- 注册时间
- 2011-3-6
- 最后登录
- 1970-1-1
该用户从未签到
|
- #include <windows.h>
- #include <psapi.h>
- #define MakeREX(W,R,X,B) __asm __emit 0100##W##R##X##B##b
- #define rep __asm __emit 0xf3
- #pragma pack(1)
- typedef struct _STUBARGS
- {
- unsigned __int64 addr;
- unsigned int argc;
- __int64 argv[1];
- }STUBARGS,*PSTUBARGS;
- #pragma pack()
- __declspec(naked) void __stdcall stubto64(void)
- {
- __asm
- {
- push esi
- push edi
- push ebp
- lea ebp,[esp+44]
- mov eax,[ebp+STUBARGS.argc]
- neg eax
- lea esp,[esp+eax*8]
- neg eax
- and esp,not 15
- lea esi,[ebp+STUBARGS.argv]
- mov edi,esp
- mov ecx,eax
- cld
- rep
- MakeREX(1,0,0,0)
- movsd
- dec eax
- jl callproc
- MakeREX(1,0,0,0)
- mov ecx,dword ptr[ebp+STUBARGS.argv+8*0]
- dec eax
- jl callproc
- MakeREX(1,0,0,0)
- mov edx,dword ptr[ebp+STUBARGS.argv+8*1]
- dec eax
- jl callproc
- MakeREX(1,1,0,0)
- mov eax,dword ptr[ebp+STUBARGS.argv+8*2]
- dec eax
- jl callproc
- MakeREX(1,1,0,0)
- mov ecx,dword ptr[ebp+STUBARGS.argv+8*3]
-
- callproc:
- MakeREX(1,0,0,0)
- call dword ptr[ebp+STUBARGS.addr]
-
- MakeREX(1,0,0,0)
- mov edx,eax
- MakeREX(1,0,0,0)
- shr edx,32
- lea esp,[ebp-44]
- pop ebp
- pop edi
- pop esi
- retf
- }
- }
- __declspec(naked) __int64 __cdecl lcall(void*off,unsigned short seg,...)//__int64 func,unsigned argc,...)
- {
- __asm call Far ptr[esp+4]
- __asm ret
- }
- #define Call64Proc(addr,argc,...) lcall(stubto64,0x33,(unsigned __int64)addr,argc,__VA_ARGS__)
- #define To64(x) ((__int64)(x))
- HMODULE GetNativeNtdll(void)
- {
- MEMORY_BASIC_INFORMATION mbi;static HMODULE ntdll=0;char*lastone=0;
- if(ntdll)return ntdll;
- for(char*p=0;size_t(p)<0x80000000;p+=mbi.RegionSize)
- {
- if(!VirtualQueryEx((HANDLE)-1,p,&mbi,sizeof mbi))break;
- if(mbi.AllocationBase==lastone||mbi.State!=MEM_COMMIT||mbi.Type!=MEM_IMAGE)continue;
- wchar_t name[256];
- const wchar_t ntdllname[]=L"\\windows\\system32\\ntdll.dll";
- const unsigned int ntdllnamelen=sizeof ntdllname/sizeof(wchar_t)-1;
- DWORD namelen;
- if((namelen=GetMappedFileNameW((HANDLE)-1,mbi.AllocationBase,name,256))>ntdllnamelen)
- {
-
- if(wcsicmp(ntdllname,name+namelen-ntdllnamelen)==0)
- {
- PIMAGE_DOS_HEADER dosheader=PIMAGE_DOS_HEADER(mbi.AllocationBase);
- PIMAGE_NT_HEADERS64 ntheaders=PIMAGE_NT_HEADERS64(size_t(dosheader)+dosheader->e_lfanew);
- if(ntheaders->FileHeader.Machine==IMAGE_FILE_MACHINE_AMD64)return (HMODULE)mbi.AllocationBase;
- }
- }
- lastone=(char*)mbi.AllocationBase;
- }
- return ntdll;
- }
- void* GetProcAddress64(const void*BaseAddress,const char*Name)
- {
- UINT_PTR base=reinterpret_cast<UINT_PTR>(BaseAddress);
- PIMAGE_DOS_HEADER DosHeader=PIMAGE_DOS_HEADER(BaseAddress);
- PIMAGE_NT_HEADERS64 NtHeaders=PIMAGE_NT_HEADERS64(size_t(DosHeader)+DosHeader->e_lfanew);;
- DWORD ExpRVA=NtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
- DWORD ExpSize=NtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
- if(ExpRVA&&ExpSize)
- {
- PIMAGE_EXPORT_DIRECTORY ExpDir=reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>(base+ExpRVA);
- PDWORD NameList=reinterpret_cast<PDWORD>(base+ExpDir->AddressOfNames);
- PWORD OrdinalList=reinterpret_cast<PWORD>(base+ExpDir->AddressOfNameOrdinals);
- PDWORD FunctionList=reinterpret_cast<PDWORD>(base+ExpDir->AddressOfFunctions);
- for(DWORD i=0;i<ExpDir->NumberOfNames;++i)
- {
- const char*ExpName=reinterpret_cast<const char*>(base+NameList[i]);
- if(strcmp(Name,ExpName)==0)
- {
- WORD Ordinal=OrdinalList[i];
- return (char*)base+FunctionList[Ordinal];
- }
- }
- }
- return 0;
- }
- HANDLE CreateThread64(HANDLE ProcessHandle,void*ThreadProc,void*Parameter,int Suspended)
- {
- __int64 hThread=0,cid[2];
- static void*RtlCreateUserThread64=0;
- if(!RtlCreateUserThread64)
- RtlCreateUserThread64=GetProcAddress64(GetNativeNtdll(),"RtlCreateUserThread");
- Call64Proc(RtlCreateUserThread64,10,To64(ProcessHandle),To64(0),To64(Suspended),To64(0),To64(0),To64(0),To64(ThreadProc),To64(Parameter),To64(&hThread),To64(cid));
- return (HANDLE)hThread;
- }
- typedef struct _UNICODE_STRING64
- {
- USHORT Length;
- USHORT MaximumLength;
- ULONGLONG Buffer;
- } UNICODE_STRING64, *PUNICODE_STRING64;
- HMODULE InjectLibrary64(HANDLE ProcessHandle,wchar_t*Name,unsigned short NameLength)
- {
- void*stub,*buf;unsigned stublen;
- __asm
- {
- mov stub,offset stubstart
- mov stublen,offset stubend
- sub stublen,offset stubstart
- jmp stubend
- stubstart:
- MakeREX(1,1,0,0)
- lea eax,[ecx+8]
- MakeREX(1,1,0,0)
- lea ecx,[esp-8]
- MakeREX(1,0,0,0)
- sub esp,48
- xor ecx,ecx
- xor edx,edx
-
- MakeREX(1,0,0,1)
- call [eax-8]
- MakeREX(1,0,0,0)
- add esp,48
- MakeREX(1,0,0,0)
- mov eax,[esp-8]
- MakeREX(1,0,0,0)
- mov edx,eax
- MakeREX(1,0,0,0)
- shr edx,32
- ret
- stubend:
- }
- static struct
- {
- __int64 LdrLoadDll;
- UNICODE_STRING64 us;
- }pre={0};
- buf=VirtualAllocEx(ProcessHandle,0,NameLength+sizeof pre+stublen,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
- if(buf)
- {
- if(!pre.LdrLoadDll)pre.LdrLoadDll=(__int64)GetProcAddress64(GetNativeNtdll(),"LdrLoadDll");
- pre.us.Length=pre.us.MaximumLength=NameLength;
- pre.us.Buffer=(ULONGLONG)buf+sizeof pre;
- WriteProcessMemory(ProcessHandle,buf,&pre,sizeof pre,0);
- WriteProcessMemory(ProcessHandle,(void*)pre.us.Buffer,Name,NameLength,0);
- void*code=(char*)buf+sizeof pre+NameLength;
- WriteProcessMemory(ProcessHandle,code,stub,stublen,0);
- HANDLE hThread=CreateThread64(ProcessHandle,code,buf,0);
- if(hThread)
- {
- if(WaitForSingleObject(hThread,-1))
- {
- DWORD ec;
- GetExitCodeThread(hThread,&ec);
- CloseHandle(hThread);
- return (HMODULE)ec;
- }
- CloseHandle(hThread);
- }
- VirtualFreeEx(ProcessHandle,buf,0,MEM_RELEASE);
- }
- return 0;
- }
- int _tmain()
- {
- DWORD pid;
- GetWindowThreadProcessId(FindWindowW(L"notepad",0),&pid);
- HANDLE ProcessHandle=OpenProcess(2035711,0,pid);
- InjectLibrary64(ProcessHandle,L"c:\\windows\\system32\\d3d9.dll",sizeof L"c:\\windows\\system32\\d3d9.dll"-2);
- return 0;
- }
复制代码 |
|