C++封裝遠程注入類CreateRemoteThreadEx實例

2020-01-26 15:13:38

字體：大中小

來源：轉載

供稿：網友

本文實例講述了C++封裝遠程注入類CreateRemoteThreadEx的方法，分享給大家供大家參考。具體方法如下：

首先，類初始化時傳入要注入的DLL文件名

只使用兩個函數

// 注入DLL到指定的地址空間
BOOL InjectModuleInto(DWORD dwProcessId);
// 從指定的地址空間卸載DLL
BOOL EjectModuleFrom(DWORD dwProcessId);

.h頭文件如下：

復制代碼代碼如下:

#pragma once  
#include <windows.h>  //在頭文件中包含  
  
class CRemThreadInject  
{  
public:  
    CRemThreadInject(LPSTR lpDllName);  
    ~CRemThreadInject(void);  
  
protected:  
    char m_szDllName[MAX_PATH];  
    static BOOL EnableDebugPrivilege(BOOL bEnable);  
public:  
    // 注入DLL到指定的地址空間  
    BOOL InjectModuleInto(DWORD dwProcessId);  
    // 從指定的地址空間卸載DLL  
    BOOL EjectModuleFrom(DWORD dwProcessId);  
};

.cpp源文件如下：

復制代碼代碼如下:

#include "RemThreadInject.h"  
#include <tlhelp32.h>   
  
CRemThreadInject::CRemThreadInject(LPSTR lpDllName)  
{  
    memcpy(m_szDllName, lpDllName, MAX_PATH);  
    EnableDebugPrivilege(TRUE);  
}  
  
CRemThreadInject::~CRemThreadInject(void)  
{  
    EnableDebugPrivilege(FALSE);  
}  
  
BOOL CRemThreadInject::EnableDebugPrivilege(BOOL bEnable)  
{  
    HANDLE hToken = INVALID_HANDLE_VALUE;  
    //OpenProcessToken  
    if (0 == ::OpenProcessToken(::GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken))  
    {  
        return FALSE;  
    }  
    LUID luid;  
      
    //  
    ::LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);  
    TOKEN_PRIVILEGES tp;  
    tp.PrivilegeCount = 1;  
    tp.Privileges[0].Luid = luid;  
    if (bEnable)  
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;  
    else  
        tp.Privileges[0].Attributes = 0;  
    if ( !AdjustTokenPrivileges(  
        hToken,   
        FALSE,   
        &tp,   
        sizeof(TOKEN_PRIVILEGES),   
        (PTOKEN_PRIVILEGES) NULL,   
        (PDWORD) NULL) )  
    {   
        return FALSE;   
    }   
    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)  
    {  
        return FALSE;  
    }   
    ::CloseHandle(hToken);  
    return TRUE;  
}  
  
// 注入DLL到指定的地址空間  
BOOL CRemThreadInject::InjectModuleInto(DWORD dwProcessId)  
{  
    //  
    if (::GetCurrentProcessId() == dwProcessId)  
    {  
        return FALSE;   
    }  
    BOOL bFound;  
    /************************************************************************/  
    /* 遍歷模塊                                                              */  
    /************************************************************************/  
    HANDLE hModuleSnap = INVALID_HANDLE_VALUE;   
    MODULEENTRY32 me32;   
  
    //  Take a snapshot of all modules in the specified process.   
    hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId );   
    if( hModuleSnap == INVALID_HANDLE_VALUE )   
    {   
        return( FALSE );   
    }   
    me32.dwSize = sizeof( MODULEENTRY32 );   
    if( !Module32First( hModuleSnap, &me32 ) )   
    {   
        CloseHandle( hModuleSnap );     // Must clean up the snapshot object!   
        return( FALSE );   
    }   
    do   
    {   
        if (stricmp(me32.szModule, m_szDllName) == 0)  
        {  
            bFound = TRUE;  
            break;  
        }  
    } while( Module32Next( hModuleSnap, &me32 ) );   
  
    //  Do not forget to clean up the snapshot object.   
    CloseHandle( hModuleSnap );   
  
    if (bFound) //如果已經加載了模塊，就不再加載  
    {  
        return FALSE;  
    }  
  
    //如果沒加載，打開進程，遠程注入  
      
    HANDLE hProcess = ::OpenProcess(PROCESS_CREATE_THREAD |PROCESS_VM_OPERATION |PROCESS_VM_WRITE, FALSE, dwProcessId);  
    if (hProcess == NULL)  
    {  
        return FALSE;  
    }  
    HMODULE  hKernerl32 = GetModuleHandle("kernel32.dll");  
    LPTHREAD_START_ROUTINE pfnLoadLibraryA = (LPTHREAD_START_ROUTINE)::GetProcAddress(hKernerl32, "LoadLibraryA");   
  
    int cbSize = strlen(m_szDllName)+1;  
    LPVOID lpRemoteDllName = ::VirtualAllocEx(hProcess, 0, cbSize, MEM_COMMIT, PAGE_READWRITE);  
    ::WriteProcessMemory(hProcess, lpRemoteDllName, m_szDllName, cbSize, NULL);  
    HANDLE hRemoteThread = ::CreateRemoteThreadEx(hProcess, NULL, 0, pfnLoadLibraryA, lpRemoteDllName, 0, NULL, NULL);  
    if (NULL == hRemoteThread)  
    {  
        ::CloseHandle(hProcess);  
        return FALSE;  
    }  
    //等待目標線程運行結束，即LoadLibraryA函數返回  
    ::WaitForSingleObject(hRemoteThread, INFINITE);  
    ::CloseHandle(hRemoteThread);  
    ::CloseHandle(hProcess);  
    return TRUE;  
}  
  
// 從指定的地址空間卸載DLL  
BOOL CRemThreadInject::EjectModuleFrom(DWORD dwProcessId)  
{  
    //  
    if (::GetCurrentProcessId() == dwProcessId)  
    {  
        return FALSE;   
    }  
    BOOL bFound;  
    /************************************************************************/  
    /* 遍歷模塊                                                              */  
    /************************************************************************/  
    HANDLE hModuleSnap = INVALID_HANDLE_VALUE;   
    MODULEENTRY32 me32;   
  
    //  Take a snapshot of all modules in the specified process.   
    hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId );   
    if( hModuleSnap == INVALID_HANDLE_VALUE )   
    {   
        return( FALSE );   
    }   
    me32.dwSize = sizeof( MODULEENTRY32 );   
    if( !Module32First( hModuleSnap, &me32 ) )   
    {   
        CloseHandle( hModuleSnap );     // Must clean up the snapshot object!   
        return( FALSE );   
    }   
    do   
    {   
        if (stricmp(me32.szModule, m_szDllName) == 0)  
        {  
            bFound = TRUE;  
            break;  
        }  
    } while( Module32Next( hModuleSnap, &me32 ) );   
  
    //  Do not forget to clean up the snapshot object.   
    CloseHandle( hModuleSnap );   
  
    if (!bFound) //如果沒有加載模塊，就不能卸載  
    {  
        return FALSE;  
    }  
  
    //如果加載了，打開進程，遠程注入  
  
    HANDLE hProcess = ::OpenProcess(PROCESS_CREATE_THREAD |PROCESS_VM_OPERATION |PROCESS_VM_WRITE, FALSE, dwProcessId);  
    if (hProcess == NULL)  
    {  
        return FALSE;  
    }  
    HMODULE  hKernerl32 = GetModuleHandle("kernel32.dll");  
    LPTHREAD_START_ROUTINE pfnFreeLibrary = (LPTHREAD_START_ROUTINE)::GetProcAddress(hKernerl32, "FreeLibrary"); 
  
    int cbSize = strlen(m_szDllName)+1;  
    LPVOID lpRemoteDllName = ::VirtualAllocEx(hProcess, 0, cbSize, MEM_COMMIT, PAGE_READWRITE);  
    ::WriteProcessMemory(hProcess, lpRemoteDllName, m_szDllName, cbSize, NULL);  
    HANDLE hRemoteThread = ::CreateRemoteThreadEx(hProcess, NULL, 0, pfnFreeLibrary, lpRemoteDllName, 0, NULL, NULL);  
    if (NULL == hRemoteThread)  
    {  
        ::CloseHandle(hProcess);  
        return FALSE;  
    }  
    //等待目標線程運行結束，即LoadLibraryA函數返回  
    ::WaitForSingleObject(hRemoteThread, INFINITE);  
    ::CloseHandle(hRemoteThread);  
    ::CloseHandle(hProcess);  
    return TRUE;  
}