1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

// 使用 CreateRemoteThread 在目标进程中创建线程执行 LoadLibrary
BOOL RemoteThreadInjection(DWORD dwProcessId, LPCSTR szDllPath) {
    // 打开目标进程
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
    
    // 在目标进程中分配内存
    LPVOID pRemoteMemory = VirtualAllocEx(hProcess, NULL, strlen(szDllPath) + 1, 
                                         MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    
    // 写入DLL路径
    WriteProcessMemory(hProcess, pRemoteMemory, szDllPath, strlen(szDllPath) + 1, NULL);
    
    // 获取 LoadLibrary 地址
    LPTHREAD_START_ROUTINE pLoadLibrary = (LPTHREAD_START_ROUTINE)
        GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
    
    // 创建远程线程
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, pLoadLibrary, pRemoteMemory, 0, NULL);
    
    // 等待线程执行完成
    WaitForSingleObject(hThread, INFINITE);
    
    // 清理资源
    VirtualFreeEx(hProcess, pRemoteMemory, 0, MEM_RELEASE);
    CloseHandle(hThread);
    CloseHandle(hProcess);
    
    return TRUE;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

// 使用 SetWindowsHookEx 设置全局钩子
HHOOK SetGlobalHook(int hookType, HOOKPROC hookProc, LPCSTR szDllPath) {
    // 加载包含钩子过程的DLL
    HMODULE hDll = LoadLibraryA(szDllPath);
    
    // 设置全局钩子
    HHOOK hHook = SetWindowsHookEx(hookType, hookProc, hDll, 0);
    
    return hHook;
}

1
2
3
4
5
6
7
8
9

// 修改注册表或创建进程时注入
BOOL ProcessHijackingInjection() {
    // 修改 AppInit_DLLs 注册表键值
    // HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
    // AppInit_DLLs = "your_dll.dll"
    // LoadAppInit_DLLs = 1
    
    return TRUE;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

// 通过修改注册表实现持久化注入
BOOL RegistryInjection(LPCSTR szDllPath) {
    HKEY hKey;
    LONG result = RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows", 
        0, KEY_SET_VALUE, &hKey);
    
    if (result == ERROR_SUCCESS) {
        // 设置 AppInit_DLLs
        RegSetValueEx(hKey, "AppInit_DLLs", 0, REG_SZ, 
                     (BYTE*)szDllPath, strlen(szDllPath) + 1);
        
        // 启用 DLL 加载
        DWORD dwValue = 1;
        RegSetValueEx(hKey, "LoadAppInit_DLLs", 0, REG_DWORD, 
                     (BYTE*)&dwValue, sizeof(dwValue));
        
        RegCloseKey(hKey);
        return TRUE;
    }
    return FALSE;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

// 使用异步过程调用注入
BOOL APCInjection(DWORD dwProcessId, LPCSTR szDllPath) {
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
    LPVOID pRemoteMemory = VirtualAllocEx(hProcess, NULL, strlen(szDllPath) + 1, 
                                         MEM_COMMIT, PAGE_READWRITE);
    WriteProcessMemory(hProcess, pRemoteMemory, szDllPath, strlen(szDllPath) + 1, NULL);
    
    // 遍历线程，插入APC
    DWORD dwThreadId = FindThreadId(dwProcessId);
    HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, dwThreadId);
    
    QueueUserAPC((PAPCFUNC)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"), 
                 hThread, (ULONG_PTR)pRemoteMemory);
    
    CloseHandle(hThread);
    CloseHandle(hProcess);
    return TRUE;
}

1
2
3
4
5
6

// 通过 COM 资源注入
BOOL ComResInjection() {
    // 修改 COM 组件的注册信息
    // 劫持 CLSID 或修改 COM 组件的 DLL 路径
    return TRUE;
}

1
2
3
4
5
6

// 利用系统可信进程进行注入
BOOL TrustedProcessInjection() {
    // 通过 svchost.exe、explorer.exe 等系统可信进程
    // 修改其加载的 DLL 或利用 DLL 搜索顺序劫持
    return TRUE;
}

1
2
3
4
5
6
7
8

// 通过输入法编辑器注入
BOOL IMEInjection() {
    // 注册输入法编辑器
    // 将 DLL 注册为 IME 组件
    // 系统加载输入法时自动加载 DLL
    
    return TRUE;
}

1

OpenProcess

1
2
3
4
5
6
7
8

HANDLE CreateRemoteThread(
  HANDLE hProcess,                          // handle to process--进程句柄
  LPSECURITY_ATTRIBUTES lpThreadAttributes, // SD
  DWORD dwStackSize,                        // initial stack size
  LPTHREAD_START_ROUTINE lpStartAddress,    // thread function--线程函数地址
  LPVOID lpParameter,                       // thread argument--线程参数地址
  DWORD dwCreationFlags,                    // creation option
  LPDWORD lpThreadId                        // thread identifier);

1
2
3
4

DWORD WINAPI ThreadProc(  LPVOID lpParameter   // thread data);
HMODULE LoadLibrary(  LPCTSTR lpFileName   // file name of module);
//线程函数地址
A.LoadLibrary=B.LoadLibrary

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

LPVOID VirtualAllocEx(  HANDLE hProcess,          // process to allocate memory
  LPVOID lpAddress,         // desired starting address 
  SIZE_T dwSize,            // size of region to allocate
  DWORD flAllocationType,   // type of allocation
  DWORD flProtect           // type of access protection);
BOOL WriteProcessMemory(  HANDLE hProcess,               // handle to process
  LPVOID lpBaseAddress,          // base of memory area
  LPVOID lpBuffer,               // data buffer
  DWORD nSize,                   // number of bytes to write
  LPDWORD lpNumberOfBytesWritten // number of bytes written);

1

WaitForSingleObject

1

VirtualFreeEx