进程注入问题

2008-10-08 09:15:50 152 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

把dll模块注入到游戏进程的方法＜a＞ DLL注入技术: 是将一个Dll文件强行加载到目标进程中，比如把外挂dll模块注入到游戏进程，这样做的目的在于方便我们通过这个DLL读写目标进程指令或内存数据，（例如 HOOK游戏函数过程或篡改游戏内存数据实现外挂功能），或以被注入进程的身份去执行一些操作等。全系统注入的优点：利用系统机制实现的全系统进程注入，可绕过比如游戏进程自身的防注入保护机制。比如远线程注入游戏可能会被拦截，但输入法注入，游戏很难拦截。阅读详情

网上找代码，东拼西凑

BOOL CinjectthreadDlg::RemoteLoadDLL(DWORD dwProcessID,   LPCSTR lpszDll)

{



	// 打开目标进程

    HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessID );

    // 向目标进程地址空间写入DLL名称

    DWORD dwSize, dwWritten;

    dwSize = lstrlenA( lpszDll ) + 1;

    LPVOID lpBuf = VirtualAllocEx( hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );

    if ( NULL == lpBuf )

    {

        CloseHandle( hProcess );

        return FALSE;

    }

    if ( WriteProcessMemory( hProcess, lpBuf, (LPVOID)lpszDll, dwSize, &dwWritten ) )

    {

        // 要写入字节数与实际写入字节数不相等，仍属失败

        if ( dwWritten != dwSize )

        {

            VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );

            CloseHandle( hProcess );

            return FALSE;

        }

    }

    else

    {

        CloseHandle( hProcess );

        return FALSE;

    }

    // 使目标进程调用LoadLibrary，加载DLL

    DWORD dwID;   

	PTHREAD_START_ROUTINE pFunc=(PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("kernel32"),"LoadLibraryA");



    HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0, pFunc, lpBuf, 0, &dwID );

    // 等待LoadLibrary加载完毕

    WaitForSingleObject( hThread, INFINITE );

    // 释放目标进程中申请的空间

    VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );

    CloseHandle( hThread );

    CloseHandle( hProcess );

    return TRUE;

}

void CinjectthreadDlg::GetProcDirectory(char *Path)

{

	CString szPath;

	char szExePath[MAX_PATH] = {0};

	GetModuleFileName(NULL, szExePath, MAX_PATH);

	szPath.Format("%s",szExePath);

	int iPos = szPath.ReverseFind('\\');

	memcpy(Path, szPath, 26);

}

char szPath[MAX_PATH] = {0};
GetProcDirectory(szPath);
CString path;
path.Format("%s", szPath);
path += "\\DLL.dll";

杀毒软件，安全工具全关了，操作系统win2003 sp1
RemoteLoadDLL(pid , path)调用中有中文 debug注入成功，release注入失败
RemoteLoadDLL(pid , "F:\\DLL.dll") 调用debug release均成功

请高人是不是与路径中文字符有关，如何修改

----------------------------------------------------------------
卸载DLL 注释部分是为了兼容不同操作系统,实际上无法卸载DLL

BOOL CinjectthreadDlg::RemoteFreeDLL(DWORD dwProcessID,  LPCSTR lpszDll)

{



	 // 打开目标进程

    HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessID );

    // 向目标进程地址空间写入DLL名称

    DWORD dwSize, dwWritten;

    dwSize = lstrlenA( lpszDll ) + 1;

    LPVOID lpBuf = VirtualAllocEx( hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );

    if ( NULL == lpBuf )

    {

        CloseHandle( hProcess );

        return FALSE;

    }

    if ( WriteProcessMemory( hProcess, lpBuf, (LPVOID)lpszDll, dwSize, &dwWritten ) )

    {

        // 要写入字节数与实际写入字节数不相等，仍属失败

        if ( dwWritten != dwSize )

        {

            VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );

            CloseHandle( hProcess );

            return FALSE;

        }

    }

    else

    {

        CloseHandle( hProcess );

        return FALSE;

    }

    // 使目标进程调用GetModuleHandle，获得DLL在目标进程中的句柄

    DWORD dwHandle, dwID;

    LPVOID pFunc = GetModuleHandleA;

    HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, lpBuf, 0, &dwID );

    // 等待GetModuleHandle运行完毕

    WaitForSingleObject( hThread, INFINITE );

    // 获得GetModuleHandle的返回值

    GetExitCodeThread( hThread, &dwHandle );

    // 释放目标进程中申请的空间

    VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );

    CloseHandle( hThread );

    // 使目标进程调用FreeLibrary，卸载DLL

    pFunc = FreeLibrary;

    hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, (LPVOID)dwHandle, 0, &dwID );

    // 等待FreeLibrary卸载完毕

    WaitForSingleObject( hThread, INFINITE );

    CloseHandle( hThread );

    CloseHandle( hProcess );

    return TRUE;





 //   // 打开目标进程

 //   HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessID );

 //   // 向目标进程地址空间写入DLL名称



 //   DWORD dwSize, dwWritten;

 //   dwSize = lstrlenA( lpszDll ) + 1;

 //   LPVOID lpBuf = VirtualAllocEx( hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );

 //   if ( NULL == lpBuf )

 //   {

 //       CloseHandle( hProcess );

 //       return FALSE;

 //   }

 //   if ( WriteProcessMemory( hProcess, lpBuf, (LPVOID)lpszDll, dwSize, &dwWritten ) )

 //   {

 //       // 要写入字节数与实际写入字节数不相等，仍属失败

 //       if ( dwWritten != dwSize )

 //       {

 //           VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );

 //           CloseHandle( hProcess );

 //           return FALSE;

 //       }

 //   }

 //   else

 //   {

 //       CloseHandle( hProcess );

 //       return FALSE;

 //   }

 //   // 使目标进程调用GetModuleHandle，获得DLL在目标进程中的句柄

 //   DWORD dwHandle, dwID;

 //   PTHREAD_START_ROUTINE pFunc = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("kernel32"),"GetModuleHandleA");

 //   HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0, pFunc, lpBuf, 0, &dwID );



 //   // 等待GetModuleHandle运行完毕

 //   WaitForSingleObject( hThread, INFINITE );

 //   // 获得GetModuleHandle的返回值

 //   GetExitCodeThread( hThread, &dwHandle );

 //   // 释放目标进程中申请的空间

 //   VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );

 //   CloseHandle( hThread );

 //   // 使目标进程调用FreeLibrary，卸载DLL

 //   

	//pFunc=(PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("kernel32"),"LoadLibraryA");



 //   hThread = CreateRemoteThread( hProcess, NULL, 0, pFunc, (LPVOID)dwHandle, 0, &dwID );

 //   // 等待FreeLibrary卸载完毕

 //   WaitForSingleObject( hThread, INFINITE );

 //   CloseHandle( hThread );

 //   CloseHandle( hProcess );

 //   return TRUE;

}