自定义PE加载器加载dll

htpidk

论坛上已经有了这方面的帖子，不过不能加载易语言写的dll，要正常加载易语言的dll需要HOOK一个函数，HOOK懒得自己写了，用了detours，具体看代码吧，源码里都注释了。

[C++] 纯文本查看 复制代码

#include "stdafx.h"
#include <iostream>
#include <Windows.h>
#include "detours.h"
#pragma comment(lib,"detours.lib")
using namespace std;

DWORD __stdcall newgetmodulefilename(HMODULE,LPSTR,DWORD);
HMODULE g_hm;
char g_dllname[200]={0};

DWORD (__stdcall *poldgetmodulefilename)(HMODULE,LPSTR,DWORD)=GetModuleFileNameA;

int _tmain(int argc, _TCHAR* argv[])
{
        char dllname[50]={0};
        cout<<"请输入需要加载的dll名称：";
        cin>>dllname;
        //char* dllname="C:\\Users\\jason\\Desktop\\vsvs\\PELoaderDll\\Debug\\yiyuyan.dll";
        strncpy(g_dllname,dllname,strlen(dllname));

        FILE* hf=fopen(dllname,"rb+");
        fseek(hf,0,SEEK_END);
        long len=ftell(hf);
        //cout<<len<<endl;
        fseek(hf,0,SEEK_SET);
        char *filebuffer=new char[len];
        fread(filebuffer,len,1,hf);
        fclose(hf);
        ///////////////////读取各种PE头/////////////////
        PIMAGE_DOS_HEADER pdosh=(PIMAGE_DOS_HEADER)filebuffer;
        PIMAGE_NT_HEADERS pnth=PIMAGE_NT_HEADERS(filebuffer+pdosh->e_lfanew);
        int sectionnumber=pnth->FileHeader.NumberOfSections;
        int imagebase=pnth->OptionalHeader.ImageBase;
        int sectionalig=pnth->OptionalHeader.SectionAlignment;
        int filealig=pnth->OptionalHeader.FileAlignment;
        int imagesize=pnth->OptionalHeader.SizeOfImage;
        int headersize=pnth->OptionalHeader.SizeOfHeaders;
        int entry=pnth->OptionalHeader.AddressOfEntryPoint;
        //cout<<sectionnumber<<"\t"<<imagebase<<"\t"<<sectionalig<<"\t"<<filealig<<"\t"<<imagesize<<"\t"<<headersize<<endl;

        ////////////////各个区段按照内存对齐粒度依次复制到申请的内存里/////////////////
        PIMAGE_SECTION_HEADER psech=PIMAGE_SECTION_HEADER((int)pnth+sizeof(IMAGE_NT_HEADERS));
        LPVOID membuffer=VirtualAlloc(NULL,imagesize,MEM_RESERVE|MEM_COMMIT,PAGE_EXECUTE_READWRITE);//直接申请可读可写可执行的内存，这样设置区段的内存属性时就省了分区段设置
        memset(membuffer,0,imagesize);
        memcpy(membuffer,filebuffer,headersize);
        for(int i=0;i<sectionnumber;++i){
                memcpy((char*)membuffer+psech->VirtualAddress,filebuffer+psech->PointerToRawData,(psech->Misc.VirtualSize>psech->SizeOfRawData)?psech->SizeOfRawData:psech->Misc.VirtualSize);
                psech++;
        }
        g_hm=(HMODULE)membuffer;

        ////////////修复导入表///////////////////
        PIMAGE_IMPORT_DESCRIPTOR pimh=PIMAGE_IMPORT_DESCRIPTOR((char*)membuffer+pnth->OptionalHeader.DataDirectory[1].VirtualAddress);
        while(pimh->OriginalFirstThunk!=0 && pimh->FirstThunk!=0){//导入表结构体由一个内容全为0的IMAGE_IMPORT_DESCRIPTOR结构作为结束
                char* dllname=(char*)membuffer+pimh->Name;
                //cout<<dllname<<endl;
                HMODULE dllhandle=GetModuleHandle(dllname);
                if(dllhandle==0)
                        dllhandle=LoadLibrary(dllname);
                PIMAGE_THUNK_DATA poritk=PIMAGE_THUNK_DATA((char*)membuffer+pimh->OriginalFirstThunk);
                PIMAGE_THUNK_DATA ptk=PIMAGE_THUNK_DATA((char*)membuffer+pimh->FirstThunk);
                while(poritk->u1.AddressOfData!=NULL){//IMAGE_THUNK_DATA是一个以0结尾的DWORD数组
                        if(poritk->u1.Ordinal&0x80000000)//最高位为1表示以序号方式导入
                                ptk->u1.Function=(DWORD)GetProcAddress(dllhandle,(LPCSTR)(poritk->u1.Ordinal&0x0000FFFF));
                        else{
                                PIMAGE_IMPORT_BY_NAME pbyname=PIMAGE_IMPORT_BY_NAME((char*)membuffer+poritk->u1.AddressOfData);
                                //cout<<pbyname->Name<<endl;
                                ptk->u1.Function=(DWORD)GetProcAddress(dllhandle,LPCSTR(pbyname->Name));
                        }
                        poritk++;
                        ptk++;
                }
                pimh++;
        }

        ///////////////修复重定位表/////////////
        PIMAGE_BASE_RELOCATION preloc=PIMAGE_BASE_RELOCATION((char*)membuffer+pnth->OptionalHeader.DataDirectory[5].VirtualAddress);
        while(preloc->VirtualAddress!=NULL && preloc->SizeOfBlock!=NULL){
                int number=(preloc->SizeOfBlock-8)/2;
                WORD* poffet=(WORD*)((DWORD)preloc+8);
                DWORD* paddress=NULL;
                for(int i=0;i<number;++i){
                        if((poffet[i]&0xF000)==0x3000){//最高位为3代表重定位类型
                                paddress=(DWORD*)((char*)membuffer+preloc->VirtualAddress+(poffet[i]&0x0FFF));
                                //cout<<hex<<paddress<<endl;
                                //cout<<hex<<*paddress<<endl;
                                *paddress=*paddress+(DWORD)membuffer-imagebase;
                                //cout<<hex<<*paddress<<endl;
                        }                
                }
                preloc=PIMAGE_BASE_RELOCATION((DWORD)preloc+preloc->SizeOfBlock);
        }

        /////////////调用dllmain///////////////
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach((PVOID*)&poldgetmodulefilename,newgetmodulefilename);
        DetourTransactionCommit();

        BOOL (__stdcall *pdllmain)(HMODULE,DWORD,LPVOID)=(BOOL (__stdcall *)(HMODULE,DWORD,LPVOID))((char*)membuffer+entry);
        pdllmain((HMODULE)membuffer,DLL_PROCESS_ATTACH,0);
        /*调用VC写的DLLMAIN正常，但是调用易语言写的DLL的DLLMAIN则失败，因为易语言的DLLMAIN里调用了getmodulefilename函数获取dll的名称，因为
        内存加载DLL没有将DLL放到LDR链里去，所以会导致getmodulefilename函数获取DLL名称失败，最后导致调用DLLMAIN失败，因此如果要正常调用易语言
        写的DLL的DLLMAIN就必须要HOOK getmodulefilename函数
        */

        delete[] filebuffer;
        system("pause");
        return 0;
}

DWORD __stdcall newgetmodulefilename(HMODULE hm,LPSTR buffer,DWORD size){
        DWORD len=0;
        if(hm==g_hm){
                strncpy(buffer,g_dllname,strlen(g_dllname));
                return strlen(g_dllname);
        }else{
                len=poldgetmodulefilename(hm,buffer,size);
                return len;
        }
}

朱朱你堕落了

加载DLL有什么用处？或是说妙处? 用于什么场合？

htpidk

朱朱你堕落了 发表于 2020-7-18 17:20
加载DLL有什么用处？或是说妙处? 用于什么场合？

一般用于外挂辅助方面，可以作为一个辅助手段减少被检测风险

njazhe

满满的干货，刚接触编程，努力啃一下

gh0st_

感谢分享