#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <winnt.h>
#include <tlhelp32.h>
#define DIE_IFNOT(cond, msg) if(!(cond)) fprintf(stderr, "%s\n", msg), exit(1);
void DisplayImportTableEx(HANDLE hProcess, HMODULE hModImage);
HMODULE RemoteGetModuleHandle(DWORD dwProcessId, LPCSTR lpModuleName);
FARPROC RemoteGetProcAddress(HMODULE hModule, HMODULE hModuleRemote, LPCSTR lpProcName);
extern "C" __declspec(dllexport) int PrintInput();
static DWORD dwCRT; // address of CreateRemoteThread
BOOL WINAPI DllMain(HINSTANCE hInstdll,DWORD fwdReason, LPVOID lpvReserved)
{
switch (fwdReason)
{
case DLL_PROCESS_ATTACH:
PrintInput();
break;
}
return TRUE;
}
extern "C" __declspec(dllexport) int PrintInput()
{
DWORD dwProcessId;
printf("Process ID (Current = %d): ", GetCurrentProcessId());
if (scanf("%u", &dwProcessId) < 1) return 1;
HMODULE hModRemote;
printf("EXE/DLL Base Address: 0x");
if (scanf("%p", &hModRemote) < 1) return 1;
CreateRemoteThread(0, 0, 0, 0, 0, 0, 0); // Test
dwCRT = (DWORD)RemoteGetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), RemoteGetModuleHandle(dwProcessId, "kernel32.dll"), "CreateRemoteThread");
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
DisplayImportTableEx(hProcess, hModRemote);
CloseHandle(hProcess);
}
void DisplayImportTableEx(HANDLE hProcess, HMODULE hModImage)
{
DWORD cbRead;
IMAGE_DOS_HEADER idh;
DIE_IFNOT(ReadProcessMemory(hProcess, hModImage, &idh, sizeof idh, &cbRead), "[!] Failed to read process memory!");
DIE_IFNOT(idh.e_magic == IMAGE_DOS_SIGNATURE, "[!] Invalid DOS Signature!");
IMAGE_NT_HEADERS inh;
DIE_IFNOT(ReadProcessMemory(hProcess, (PCHAR)hModImage + idh.e_lfanew, &inh, sizeof inh, &cbRead), "[!] Failed to read process memory!");
DIE_IFNOT(inh.Signature == IMAGE_NT_SIGNATURE, "[!] Invalid PE Signature!");
IMAGE_DATA_DIRECTORY dirImport = inh.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
DIE_IFNOT(dirImport.VirtualAddress && dirImport.Size, "[!] No Import Table Found!");
PIMAGE_IMPORT_DESCRIPTOR lpImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((PCHAR)hModImage + dirImport.VirtualAddress);
IMAGE_IMPORT_DESCRIPTOR impDesc;
DIE_IFNOT(ReadProcessMemory(hProcess, lpImportDesc, &impDesc, sizeof impDesc, &cbRead), "[!] Failed to read process memory!");
while (impDesc.Characteristics) {
CHAR szImportDllName[MAX_PATH];
DIE_IFNOT(ReadProcessMemory(hProcess, (PCHAR)hModImage + impDesc.Name, szImportDllName, sizeof szImportDllName, &cbRead), "[!] Failed to read process memory!");
printf("[+] %s\n", szImportDllName);
PIMAGE_THUNK_DATA lpImportThunk = (PIMAGE_THUNK_DATA)((PCHAR)hModImage + lpImportDesc->FirstThunk);
IMAGE_THUNK_DATA impThunk;
DIE_IFNOT(ReadProcessMemory(hProcess, lpImportThunk, &impThunk, sizeof impThunk, &cbRead), "[!] Failed to read process memory!");
while (impThunk.u1.Function) {
printf("\t[+] Function: 0xlX", impThunk.u1.Function);
if ((DWORD)impThunk.u1.Function == dwCRT) {
printf(" (Gotcha! This is CreateRemoteThread)");
}
putchar('\n');
DIE_IFNOT(ReadProcessMemory(hProcess, ++lpImportThunk, &impThunk, sizeof impThunk, &cbRead), "[!] Failed to read process memory!");
}
DIE_IFNOT(ReadProcessMemory(hProcess, ++lpImportDesc, &impDesc, sizeof impDesc, &cbRead), "[!] Failed to read process memory!");
}
}
HMODULE RemoteGetModuleHandle(DWORD dwProcessId, LPCSTR lpModuleName) {
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
if (hSnapshot != INVALID_HANDLE_VALUE) {
MODULEENTRY32 me = { sizeof(MODULEENTRY32) };
BOOL bRet = Module32First(hSnapshot, &me);
while (bRet) {
if (!strcmpi((const char *)me.szModule, lpModuleName))
return me.hModule;
bRet = Module32Next(hSnapshot, &me);
}
CloseHandle(hSnapshot);
}
return NULL;
}
FARPROC RemoteGetProcAddress(HMODULE hModule, HMODULE hModuleRemote, LPCSTR lpProcName) {
FARPROC fp = GetProcAddress(hModule, lpProcName);
if (!fp) return NULL;
return (FARPROC)((PCHAR)fp - (PCHAR)hModule + (PCHAR)hModuleRemote);
}
--------------
DLL 이렇게 만들었는데 메인에선 인젝션 성공했다고 나오는데.. 성공 되면 ID하고 주소 입력받는게 떠야하는데 그게 안떠요
댓글 0