Frage zu c++ (dll injection)

Tyrar · 09/20/2010, 19:25

Quote:

Originally Posted by Nulpe123

Wie würde dafür denn ein Implementierungsbeispiel aussehen? Google will mir da nichts nützliches ausspucken...

Code:

#include <windows.h> 
#include <tlhelp32.h> 
#include <shlwapi.h> 

#define PROC_NAME "target.exe" 
#define DLL_NAME "injected.dll" 

unsigned long GetTargetProcessIdFromProcname(char *procName); 
unsigned long GetTargetThreadIdFromProcname(char *procName); 

__declspec(naked) loadDll(void) 
{ 
   _asm{ 
      push 0xDEADBEEF 

      pushfd 
      pushad 

      push 0xDEADBEEF 
      mov eax, 0xDEADBEEF 

      call eax 

      popad 
      popfd 
       
      ret 
   } 
} 

__declspec(naked) loadDll_end(void) 
{ 
} 

int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow) 
{ 
   void *dllString; 
   void *stub; 
   unsigned long wowID, threadID, stubLen, oldIP, oldprot, loadLibAddy; 
    HANDLE hProcess, hThread; 
   CONTEXT ctx; 
    
   stubLen = (unsigned long)loadDll_end - (unsigned long)loadDll; 
    
   loadLibAddy = (unsigned long)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"); 

   wowID    = GetTargetProcessIdFromProcname(PROC_NAME); 
   hProcess = OpenProcess((PROCESS_VM_WRITE | PROCESS_VM_OPERATION), false, wowID); 

   dllString = VirtualAllocEx(hProcess, NULL, (strlen(DLL_NAME) + 1), MEM_COMMIT, PAGE_READWRITE); 
   stub      = VirtualAllocEx(hProcess, NULL, stubLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE); 
   WriteProcessMemory(hProcess, dllString, DLL_NAME, strlen(DLL_NAME), NULL); 
    
   threadID = GetTargetThreadIdFromProcname(PROC_NAME); 
   hThread   = OpenThread((THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME), false, threadID); 
   SuspendThread(hThread); 

   ctx.ContextFlags = CONTEXT_CONTROL; 
   GetThreadContext(hThread, &ctx); 
   oldIP   = ctx.Eip; 
   ctx.Eip = (DWORD)stub; 
   ctx.ContextFlags = CONTEXT_CONTROL; 

   VirtualProtect(loadDll, stubLen, PAGE_EXECUTE_READWRITE, &oldprot); 
   memcpy((void *)((unsigned long)loadDll + 1), &oldIP, 4); 
   memcpy((void *)((unsigned long)loadDll + 8), &dllString, 4); 
   memcpy((void *)((unsigned long)loadDll + 13), &loadLibAddy, 4); 

    WriteProcessMemory(hProcess, stub, loadDll, stubLen, NULL); 
   SetThreadContext(hThread, &ctx); 

   ResumeThread(hThread); 

   Sleep(8000); 

   VirtualFreeEx(hProcess, dllString, strlen(DLL_NAME), MEM_DECOMMIT); 
   VirtualFreeEx(hProcess, stub, stubLen, MEM_DECOMMIT); 
   CloseHandle(hProcess); 
   CloseHandle(hThread); 

    return 0; 
} 


unsigned long GetTargetProcessIdFromProcname(char *procName) 
{ 
   PROCESSENTRY32 pe; 
   HANDLE thSnapshot; 
   BOOL retval, ProcFound = false; 

   thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 

   if(thSnapshot == INVALID_HANDLE_VALUE) 
   { 
      MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL); 
      return false; 
   } 

   pe.dwSize = sizeof(PROCESSENTRY32); 

    retval = Process32First(thSnapshot, &pe); 

   while(retval) 
   { 
      if(StrStrI(pe.szExeFile, procName) ) 
      { 
         ProcFound = true; 
         break; 
      } 

      retval    = Process32Next(thSnapshot,&pe); 
      pe.dwSize = sizeof(PROCESSENTRY32); 
   } 

   CloseHandle(thSnapshot); 
   return pe.th32ProcessID; 
} 

unsigned long GetTargetThreadIdFromProcname(char *procName) 
{ 
   PROCESSENTRY32 pe; 
   HANDLE thSnapshot, hProcess; 
   BOOL retval, ProcFound = false; 
   unsigned long pTID, threadID; 

   thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 

   if(thSnapshot == INVALID_HANDLE_VALUE) 
   { 
      MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL); 
      return false; 
   } 

   pe.dwSize = sizeof(PROCESSENTRY32); 

    retval = Process32First(thSnapshot, &pe); 

   while(retval) 
   { 
      if(StrStrI(pe.szExeFile, procName) ) 
      { 
         ProcFound = true; 
         break; 
      } 

      retval    = Process32Next(thSnapshot,&pe); 
      pe.dwSize = sizeof(PROCESSENTRY32); 
   } 

   CloseHandle(thSnapshot); 
    
   _asm { 
      mov eax, fs:[0x18] 
      add eax, 36 
      mov [pTID], eax 
   } 

   hProcess = OpenProcess(PROCESS_VM_READ, false, pe.th32ProcessID); 
   ReadProcessMemory(hProcess, (const void *)pTID, &threadID, 4, NULL); 
   CloseHandle(hProcess); 

   return threadID; 
}

Nulpe123 · 09/20/2010, 21:09

Quote:

Originally Posted by HeavyHacker

Code:

#include <windows.h> 
#include <tlhelp32.h> 
#include <shlwapi.h> 

#define PROC_NAME "target.exe" 
#define DLL_NAME "injected.dll" 

unsigned long GetTargetProcessIdFromProcname(char *procName); 
unsigned long GetTargetThreadIdFromProcname(char *procName); 

__declspec(naked) loadDll(void) 
{ 
   _asm{ 
      push 0xDEADBEEF 

      pushfd 
      pushad 

      push 0xDEADBEEF 
      mov eax, 0xDEADBEEF 

      call eax 

      popad 
      popfd 
       
      ret 
   } 
} 

__declspec(naked) loadDll_end(void) 
{ 
} 

int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow) 
{ 
   void *dllString; 
   void *stub; 
   unsigned long wowID, threadID, stubLen, oldIP, oldprot, loadLibAddy; 
    HANDLE hProcess, hThread; 
   CONTEXT ctx; 
    
   stubLen = (unsigned long)loadDll_end - (unsigned long)loadDll; 
    
   loadLibAddy = (unsigned long)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"); 

   wowID    = GetTargetProcessIdFromProcname(PROC_NAME); 
   hProcess = OpenProcess((PROCESS_VM_WRITE | PROCESS_VM_OPERATION), false, wowID); 

   dllString = VirtualAllocEx(hProcess, NULL, (strlen(DLL_NAME) + 1), MEM_COMMIT, PAGE_READWRITE); 
   stub      = VirtualAllocEx(hProcess, NULL, stubLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE); 
   WriteProcessMemory(hProcess, dllString, DLL_NAME, strlen(DLL_NAME), NULL); 
    
   threadID = GetTargetThreadIdFromProcname(PROC_NAME); 
   hThread   = OpenThread((THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME), false, threadID); 
   SuspendThread(hThread); 

   ctx.ContextFlags = CONTEXT_CONTROL; 
   GetThreadContext(hThread, &ctx); 
   oldIP   = ctx.Eip; 
   ctx.Eip = (DWORD)stub; 
   ctx.ContextFlags = CONTEXT_CONTROL; 

   VirtualProtect(loadDll, stubLen, PAGE_EXECUTE_READWRITE, &oldprot); 
   memcpy((void *)((unsigned long)loadDll + 1), &oldIP, 4); 
   memcpy((void *)((unsigned long)loadDll + 8), &dllString, 4); 
   memcpy((void *)((unsigned long)loadDll + 13), &loadLibAddy, 4); 

    WriteProcessMemory(hProcess, stub, loadDll, stubLen, NULL); 
   SetThreadContext(hThread, &ctx); 

   ResumeThread(hThread); 

   Sleep(8000); 

   VirtualFreeEx(hProcess, dllString, strlen(DLL_NAME), MEM_DECOMMIT); 
   VirtualFreeEx(hProcess, stub, stubLen, MEM_DECOMMIT); 
   CloseHandle(hProcess); 
   CloseHandle(hThread); 

    return 0; 
} 


unsigned long GetTargetProcessIdFromProcname(char *procName) 
{ 
   PROCESSENTRY32 pe; 
   HANDLE thSnapshot; 
   BOOL retval, ProcFound = false; 

   thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 

   if(thSnapshot == INVALID_HANDLE_VALUE) 
   { 
      MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL); 
      return false; 
   } 

   pe.dwSize = sizeof(PROCESSENTRY32); 

    retval = Process32First(thSnapshot, &pe); 

   while(retval) 
   { 
      if(StrStrI(pe.szExeFile, procName) ) 
      { 
         ProcFound = true; 
         break; 
      } 

      retval    = Process32Next(thSnapshot,&pe); 
      pe.dwSize = sizeof(PROCESSENTRY32); 
   } 

   CloseHandle(thSnapshot); 
   return pe.th32ProcessID; 
} 

unsigned long GetTargetThreadIdFromProcname(char *procName) 
{ 
   PROCESSENTRY32 pe; 
   HANDLE thSnapshot, hProcess; 
   BOOL retval, ProcFound = false; 
   unsigned long pTID, threadID; 

   thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 

   if(thSnapshot == INVALID_HANDLE_VALUE) 
   { 
      MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL); 
      return false; 
   } 

   pe.dwSize = sizeof(PROCESSENTRY32); 

    retval = Process32First(thSnapshot, &pe); 

   while(retval) 
   { 
      if(StrStrI(pe.szExeFile, procName) ) 
      { 
         ProcFound = true; 
         break; 
      } 

      retval    = Process32Next(thSnapshot,&pe); 
      pe.dwSize = sizeof(PROCESSENTRY32); 
   } 

   CloseHandle(thSnapshot); 
    
   _asm { 
      mov eax, fs:[0x18] 
      add eax, 36 
      mov [pTID], eax 
   } 

   hProcess = OpenProcess(PROCESS_VM_READ, false, pe.th32ProcessID); 
   ReadProcessMemory(hProcess, (const void *)pTID, &threadID, 4, NULL); 
   CloseHandle(hProcess); 

   return threadID; 
}

Injected das nicht die DLL also erstellt einen Thread in einem fremden Prozess? Ich hab die ja schon drin und möchte innerhalb des injizierten Prozess einen neuen Thread erzeugen.