C# dll 注入未加载 dll

Question

我知道在stackoverflow上有一些类似的问题，但没有一个能解决我的问题。

因此，我正在为低级进程间操作编写一个 c# 框架，包括 dll 注入功能。

在调用我的注入器之前，我已经使用具有PROCESS_ALL_ACCESS权限的OpenProcess()附加到目标进程(在本例中为记事本++.exe)。 以下是我的注入器代码(我知道由于所有调试打印，可读性受到很大影响)：

public void Inject(string dllName, bool printDebugInfo)
{
// Check if we are attached to the process.
target.Assertions.AssertProcessAttached();
target.Assertions.AssertInjectionPermissions();
// searching for the address of LoadLibraryA and storing it in a pointer
IntPtr kernel32Handle = WinAPI.GetModuleHandle("kernel32.dll");
if (kernel32Handle == IntPtr.Zero)
{
uint errorCode = WinAPI.GetLastError();
throw new Win32Exception((int)errorCode, "Encountered error " + errorCode.ToString() + " (0x" + errorCode.ToString("x") + ") - FATAL: Could not get handle of kernel32.dll: was NULL.");
}
UIntPtr loadLibraryAddr = WinAPI.GetProcAddress(kernel32Handle, "LoadLibraryA");
if (loadLibraryAddr == UIntPtr.Zero)
{
uint errorCode = WinAPI.GetLastError();
throw new Win32Exception((int)errorCode, "Encountered error " + errorCode.ToString() + " (0x" + errorCode.ToString("x") + ") - FATAL: Could not get address of LoadLibraryA: was NULL.");
}
HelperMethods.Debug("LoadLibraryA is at 0x" + loadLibraryAddr.ToUInt64().ToString("x"), printDebugInfo);
// alocating some memory on the target process - enough to store the name of the dll
// and storing its address in a pointer
uint size = (uint)((dllName.Length + 1) * Marshal.SizeOf(typeof(char)));
IntPtr allocMemAddress = WinAPI.VirtualAllocEx(target.Handle, IntPtr.Zero, size, (uint)Permissions.MemoryPermission.MEM_COMMIT | (uint)Permissions.MemoryPermission.MEM_RESERVE, (uint)Permissions.MemoryPermission.PAGE_READWRITE);
HelperMethods.Debug("Allocated memory at 0x" + allocMemAddress.ToInt64().ToString("x"), printDebugInfo);
int bytesWritten = 0;
// writing the name of the dll there
byte[] buffer = new byte[size];
byte[] bytes = Encoding.ASCII.GetBytes(dllName);
Array.Copy(bytes, 0, buffer, 0, bytes.Length);
buffer[buffer.Length - 1] = 0;
bool success = WinAPI.WriteProcessMemory((uint)target.Handle, allocMemAddress.ToInt64(), buffer, size, ref bytesWritten);
if (success)
{
HelperMethods.Debug("Successfully wrote "" + dllName + "" to 0x" + allocMemAddress.ToInt64().ToString("x"), printDebugInfo);
}
else
{
HelperMethods.Debug("FAILED to write dll name!", printDebugInfo);
}
// creating a thread that will call LoadLibraryA with allocMemAddress as argument
HelperMethods.Debug("Injecting dll ...", printDebugInfo);
IntPtr threadHandle = WinAPI.CreateRemoteThread(target.Handle, IntPtr.Zero, 0, loadLibraryAddr, allocMemAddress, 0, out IntPtr threadId);
HelperMethods.Debug("CreateRemoteThread returned the following handle: 0x" + threadHandle.ToInt32().ToString("x"), printDebugInfo);
uint errCode = WinAPI.GetLastError();
if (threadHandle == IntPtr.Zero)
{
throw new Win32Exception((int)errCode, "Encountered error " + errCode.ToString() + " (0x" + errCode.ToString("x") + ") - FATAL: CreateRemoteThread returned NULL pointer as handle.");
}
Console.WriteLine("CreateRemoteThread threw errorCode 0x" + errCode.ToString("x"));
Console.WriteLine("Currently the following modules are LOADED:");
ProcessModuleCollection processModules = target.Process.Modules;
foreach (ProcessModule module in processModules)
{
Console.WriteLine("  - " + module.FileName);
}
uint waitExitCode = WinAPI.WaitForSingleObject(threadHandle, 10 * 1000);
HelperMethods.Debug("Waiting for thread to exit ...", printDebugInfo);
HelperMethods.Debug("WaitForSingleObject returned 0x" + waitExitCode.ToString("x"), printDebugInfo);
Thread.Sleep(1000);
Console.WriteLine("Currently the following modules are LOADED:");
processModules = target.Process.Modules;
foreach (ProcessModule module in processModules)
{
Console.WriteLine("  - " + module.FileName);
}
success = WinAPI.GetExitCodeThread(threadHandle, out uint exitCode);
if (!success)
{
uint errorCode = WinAPI.GetLastError();
throw new Win32Exception((int)errorCode, "Encountered error " + errorCode.ToString() + " (0x" + errorCode.ToString("x") + ") - FATAL: Non-zero exit code of GetExitCodeThread.");
}
Console.WriteLine("Currently the following modules are LOADED:");
processModules = target.Process.Modules;
foreach (ProcessModule module in processModules)
{
Console.WriteLine("  - " + module.FileName);
}
HelperMethods.Debug("Remote thread returned 0x" + exitCode.ToString("x"), printDebugInfo);
success = WinAPI.CloseHandle(threadHandle);
if (!success)
{
uint errorCode = WinAPI.GetLastError();
throw new Win32Exception((int)errorCode, "Encountered error " + errorCode.ToString() + " (0x" + errorCode.ToString("x") + ") - FATAL: Failed calling CloseHandle on 0x" + threadHandle.ToInt64().ToString("x") + ".");
}
HelperMethods.Debug("Called CloseHandle on 0x" + threadHandle.ToInt64().ToString("x") + ".", printDebugInfo);
success = WinAPI.VirtualFreeEx(target.Handle, allocMemAddress, 0, 0x8000);
if (!success)
{
uint errorCode = WinAPI.GetLastError();
throw new Win32Exception((int)errorCode, "Encountered error " + errorCode.ToString() + " (0x" + errorCode.ToString("x") + ") - FATAL: Failed calling VirtualFreeEx on 0x" + allocMemAddress.ToInt64().ToString("x") + ".");
}
HelperMethods.Debug("Released all previously allocated resources!", printDebugInfo);
}

所有 WinAPI 函数都按照官方Microsoft文档的指定进行调用(三重检查)。

我按如下方式调用我的代码

Target target = Target.CreateFromName("notepad++");
target.Attach(Permissions.ProcessPermission.PROCESS_ALL_ACCESS);
target.Injector.Inject(@"L:ProgrammingCtestnewdll.dll",true);

Target类的完整源代码在 GitHub 上，但应该与此问题无关。

这里最有趣的可能是用本机 C 编写的newdll.dll，如下所示：

#include<Windows.h>
#include<stdbool.h>
__declspec(dllexport) bool WINAPI DllMain(HINSTANCE hInstDll, DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
{
break;
}
case DLL_PROCESS_DETACH:
{
break;
}
case DLL_THREAD_ATTACH:
{
break;
}
case DLL_THREAD_DETACH:
{
break;
}
}
return true;
}

这段代码显然没有多大作用，但是由于从 DllMain 生成类似消息框的东西显然被认为是"坏的"，所以我就这样离开了它。但是，如果注射有效，则 dll 将在Process.Modules中列出(事实并非如此)。

但是，在运行我的代码时，我从所有调试打印中得到以下输出：

LoadLibraryA is at 0x778f60b0
Allocated memory at 0x9c0000
Successfully wrote "L:ProgrammingCtestnewdll.dll" to 0x9c0000
Injecting dll ...
CreateRemoteThread returned the following handle: 0x22c
CreateRemoteThread threw errorCode 0x0
Currently the following modules are LOADED:
- J:TOOLSNotepad++notepad++.exe
- C:WindowsSYSTEM32ntdll.dll
- C:WindowsSYSTEM32wow64.dll
- C:WindowsSYSTEM32wow64win.dll
- C:WindowsSYSTEM32wow64cpu.dll
Waiting for thread to exit ...
WaitForSingleObject returned 0x0
Currently the following modules are LOADED:
- J:TOOLSNotepad++notepad++.exe
- C:WindowsSYSTEM32ntdll.dll
- C:WindowsSYSTEM32wow64.dll
- C:WindowsSYSTEM32wow64win.dll
- C:WindowsSYSTEM32wow64cpu.dll
Currently the following modules are LOADED:
- J:TOOLSNotepad++notepad++.exe
- C:WindowsSYSTEM32ntdll.dll
- C:WindowsSYSTEM32wow64.dll
- C:WindowsSYSTEM32wow64win.dll
- C:WindowsSYSTEM32wow64cpu.dll
Remote thread returned 0x0
Called CloseHandle on 0x22c.
Released all previously allocated resources!
Press any key to continue . . .

可以看出，没有错误代码或任何迹象表明注入确实出错了，除了从未加载newdll.dll，因为它没有显示在Process.Modules加载的模块中。

那么我的代码有什么问题呢？

快速概述：我遵循以下程序：

• OpenProcess()PROCESS_ALL_ACCESS
• GetModuleHandle("kernel32.dll")
• GetProcAddress(kernel32Handle, "LoadLibraryA")
• VirtualAllocEx(...)和WriteProcessMemory()写我的dll名称和路径。
• CreateRemoteThread()加载 dll
• WaitForSingleObject()等待加载 dll
• 释放之前分配的所有资源

Answer 1

正如正确指出的那样，这种注入技术仅在从 32 位进程 -> 32 位进程或 64 位进程 -> 64 位进程注入时才有效。我正在将我的代码编译为 64 位可执行文件，试图将我的 dll 注入 32 位记事本++.exe。

此外，我还必须调整WriteProcessMemory调用以符合 32 位内存空间。因此，从bool success = WinAPI.WriteProcessMemory((uint)target.Handle, allocMemAddress.ToInt64(), buffer, size, ref bytesWritten);改为bool success = WinAPI.WriteProcessMemory((uint)target.Handle, allocMemAddress.ToInt32(), buffer, size, ref bytesWritten);就成功了。