使用 C 崩溃记事本的 DLL 注入

Question

我用C和DLL创建了一个DLL注入器程序。当我尝试运行程序时，目标进程崩溃(我尝试了记事本和cmd(。我正在将注入器编译为 64 位和 DLL。程序和用Visual Studio编译的DLL。

经过一些检查，如果我删除CreateRemoteThread程序不会崩溃，并且注入了DLL(当然没有执行DLL(。

我尝试使用RUNDLL32.exe来检查DLL是否是问题所在，并且我已经能够看到消息框。

注射器：

#include <Windows.h>
#include <stdio.h>
int main() {
// The DLL path we want to inject and the target process id.
LPCSTR dllpath = "C:\Users\....\hello-world.dll";
int processID = 2980;
printf("#### Starting ####n");
// Open target process handle    
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
if (hProcess == NULL) {
//close handles
CloseHandle(hProcess);
printf("[!] Unable to find the target process id: %dn" , processID);
return 1;
}
printf("[+] Open target process handlen");
// Getting targt memory address for the dll path
LPVOID dllpathMemoryAddr = VirtualAllocEx(hProcess, NULL, strlen(dllpath) + 1, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (dllpathMemoryAddr == NULL) {
//close handles
CloseHandle(hProcess);
printf("[!] Unable to get memory address of target process for the dllpath");
return 1;
}
printf("[+] Allocate the memory address to store the dllpathn");
// Writing the dll path to the target memory address
BOOL succeedWrite = WriteProcessMemory(hProcess, dllpathMemoryAddr, dllpath, strlen(dllpath) + 1, NULL);
if (!succeedWrite) {
//close handles
CloseHandle(hProcess);
printf("[!] Unable to write to the memory address of target process the dllpathn");
return 1;
}
printf("[+] Writed the dllpath to memoryn");
// Getting LoadLibreryA address
FARPROC loadLibAddr = 
(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryA");
if (loadLibAddr == NULL) {
// free the memory 
VirtualFreeEx(hProcess, dllpathMemoryAddr, 0, MEM_RELEASE);
//close handles
CloseHandle(hProcess);
printf("[!] Unable to get the memory address of LoadLibraryA functionn");
return 1;
}
printf("[+] Allocate the memory address to LoadLibraryA functionn");
// Create remote thread on the remote process to load the dll
HANDLE rThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)loadLibAddr, dllpathMemoryAddr, 0, NULL);
if (rThread == NULL) {
// free the memory 
VirtualFreeEx(hProcess, dllpathMemoryAddr, 0, MEM_RELEASE);
//close handles
CloseHandle(hProcess);
printf("[!] Unable to create thread to execute the LoadLibraryA functionn the error: %un", GetLastError());
return 1;
}
printf("[+] Created remote thread to execute the dlln");
// Waiting to opertion to complete
WaitForSingleObject(rThread, INFINITE);
// free the memory 
VirtualFreeEx(hProcess, dllpathMemoryAddr, 0, MEM_RELEASE);
//close handles
CloseHandle(hProcess);
CloseHandle(rThread);
printf("#### DLL INJECTED ####n");

return TRUE;
}

.DLL

#define WIN32_LEAN_AND_MEAN
#include <stdio.h>
#include <windows.h>
extern "C" __declspec(dllexport)
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved) {
switch (ul_reason_for_call) {
case DLL_PROCESS_ATTACH:
MessageBox(NULL, "Hello world!", "Hello World!", NULL);
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}

输出：

#### Starting ####
[+] Open target process handle
[+] Allocate the memory address to store the dllpath
[+] Writed the dllpath to memory
[+] Allocate the memory address to LoadLibraryA function
[+] Created remote thread to execute the dll
#### DLL INJECTED ####

Answer 1

如果我正确理解了OP的评论，主要问题是OP最初使用了以下行(在编辑问题之前(：

BOOL succeedWrite = WriteProcessMemory(hProcess, dllpathMemoryAddr, dllpath, strlen(dllpath), NULL);

通过写入strlen(dllpath)而不是strlen(dllpath) + 1字节，OP 不会将字符串的终止 null 字符写入远程进程。因此，当该未终止的字符串作为函数参数传递给LoadLibraryA时，远程进程可能会崩溃。

正如评论部分所指出的，代码还存在一些其他问题，但这些不太可能是崩溃的原因。