c++ - 通过 CreateRemoteThread 注入(inject) DLL？

Question

让我们假设远程线程过程如下所示:

DWORD __stdcall ThreadProc (void *pData) {
    ThreadData *p = (ThreadData*)pData; // Contains function references and strings
    p->MessageBoxW(NULL, p->Message, p->Title, MB_OK);
}

然后一切正常，p->MessageBoxW(...) 按预期显示消息框。但是我不想为我在远程线程中使用的每个函数调用 GetProcAddress，所以我想我可以在我的模块中创建一个函数导出(EXE 文件创建远程线程)，这样远程线程只需调用 LoadLibraryW 将我的 EXE 文件作为模块加载到目标进程的地址空间，并调用 GetProcAddress 获取导出函数的地址以便调用它。

typedef void (__stdcall *_Test) ();
extern "C" void __stdcall Test () {
    return;
}

DWORD __stdcall ThreadProc (void *pData) {
    ThreadData *p = (ThreadData*)pData; // Contains function references and strings
    HMODULE hLib = p->LoadLibraryW(p->LibPath);
    _Test pTest = (_Test)p->GetProcAddress(hLib, p->ProcName);

    pTest();

    p->FreeLibrary(hLib);
    return NULL;
}

这仍然可以正常工作。但是一旦我将导出的函数更改为

extern "C" void __stdcall Test () {
    MessageBoxW(NULL, L"Message", L"Title", MB_OK);
    return;
}

目标进程突然崩溃。 LoadLibrary 不解析模块间引用吗？是否可以将我的模块加载到目标进程的地址空间中，以便可以在不将所有函数地址传递给它的情况下对导出的函数进行编码？

---

附加信息:对于每个复制代码的人，我必须禁用增量链接，构建为发布并添加一个模块定义文件到确保 Test 导出为 Test 而不是 _Test@SoMeJuNk。由于某些原因，仅在 __declspec(dllexport) 前面添加不起作用。模块定义文件如下所示

EXPORTS
    Test@0

ThreadData 结构如下所示

typedef struct tagThreadData {
    typedef BOOL (__stdcall *_FreeLibrary) (HMODULE);
    typedef FARPROC (__stdcall *_GetProcAddress) (HMODULE, PSTR);
    typedef HMODULE (__stdcall *_LoadLibraryW) (LPWSTR);
    typedef DWORD (__stdcall *_MessageBoxW) (HWND, LPWSTR, LPWSTR, DWORD);

    _FreeLibrary FreeLibrary;
    _GetProcAddress GetProcAddress;
    _LoadLibraryW LoadLibraryW;
    _MessageBoxW MessageBoxW;

    WCHAR LibPath[100];
    WCHAR Message[30];
    CHAR ProcName[10];
    WCHAR Title[30];
} ThreadData, *PThreadData;

Answer 1

我想到了一个临时解决方案:将所有远程代码放入一个实际的 DLL 中。但是将代码放入 DLL 并不是我的目标，所以如果有人想出一个聪明的解决方案，其中 EXE 文件是注入(inject)器以及被注入(inject)的模块，我会将新答案标记为正确。

尽管有很多教程介绍如何将实际的 DLL 注入(inject)另一个进程的地址空间，但我仍然给出了我的解决方案。我只为 UNICODE 和 64 位编写了我的原始解决方案，但我尽力使其适用于 ASCII 和 UNICODE 以及 32 位和 64 位。但是让我们开始吧......

---

首先对基本步骤进行说明

1. 获取至少具有以下访问权限的目标进程句柄

   PROCESS_CREATE_THREAD
   PROCESS_QUERY_INFORMATION
   PROCESS_VM_OPERATION
   PROCESS_VM_WRITE
   PROCESS_VM_READ
   

2. 为远程线程过程和加载目标 dll 及其“入口点”所需的数据和函数指针分配内存(我不是指实际的入口点 DllMain，而是设计为从内部调用的函数远程线程)

   PVOID pThread = VirtualAllocEx(hProc, NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
   

3. 将远程线程过程和重要数据复制到目标进程

   WriteProcessMemory(hProc, pThread, ThreadProc, ThreadProcLen, NULL);
   WriteProcessMemory(hProc, pParam, &data, sizeof(ThreadData), NULL);
   

4. 创建远程线程。该线程会将目标dll加载到目标进程的地址空间中，并调用它的“入口点”

   HANDLE hThread = CreateRemoteThread(hProc, NULL, 0, (PTHREAD_START_ROUTINE)pThread, pParam, NULL, NULL);
   

5. 可选:等待线程返回

   WaitForSingleObject(hThread, INFINITE);
   
   DWORD threadExitCode;
   GetExitCodeThread(hThread, &threadExitCode);
   

6. 关闭线程句柄，释放内存，关闭进程句柄

   CloseHandle(hThread);
   VirtualFreeEx(hProc, pThread, 4096, MEM_RELEASE);
   CloseHandle(hProc);
   

---

这是我的ThreadProc 和ThreadData 结构。 ThreadProc 是由CreateRemoteThread 调用的远程线程过程，应该LoadLibrary 目标dll，所以它可以调用目标dll 的“入口点”。 ThreadData结构包含LoadLibrary、GetProcAddress和FreeLibrary的地址，目标dll的路径TargetDll 和“入口点”DllEntry 的名称。

typedef struct {
    typedef BOOL (__stdcall *_FreeLibrary) (HMODULE);
    typedef FARPROC (__stdcall *_GetProcAddress) (HMODULE, LPCH);
    typedef HMODULE (__stdcall *_LoadLibrary) (LPTSTR);
    typedef void (__stdcall *_DllEntry) ();

    _LoadLibrary LoadLibrary;
    TCHAR TargetDll[MAX_PATH];

    _GetProcAddress GetProcAddress;
    CHAR DllEntry[50]; // Some entrypoint designed to be
                       // called from the remote thread

    _FreeLibrary FreeLibrary;
} ThreadData, *PThreadData;



// ThreadProcLen should be smaller than 3400, because ThreadData can
// take up to 644 bytes unless you change the length of TargetDll or
// DllEntry
#define ThreadProcLen       (ULONG_PTR)2048
#define SPY_ERROR_OK        (DWORD)0
#define SPY_ERROR_LOAD_LIB  (DWORD)1
#define SPY_ERROR_GET_PROC  (DWORD)2

DWORD ThreadProc (PVOID pParam) {
    DWORD err = SPY_ERROR_OK;
    PThreadData p = (PThreadData)pParam;

    // Load dll to be injected
    HMODULE hLib = p->LoadLibrary(p->TargetDll);
    if (hLib == NULL)
        return SPY_ERROR_LOAD_LIB;

    // Obtain "entrypoint" of dll (not DllMain)
    ThreadData::_DllEntry pDllEntry = (ThreadData::_DllEntry)p->GetProcAddress(hLib, p->DllEntry);
    if (pDllEntry != NULL)
        // Call dll's "entrypoint"
        pDllEntry();
    else
        err = SPY_ERROR_GET_PROC;

    // Free dll
    p->FreeLibrary(hLib);
    return err;
}

---

然后是将远程线程过程注入(inject)目标进程地址空间的实际代码

int main(int argc, char* argv[]) {
    // DWORD pid = atoi(argv[1]);

    // Open process
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (hProc != NULL) {
        // Allocate memory in the target process's address space
        PVOID pThread = VirtualAllocEx(hProc, NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
        if (pThread != NULL) {
            PVOID pParam = (PVOID)((ULONG_PTR)pThread + ThreadProcLen);

            // Initialize data to be passed to the remote thread
            ThreadData data;

            HMODULE hLib = LoadLibrary(TEXT("KERNEL32.DLL"));
            data.LoadLibrary = (ThreadData::_LoadLibrary)GetProcAddress(hLib, "LoadLibrary");
            data.GetProcAddress = (ThreadData::_GetProcAddress)GetProcAddress(hLib, "GetProcAddress");
            data.FreeLibrary = (ThreadData::_FreeLibrary)GetProcAddress(hLib, "FreeLibrary");
            FreeLibrary(hLib);

            _tcscpy_s(data.TargetDll, TEXT("..."));         // Insert path of target dll
            strcpy_s(data.DllEntry, "NameOfTheDllEntry");   // Insert name of dll's "entrypoint"

            // Write procedure and data into the target process's address space
            WriteProcessMemory(hProc, pThread, ThreadProc, ThreadProcLen, NULL);
            WriteProcessMemory(hProc, pParam, &data, sizeof(ThreadData), NULL);

            // Create remote thread (ThreadProc)
            HANDLE hThread = CreateRemoteThread(hProc, NULL, 0, (PTHREAD_START_ROUTINE)pThread, pParam, NULL, NULL);
            if (hThread != NULL) {
                // Wait until remote thread has finished
                if (WaitForSingleObject(hThread, INFINITE) == WAIT_OBJECT_0) {
                    DWORD threadExitCode;

                    // Evaluate exit code
                    if (GetExitCodeThread(hThread, &threadExitCode) != FALSE) {
                        // Evaluate exit code
                    } else {
                        // The thread's exit code couldn't be obtained
                    }
                } else {
                    // Thread didn't finish for some unknown reason
                }

                // Close thread handle
                CloseHandle(hThread);
            }

            // Deallocate memory
            VirtualFreeEx(hProc, pThread, 4096, MEM_RELEASE);
        } else {
            // Couldn't allocate memory in the target process's address space
        }

        // Close process handle
        CloseHandle(hProc);
    }

    return 0;
}

---

被注入(inject)的 dll 有一个真正的入口点 DllMain，当 LoadLibrary 将目标 dll 加载到目标进程的地址空间时调用，另一个“入口点” NameOfTheDllEntry 由远程线程过程调用(如果它可以定位到第一个位置)

// Module.def:
// LIBRARY NameOfDllWithoutExtension
// EXPORTS
//     NameOfTheDllEntry
__declspec(dllexport) void __stdcall NameOfTheDllEntry () {
    // Because the library is actually loaded in the target process's address
    // space, there's no need for obtaining pointers to every function.
    // I didn't try libraries other than kernel32.dll and user32.dll, but they
    // should be working as well as long as the dll itself references them

    // Do stuff
    return;
}



BOOL APIENTRY DllMain (HMODULE hLib, DWORD reason, PVOID) {
    if (reason == DLL_PROCESS_ATTACH)
        DisableThreadLibraryCalls(hLib);    // Optional

    return TRUE;
}