注入技术--远程代码注入

1.简介:
代码注入和远程线程注入dll类似,但是隐蔽性更好,因为不产生文件.但是可靠性差,更加复杂
代码注入时注入的代码部分是从本进程空间复制过去的,所以不能出现依赖于本进程的数据存在.
所以注入的代码中数据,地址都是动态生成的, 因此可以考虑将这些数据作为参数传递给注入的代码.
将代码和数据都注入到目标进程中
(注意,该代码要以release模式编译才能运行成功,因为debug模式的编译的结构的函数调用是个jmp,而不是直接调用)

//声明需要用到的函数
typedef HMODULE(WINAPI *lpLoadLibraryA)(char* filename);
typedef FARPROC(WINAPI *lpGetProcAddress)(HMODULE hModule, char* funcName);
typedef int(WINAPI *lpMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);
typedef struct _thread_param
{
    lpLoadLibraryA loadFunc;
    lpGetProcAddress GetPFunc;
    char data[4][100]; //保存所有参数
}thread_param;

DWORD WINAPI threadProc(LPVOID param)
{
    thread_param* tparam = (thread_param*)param;
    HMODULE hd = tparam->loadFunc(tparam->data[0]); //data的第一个item是user32.dll
    lpMessageBoxA msg = (lpMessageBoxA)tparam->GetPFunc(hd, tparam->data[1]);//data的第2个参数是MessageBoxA
    msg(0, tparam->data[2], tparam->data[3], 0);//data后2个参数是messagebox的参数
}

DWORD codeInject(DWORD pid)
{
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
    if (hProcess==0||hProcess==INVALID_HANDLE_VALUE)
    {
        return 0;
    }
    thread_param param = { 0 };
    param.loadFunc = (lpLoadLibraryA)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    param.GetPFunc = (lpGetProcAddress)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetProcAddress");
    memcpy(&param.data[0], "user32.dll", 11);
    memcpy(&param.data[1], "MessageBoxA", 12);
    memcpy(&param.data[2], "freesec", 8);
    memcpy(&param.data[3], "inject", 7);

    DWORD codesize = (DWORD)codeInject - (DWORD)threadProc; //计算线程函数的代码大小
    LPVOID database = VirtualAllocEx(hProcess, 0, sizeof(thread_param), MEM_COMMIT, PAGE_READWRITE);
    DWORD written;
    HANDLE hThread;
    if (database==0)
    {
        CloseHandle(hProcess);
        return 0;
    }
    WriteProcessMemory(hProcess, database, &param, sizeof(thread_param), &written);
    LPVOID codebase = VirtualAllocEx(hProcess, 0, codesize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (codebase == 0)
    {
        VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
        CloseHandle(hProcess);
        return 0;
    }
    WriteProcessMemory(hProcess, codebase, threadProc, codesize, &written);
    if ((hThread=CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)codebase, database, 0, 0))!=0)
    {
        VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
        VirtualFreeEx(hProcess, codebase, codesize, MEM_FREE);
        CloseHandle(hThread);
        CloseHandle(hProcess);
        return 1;
    }
    VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
    VirtualFreeEx(hProcess, codebase, codesize, MEM_FREE);
    CloseHandle(hProcess);
    return 0;
}