EIP 底层注入 调用 LdrLoadDll

callroot

;获取主线现成ID
;BY 知易
Import "kernel32.lib"

  OpenThread(dwDesiredAccess.l , bInheritHandle.l ,dwThreadId.l)

EndImport




Structure UNICODE_STRING Align #PB_Structure_AlignC
  Length.w
  MaximumLength.w
  *Buffer
EndStructure

Procedure.l Ansi2Uni(ansi.s)
  size.l=MultiByteToWideChar_(#CP_ACP,0,ansi,-1,0,0)
  Dim unicode.w(size)
  MultiByteToWideChar_(#CP_ACP, 0, ansi, Len(ansi), unicode(), size)
  ProcedureReturn @unicode()  
EndProcedure

Procedure.l  GetTidByPid(pid.l)
    Protected hSnap.l
    Protected Thread32.THREADENTRY32
    Protected LoopFlag.l
    hSnap = CreateToolhelp32Snapshot_(4, 0)
    Thread32\dwSize = SizeOf(Thread32)
    If hSnap = -1
      ProcedureReturn
    EndIf
    LoopFlag = Thread32First_(hSnap, Thread32)
   If LoopFlag = 0
      ProcedureReturn
   EndIf
   While LoopFlag <> 0

     If pid = Thread32\th32OwnerProcessID
      CloseHandle_(hSnap)
        ProcedureReturn   Thread32\th32ThreadID
     EndIf
    LoopFlag = Thread32Next_(hSnap, Thread32)
  Wend

  CloseHandle_(hSnap)

  ProcedureReturn

  EndProcedure

;EIP注入DLL
;参1 - 进程ID
;参2 - DLL名称
;成功返回1 ；错误返回0
Procedure.L EIPDLL(ProcessId.L,DllFileName.S)
   Protected XCID.L
   Protected hThread.L
   Protected hProcess.L
   Protected Dim InCode.B(36)
   Protected ConTxt.CONTEXT
   Protected lpAddr.L
   Protected DllLength.L

  DllLength = Len(DllFileName)
;   获取线程ID
  Xcid = GetTidByPid(ProcessId)
  If Xcid = 0
    Debug "线程为空"
    ProcedureReturn 0
  EndIf
;  打开进程
hProcess = OpenProcess_(#PROCESS_ALL_ACCESS,#False, ProcessId)

If hProcess = 0
    Debug "打开进程失败"
    ProcedureReturn 0
  EndIf

  ; 打开线程


  hThread = OpenThread($8|$10, 0, Xcid)

If hThread = 0
    Debug "线程打开失败"
    CloseHandle_(hProcess)
   ProcedureReturn 0
EndIf

SuspendThread_(hThread)

ConTxt\ContextFlags = $10001 ;&HD

GetThreadContext_(hThread, ConTxt)

; 在目标进程申请一块内存

lpAddr = VirtualAllocEx_(hProcess, 0, 150 + DllLength + 1, #MEM_COMMIT | #MEM_RESERVE, #PAGE_EXECUTE_READWRITE)

Debug "申请的ASMCODE内存地址" + Hex(lpAddr )

If lpAddr = 0
        Debug "内存申请失败"
        ;REM 恢复线程
        ResumeThread_(hThread)
       ;REM 关闭句柄
        CloseHandle_(hProcess)
        CloseHandle_(hThread)
EndIf


lzLibFileRemote = VirtualAllocEx_(hProcess, #Null, 100,#MEM_COMMIT | #MEM_RESERVE, #PAGE_READWRITE)

DLLstr = VirtualAllocEx_(hProcess, #Null, 100,#MEM_COMMIT | #MEM_RESERVE, #PAGE_READWRITE)

Debug "DLLSTR  " +Str(DLLstr)

CCQ = VirtualAllocEx_(hProcess, #Null, 150, #MEM_COMMIT | #MEM_RESERVE, #PAGE_READWRITE)

  Protected a.l,b.l,ACC0.L,ACC.L,ACC2.L,ACC3.L,FCALL.l,EIPADR.L

    ;写入参数1地址

     ACC0=CCQ

     Debug "参数1" + Hex(ACC0)

     CopyMemory(@ACC0,?ASMCODE+3, 4)

     ;写入参数2

     ACC1=lzLibFileRemote

     Debug "参数2" + Hex(ACC1)

     CopyMemory(@ACC1,?ASMCODE+9, 4)



     ;REM 写入Dll路径
;      
;      filename.s =DllFileName
;      
;      Debug  DllFileName
;
;      filelen.l =lstrlen_(@filename)

      Define  Ustr.UNICODE_STRING
;
;      Define  DLLHWND.L
;
;      Debug "名字长度"  + Str(filelen)
;
;      zpoint.l = SysAllocStringLen_(0,filelen) ;申请一个BSTR 的内存
;
;      MultiByteToWideChar_(#CP_ACP, 0, filename, filelen, zpoint, filelen) ;转换编码
;
;      RtlInitUnicodeString_(@Ustr, zpoint);  写入到结构里
;
;      SysFreeString_(zpoint); 释放内存


       ustr\Buffer=DLLstr
       ustr\Length=Len(DllFileName)*2
       ustr\MaximumLength = Len(DllFileName)*2 + 2

      WriteProcessMemory_(hProcess,DLLstr, Ansi2Uni(DllFileName),Len(DllFileName) *2 , 0)

      WriteProcessMemory_(hProcess,ACC1, @Ustr,80, 0)


    ;REM 写入 LoadLibrary地址

    ACC3=GetProcAddress_(LoadLibrary_("ntdll.dll"), "LdrLoadDll") ;获取LDDR的地址

    FCALL =ACC3 -(lpAddr+19+4)


    CopyMemory(@FCALL,?ASMCODE+19, 4)


    ;REM 写入原始EIP地址

     ACC2=ConTxt\Eip

     EIPADR = ACC2 -(lpAddr+27+4) ;M没有恢复

     ;CopyMemory(@EIPADR,?ASMCODE+27, 4)

     Debug "eIP : " +Hex(ACC2)


    ; REM 向目标进程写入汇编代码
    WriteProcessMemory_(hProcess,lpAddr, ?ASMCODE, 27, 0)



;     ;REM 修改Eip地址
    ConTxt\Eip = lpAddr
;     ;REM 修改线程信息
    Debug Hex(lpAddr) + " 远程代码地址"
;     
    ConTxt\ContextFlags = $10001
;     
;  
   If SetThreadContext_(hThread, ConTxt) = 1

    ResumeThread_(hThread)

    CloseHandle_(hProcess)


     ProcedureReturn  1
     Else
;        
      ResumeThread_(hThread)
;
    ProcedureReturn  0
;      
   EndIf



EndProcedure  

EIPDLL(3744,"c:\test.dll")

DataSection:
   ASMCODE:
    ;Data.b $60,$9C,$B8,$1C,$00,$CE,$02,$50,$B8,$1C,$00,$CE,$02,$50,$6A,$00,$6A,$00,$E8,$88,$49,$6E,$73,$58,$58,$9D,$61,$E9,$80,$49,$6E,$73
    Data.b $60,$9C,$B8,$1C,$00,$CE,$02,$50,$B8,$1C,$00,$CE,$02,$50,$6A,$00,$6A,$00,$E8,$88,$49,$6E,$73,$58,$58,$9D,$61
EndDataSection

huchaoold

特别是这个代码又不是C，看起来更费劲，来本就是只会易的。能不是翻译成易语言，我自己也在写这个。目前，调用不崩溃，但是模块注入也不成功

huchaoold

嗯。不错的代码，但是不是能看的太明白