csrss.exe进程用CretateRemoteThread无法注入DLL

[zwfgdlc]

如题,已经提升至DEBUG权限了.
winlogon.exe可以注入.
这个进程又没窗口,SetWindowsHookEx没法试.
有人试过吗?

[oyljerry]

系统进程可能自身有保护.同时是否有杀毒软件拦截

[zwfgdlc]

加了Messagebox()

发现是WriteProcessMemory失败了.

WriteProcessMemory返回5,拒绝访问,
问题是OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
能返回句柄.
VirtualAllocEx()也没提示出错.
怎么回事

[zwfgdlc]

[e-mail]
谢谢了.

[Lactoferrin]

这个进程有窗口，程序没响应时的结束任务或等待的窗口就是它的。
把你的代码弄上来

[日落]

不懂，看看！！！

[zwfgdlc]

#include <windows.h>
#include <process.h> 
#include <tchar.h>
#include <stdio.h>
#include <shlwapi.h>

#pragma comment(lib, "shlwapi.lib")

TCHAR ModuleFile[MAX_PATH];
FILE* fp;
TCHAR szText[128] = {0};
TCHAR szClass[64] = {0};
WNDPROC OldWindowProc;
HWND hWinLogon;
HMODULE hDll;

BOOL CALLBACK lpEnumWindowsProc(HWND hwnd, LPARAM lParam)
{
	if (IsWindow(hwnd))
	{
		::GetWindowText(hwnd, szText, _countof(szText));
		::GetClassName(hwnd, szClass, _countof(szClass));
		_ftprintf_s(fp, TEXT("%s\t\t%s\n"), szText, szClass);
		if (!_tcscmp(szText, TEXT("SAS window")))
		{
			hWinLogon = hwnd;
			//OldWindowProc = (WNDPROC)::SetWindowLongPtr(hwnd, GWL_WNDPROC, (LONG)NewWindowProc);
			//SendMessage(hwnd, WM_HOTKEY, 123456, NULL);
			return 0;
		}
	}
	return TRUE;
}

void ThreadFunc(void *Arg)
{
	_tfopen_s(&fp, TEXT("d:\\window.txt"), TEXT("wt,ccs=unicode"));
	HDESK hWinLogon = OpenDesktop(TEXT("Winlogon"), 0, FALSE, GENERIC_ALL);
	::EnumDesktopWindows(hWinLogon, lpEnumWindowsProc, NULL);
	CloseDesktop(hWinLogon);
	fclose(fp);
}

BOOL WINAPI DllMain(HINSTANCE hDllHandle, DWORD nReason, LPVOID Reserved)
{
	switch ( nReason )
	{
	case DLL_PROCESS_ATTACH:
		hDll = hDllHandle;
		GetModuleFileName(NULL, ModuleFile, _countof(ModuleFile));
		EnablePrivileges();

		if (StrStrI(ModuleFile, TEXT("winlogon.exe")))
		{
			_beginthread(ThreadFunc, 0, 0);
		}
		else if (StrStrI(ModuleFile, TEXT("Rundll32.exe")))
		{
			DWORD dwProcessId = 496;
			HANDLE hProcess = 0;  

			if (dwProcessId)
			{
				hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
			}
			if (!hProcess)
			{
				MessageBox(NULL, TEXT("进程句柄无效"), TEXT("进程句柄无效"), MB_ICONWARNING);
				return 0;
			}

			LPVOID Param = VirtualAllocEx(hProcess, 0, 256, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
			if (!Param)
			{
				MessageBox(NULL, TEXT("申请内存失败"), TEXT("申请内存失败"), MB_ICONWARNING);
				return 0;
			}

			GetModuleFileName(hDllHandle, ModuleFile, _countof(ModuleFile));

			if (!WriteProcessMemory(hProcess, Param, (LPVOID)ModuleFile, 256, NULL))
			{
				TCHAR sztmp[1024];
				_stprintf_s(sztmp, _countof(sztmp), TEXT("写入内存失败, 错误代码:%d, dll=%s"), GetLastError(), ModuleFile);

				MessageBox(NULL, sztmp, TEXT("写入内存失败"), MB_ICONWARNING);
				return 0;
			}
			HANDLE hThread = CreateRemoteThread(hProcess, 
				NULL, 
				NULL, 
				(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryW"),
				Param, 
				NULL, 
				NULL);

			if (hThread)
			{
				WaitForSingleObject(hThread, INFINITE);
			}
			else
			{
				TCHAR sztmp[1024];
				_stprintf_s(sztmp, _countof(sztmp), TEXT("创建远程线程失败, 错误代码:%d, dll=%s"), GetLastError(), ModuleFile);
				MessageBox(NULL, sztmp, TEXT("创建远程线程失败"), MB_ICONWARNING);
				return 0;				
			}
			VirtualFreeEx(hProcess, Param , 0, MEM_RELEASE);
			CloseHandle(hThread);
			CloseHandle(hProcess);
		}
		break;
	case DLL_THREAD_ATTACH:
		break;
	case DLL_THREAD_DETACH:
		break;
	case DLL_PROCESS_DETACH:
		//::SetWindowLongPtr(hWinLogon, GWL_WNDPROC, (LONG)OldWindowProc);
		break;
	default:
		break;
	}

	return 1;
}

EXTERN_C __declspec(dllexport) int Hook(void)
{
	return 1;
}

我是直接运行rundll32 "D:\My Documents\Visual Studio 2008\Projects\UnregisterSystemHotKey\Release\UnregisterSystemHotKey.dll",Hook注入DLL,没有另外写个DLL注入工具.

[Lactoferrin]

什么windows

[Lactoferrin]

你现在是注入哪个进程不成功

[zwfgdlc]

除了csrss.exe,其他进程都能成功

[zwfgdlc]

XPsp3

[Lactoferrin]

这个可用，link.exe参数中加一个/export:InjectCsrssW

#include<windows.h>
int __stdcall DllMain(HINSTANCE ImageBase,DWORD Reason,DWORD EventType)
{
	if(Reason==DLL_PROCESS_ATTACH)
	{
		static char Text[256]="ProcessId:";
		_itoa(GetCurrentProcessId(),Text+10,10);
		OutputDebugStringA(Text);
	}
	return 1;
}
typedef ULONG(__stdcall*PRtlAdjustPrivilege)(ULONG Privilege,int Enable,int CurrentThread,int*Enabled);
typedef DWORD(__stdcall*PCsrGetProcessId)(void);
void __stdcall InjectCsrssW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow)
{
int b;PRtlAdjustPrivilege pRtlAdjustPrivilege;PCsrGetProcessId pCsrGetProcessId;HANDLE ProcessHandle;
HMODULE ntdll=GetModuleHandleW(L"ntdll.dll");
pRtlAdjustPrivilege=(PRtlAdjustPrivilege)GetProcAddress(ntdll,"RtlAdjustPrivilege");
pRtlAdjustPrivilege(20,1,0,&b);
pCsrGetProcessId=(PCsrGetProcessId)GetProcAddress(ntdll,"CsrGetProcessId");
ProcessHandle=OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,0,pCsrGetProcessId());
if(ProcessHandle)
{
	wchar_t FileName[260];void*Buffer;MEMORY_BASIC_INFORMATION mbi;
	VirtualQueryEx((HANDLE)-1,InjectCsrssW,&mbi,sizeof mbi);
	GetModuleFileNameW((HINSTANCE)mbi.AllocationBase,FileName,260);
	Buffer=VirtualAllocEx(ProcessHandle,0,260,MEM_RESERVE|MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	if(Buffer)
	{
		if(WriteProcessMemory(ProcessHandle,Buffer,FileName,260,0))
		{
			HANDLE ThreadHandle;
			ThreadHandle=CreateRemoteThread(ProcessHandle,0,0,(LPTHREAD_START_ROUTINE)LoadLibraryW,Buffer,0,0);
			if(ThreadHandle)
			{
				WaitForSingleObject(ThreadHandle,INFINITE);
				CloseHandle(ThreadHandle);
			}
		}
		VirtualFreeEx(ProcessHandle,Buffer,0,MEM_RELEASE);
	}
	CloseHandle(ProcessHandle);
}
}

[Lactoferrin]

运行方法
rundll32.exe a.dll,InjectCsrssW

[zwfgdlc]

我用你编译好的DLL可以注入成功，不过把你的代码用VC2008重新编译又注入失败了。

[Lactoferrin]

我这里不光是代码，我还有编译器，连接器参数的设置，你仅复制代码可能不行

[zwfgdlc]

我是用VC2008打开DSW文件,利用VC2008自带的转换功能转换成vcproj文件再编译的.
工程属性应该是不变的吧。

[Lactoferrin]

把转换后的发过来

[zwfgdlc]

发到你邮箱了。

[Lactoferrin]

发了vc2008能用的，这个dll不要使用vc的运行库(动静态都不行，只能使用system32\msvcrt.dll的或system32\ntdll.dll中的c运行库函数),manifest也不能嵌入

[Lactoferrin]

关闭杀毒软件

[zwfgdlc]

还是不成功.