为什么我的程序无法正确注入我的.dll?

Why won't my program inject my .dll properly?

本文关键字:我的 注入 dll 程序 为什么      更新时间:2023-10-16

被困了几个小时,制作一个(简单的)dll注入器,它将一个.dll文件和一个进程作为参数,然后将所述.dll注入到进程中,我即将开始撕扯我的头发。

它无法正常运行,也没有明显的原因。dll 根本不会加载到进程中,但不会显示任何错误消息。我做了完全相同的事情,但使用 ANSI 函数而不是 Unicode,它就像一个魅力,经过一些测试后,我相信这可能是文件路径未正确加载的问题,但我不知道为什么。

我在下面附上了我的整个源代码,并添加了一些注释,希望能澄清一些。就像我说的,如果我是对的,那么重要的部分应该从某个地方开始:获取 dll 的完整路径并将其存储在变量中

帮一个兄弟。

#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>
using namespace std;
int main()
{
    HANDLE hSnapshot, hProc = NULL;
    PROCESSENTRY32 PE32;
    PE32.dwSize = sizeof(PROCESSENTRY32);
    WCHAR injProcName[100] = {NULL}, injDllName[100] = {NULL};
    //Let user input options
    cout << "Dll injector started!" << endl << "Please enter the name of the dll you would like to inject: ";
    wcin >> injDllName;
    cout << "Enter the name of the target process: ";
    wcin >> injProcName;
    //Create snapshot
    hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    Process32First(hSnapshot, &PE32);
    //Load the first process into PE32 and loop to see if target process is running
    do {
        if(wcscmp(PE32.szExeFile, injProcName) == 0) {
            wcout << PE32.szExeFile << " found!" << endl;
            wcout << "Attempting to open " << injProcName << ".." << endl;
            hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PE32.th32ProcessID);
                if(!hProc)
                {
                    cout << "Failed to open process!" << endl;
                    return 1;
                }
            break;
        }
    }
while(Process32Next(hSnapshot, &PE32));
    if(!hProc) {
        cout << "Unable to locate process!" << endl;
        return 1;
    }
    cout << "Process successfully opened!" << endl;
    //Get the full path of our dll and store it in a variable
    WCHAR DllPath[MAX_PATH] = {NULL};
    GetFullPathName(injDllName, MAX_PATH, DllPath, NULL);
    wcout << DllPath << endl;
    //Allocate memory in target process
    cout << "Allocating memory.." << endl;
    LPVOID DllMemAddr = VirtualAllocEx(hProc,
        NULL,
        wcslen(DllPath),
        MEM_COMMIT|MEM_RESERVE,
        PAGE_READWRITE);
    //Write our path into target process memory
    wcout << "Writing dll to target process.." << endl;
    WriteProcessMemory(hProc,
        DllMemAddr,
        DllPath,
        wcslen(DllPath),
        NULL);
    //Get the memory address of LoadLibraryW
    LPVOID LoadAddr = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryW");
    //Finally, start a new thread with the address of LoadLibraryW and our dll path as argument
    cout << "Executing dll in remote process.." << endl;
    CreateRemoteThread(hProc,
        NULL,
        NULL,
        (LPTHREAD_START_ROUTINE)LoadAddr,
        DllMemAddr,
        NULL,
        NULL);
    cout << "Dll sucessfully injected!" << endl;
    cin.get();
return 0;
}

>wcslenwchar_t为单位返回长度。但是VirtualAllocExWriteProcessMemory的长度以byte为单位。所以你只写一半的字符串,因为wchar_t是两个字节宽。而且您没有编写空终止符。

你需要通过(wcslen(DllPath)+1)*sizeof(wchar_t).


顺便说一下,您的ANSI代码可能也被破坏了,因为据推测,它也错过了空终止符。但你可能偶然侥幸逃脱了。

一点点错误检查不会消失,而我们正在查看您的代码。当你跟随它调用GetFullPathName时,初始化DllPath有点毫无意义。