注入C ++ DLL [英] Injecting C++ DLL

问题描述

我知道这里有各种各样的问题和书籍，但我似乎无法将C ++ DLL注入到任何进程中。

I know there are various questions and books on this but I can't seem to get my C++ DLL injected into any processes.

注入DLL的代码：

#include <iostream>
#include "windows.h"

bool Inject(DWORD pId, char *dllName);

using namespace std;

int main()
{
    Inject(600, "C:\\d.dll");
    return 0;
}

bool Inject(DWORD pId, char *dllName)
{
    HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, false, pId);
    if(h)
    {
        LPVOID LoadLibAddr = (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
        LPVOID dereercomp = VirtualAllocEx(h, NULL, strlen(dllName), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
        WriteProcessMemory(h, dereercomp, dllName, strlen(dllName), NULL);
        HANDLE asdc = CreateRemoteThread(h, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddr, dereercomp, 0, NULL);
        WaitForSingleObject(asdc, INFINITE);
        VirtualFreeEx(h, dereercomp, strlen(dllName), MEM_RELEASE);
        CloseHandle(asdc);
        CloseHandle(h);
        return true;
    }
    return false;
}

和我试图注入的DLL：

and the DLL I am trying to inject:

#include <windows.h>
#include <stdio.h>

BOOL APIENTRY DllMain (HINSTANCE hInst     /* Library instance handle. */ ,
                       DWORD reason        /* Reason this function is being called. */ ,
                       LPVOID reserved     /* Not used. */ )
{
switch (reason)
    {
      case DLL_PROCESS_ATTACH:
           MessageBox (0, "From DLL\n", "Process Attach", MB_ICONINFORMATION);
        break;

      case DLL_PROCESS_DETACH:
           MessageBox (0, "From DLL\n", "Process Detach", MB_ICONINFORMATION);
        break;

      case DLL_THREAD_ATTACH:
           MessageBox (0, "From DLL\n", "Thread Attach", MB_ICONINFORMATION);
        break;

      case DLL_THREAD_DETACH:
           MessageBox (0, "From DLL\n", "Thread Detach", MB_ICONINFORMATION);
        break;
    }

    return TRUE;
}

我不知道足够的C ++知道这是怎么回事。我已经在我试图注入的过程中运行Process Explorer（进程以admin的形式运行），但没有被注入。当我运行它，没有任何事情发生，任何想法？

I don't know enough C++ to know where this is going wrong. I have run Process Explorer on the process I am trying to inject to (process run as admin aswell) but it isn't being injected. When I run it, nothing happens, any ideas?

推荐答案

不要做 MessageBox 从 DllMain 。为什么？请参阅：

Don't do MessageBox from DllMain. Why? See:

• DLL_PROCESS_ATTACH无法在Windows 7 C ++上执行


• 某些原因在DllMain中不要做任何事情


• 不要在静态初始化程序/ DllMain中使用标准库/ CRT函数！

• DLL_PROCESS_ATTACH failing to execute on Windows 7 C++
• Some reasons not to do anything scary in your DllMain
• Don’t use standard library/CRT functions in static initializers/DllMain!

您的消息框可能在显示之前就会死锁。为确保您达到感兴趣的代码行，请改用 OutputDebugString 。当你指出你熟悉Process Explorer时，你可能会注意到在那里创建的线程（你可以通过在你的 CreateRemoteThread 中提供最后一个参数来获得它的标识符）和它的锁定状态在内核库中执行。

Your message box might just deadlock before showing up there. To ensure you reach the code line of interest, use OutputDebugString instead. As you indicated you are familiar with Process Explorer, you might notice created thread there (you can obtain its identifier in your launcher by providing last argument in your CreateRemoteThread) and its locked state with execution inside kernel libraries.

这是您需要放置 OutputDebugString 的位置：

This is where you need to put OutputDebugString:

BOOL APIENTRY DllMain(HMODULE hModule, DWORD nReason, VOID* pvReserved)
{
    pvReserved;
    TCHAR pszMessage[1024] = { 0 };
    _stprintf_s(pszMessage, _T("GetCurrentProcessId() %d, hModule 0x%p, nReason %d\r\n"), GetCurrentProcessId(), hModule, nReason);
    OutputDebugString(pszMessage);
    /*switch(nReason)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }*/
    return TRUE;
}

另外要确保的是加载正确位置的DLL。 Win32 DLL进入 Win32 进程，或 x64 code> x64 进程。

Another thing to make sure is that you are loading DLL of correct bitness. Win32 DLL into Win32 process, or x64 DLL into x64 process.

更新。我从评论中提出这一点：这里是Visual Studio 2010项目的源代码： SVN 或 Trac 。

UPDATE. I am putting this up from comment: here is the source code for the Visual Studio 2010 project that does the thing: SVN or Trac.

• 将流程标识符放入源代码


• 可执行文件创建远程线程并加载库
• 
  
• 库从DllMain启动并生成调试输出


• DebugView 显示输出


• ProcessExplorer 显示你创建的线程，你也有其标识符打印

• You put process identifier into source code
• The executable creates remote thread and loads library
• The library starts from DllMain and generates debug output
• DebugView shows you the output
• ProcessExplorer shows you the thread created, and you also have its identifier printed

这篇关于注入C ++ DLL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！