            MessageBox("ContinueDebugEvent 失敗!!");            return;        }    }}void DebugInject::OnBnClickedButton4(){    // TODO:  在此添加控制項通知處理常式代碼    char szFilter[] = "動態連結程式庫|*.dll";    CFileDialog fileDlg(TRUE, "dll", NULL, OFN_HIDEREADONLY | OFN_OVERWRITEPROMPT, szFilter);    UpdateData(TRUE);    if (fileDlg.DoModal() == IDOK)    {        m_strDllPath = fileDlg.GetPathName();    }    UpdateData(FALSE);}void DebugInject::OnBnClickedButton3(){    // TODO:  在此添加控制項通知處理常式代碼    char szFilter[] = "可執行程式|*.exe";    CFileDialog fileDlg(TRUE, "exe", NULL, OFN_HIDEREADONLY | OFN_OVERWRITEPROMPT, szFilter);    UpdateData(TRUE);    if (fileDlg.DoModal() == IDOK)    {        m_strExePath = fileDlg.GetPathName();    }    UpdateData(FALSE);}

DebugInject(dll)