writeprocessmemory_注入dll进程假死_ntopenprocess

To avoid using WriteProcessMemory, we need to find other ways to inject a certain string (e.g. "mypayload.dll") into a foreign process.

This idea is a more creative one, by simply modifying the registers of the foreign process and pushing them to load a string into the stack.

Then we can simply change the EIP to call a certain API (e.g. "LoadLibraryA"), then return to the OEP like nothing happened.

WARNING: This uses static memoryadresses for the used commands like push 0 etc. I already made an memscanner to find out the adresses dynamically, but I wont make it public (ripper detection).

unit prjBypass;

intece

uses

Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,

Dialogs, StdCtrls, tlhelp32;

type

TForm1 = class(TForm)

btn2: TButton;

lbl1: TLabel;

procedure btn2Click(Sender: TObject);

private

{ Private declarations }

public

{ Public declarations }

end;

function OpenThread(dwDesiredAccess: DWord;

bInheritHandle: Bool;

dwThreadId: DWord): DWord; stdcall; external 'kernel32.dll';

function DebugSetProcessKillOnExit(KillOnExit: boolean):boolean; stdcall;external 'kernel32.dll';

var

Form1: TForm1;

implementation

{$R *.dfm}

function HexToInt(HexNum: string): LongInt;

begin

Result:=StrToInt('$' + HexNum);

end;

function WaitForData(dDebug:TDebugEvent):Boolean;

begin

Result := True;

repeat

WaitForDebugEvent(dDebug,INFINITE);

if dDebug.dwDebugEventCode = EXCEPTION_DEBUG_EVENT then

if dDebug.Exception.ExceptionRecord.ExceptionCode = EXCEPTION_SINGLE_STEP then

break;

if dDebug.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT then begin

Result := False;

Exit;

end;

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

until 1=3;

end;

procedure TForm1.btn2Click(Sender: TObject);

var

pi: TProcessInformation;

si: TStartupInfo;

context:_CONTEXT;

dDebug:TDebugEvent;

dwOEP, dwESP, dwEAX, dwECX, dwEBP, dwEDI, dwEBX, dwEDX:DWORD;

begin

FillMemory( @si, sizeof( si ), 0 );

si.cb := sizeof( si );

context.ContextFlags:=CONTEXT_FULL or CONTEXT_FLOATING_POINT or CONTEXT_DEBUG_REGISTERS;

If CreateProcess(Nil,PChar('notepad.exe'),Nil, Nil, False,DEBUG_PROCESS, Nil, Nil, si, pi ) then begin

repeat

WaitForDebugEvent(dDebug,INFINITE);

if dDebug.dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT then

break;

if dDebug.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT then

Exit;

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

until 1=3;

//Set BP on OEP

GetThreadContext(pi.hThread,context);

dwOEP := context.EAX;

context.Dr0 := dwOEP;

context.Dr7 := 1;

SetThreadContext(pi.hThread,context);

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then

Exit;

//We are at OEP

//Save Registers, change EIP to push eax

GetThreadContext(pi.hThread,context);

if context.Eip = dwOEP then begin

context.Dr0 := 0;

context.Dr7 := 0;

//Save Registers

dwEBP := context.Ebp;

dwEAX := context.Eax;

dwEBX := context.Ebx;

dwECX := context.Ecx;

dwEDX := context.Edx;

dwESP := context.Esp;

dwEDI := context.Edi;

context.Eax := HexToInt('00796568');

context.Eip := HexToInt('01007505');

context.EFlags := Context.EFlags or $0100;

SetThreadContext(pi.hThread,context);

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

end else

Exit;

if WaitForData(dDebug) = false then

Exit;

//Mov eax, esp

//Push 0

GetThreadContext(pi.hThread,context);

context.Eip := HexToInt('01002290');

context.Eax := context.Esp;

context.EFlags := Context.EFlags or $0100;

SetThreadContext(pi.hThread,context);

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then

Exit;

//push eax

GetThreadContext(pi.hThread,context);

context.Eip := HexToInt('01001B18');

context.EFlags := Context.EFlags or $0100;

SetThreadContext(pi.hThread,context);

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then

Exit;

//push eax

GetThreadContext(pi.hThread,context);

context.Eip := HexToInt('01001B18');

context.EFlags := Context.EFlags or $0100;

SetThreadContext(pi.hThread,context);

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then

Exit;

//Push 0

GetThreadContext(pi.hThread,context);

context.Eip := HexToInt('01002290');

context.EFlags := Context.EFlags or $0100;

SetThreadContext(pi.hThread,context);

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then

Exit;

//mov eax, messagebox

//call eax

GetThreadContext(pi.hThread,context);

context.Eax := DWORD(GEtProcAddress(LoadLibrary('user32.dll'),'MessageBoxA'));

context.Eip := HexToInt('01002969');

context.Dr0 := context.Eip + 2;

context.Dr7 := 1;

SetThreadContext(pi.hThread,context);

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then

Exit;

GetThreadContext(pi.hThread,context);

//Save Registers

context.Eax := dwEAX;

context.Ebx := dwEBX;

context.Ecx := dwECX;

context.Edx := dwEDX;

context.Esp := dwESP;

context.Edi := dwEDI;

context.Eip := dwOEP;

context.Ebp := dwEBP;

context.Dr0 := 0;

context.Dr7 := 0;

SetThreadContext(pi.hThread,context);

ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

//Detach Process

DebugSetProcessKillOnExit(False);

end;

end;

end.

本文来自电脑杂谈，转载请注明本文网址：
https://www.pc-fly.com/a/jisuanjixue/article-34629-1.html