DLL注入不起作用，沒有從資源管理器行程中彈出訊息框

沒有拋出錯誤，一切似乎都正常執行，除了在行程附加時沒有彈出訊息框。主功能：

int main(int argc, wchar_t** argv){
    
    wchar_t bufdebug[MAX_PATH];

    HANDLE hTargetProcess = findProcess(L"explorer.exe", NULL);
    

    wchar_t dllfullpath[MAX_PATH];
    wchar_t* filepart = new wchar_t[MAX_PATH];
    wchar_t dllname[] = L"HelloWorldDLL.dll";

    GetFullPathName(dllname, MAX_PATH, dllfullpath, (LPWSTR*)&filepart);

    //MessageBox(NULL, dllfullpath, filepart, MB_OK);

    LPVOID lpBufTargetProc = VirtualAllocEx(hTargetProcess, NULL, wcslen(dllfullpath), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if(lpBufTargetProc == nullptr) MessageBox(NULL, L"VEX Failed", NULL, MB_OK);

    size_t nbyteswritten = 0;

    int res = WriteProcessMemory(hTargetProcess, lpBufTargetProc, dllfullpath, wcslen(dllfullpath), &nbyteswritten);
    if(res == FALSE) MessageBox(NULL, L"WPM Failed", NULL, MB_OK);

    wsprintf(bufdebug, L"Bytes Written in target process: %d\n", nbyteswritten);

    //MessageBox(NULL, bufdebug, NULL, MB_OK);

    LPVOID pFuncLLW = (LPVOID)GetProcAddress(LoadLibrary(L"kernel32"), "LoadLibraryW");
    if (pFuncLLW == nullptr) MessageBox(NULL, L"GPA for LLW in kernel32 failed", L"Injection Failed", NULL);

    DWORD threadID = NULL;

    HANDLE hRemoteThread = CreateRemoteThread(hTargetProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)pFuncLLW, lpBufTargetProc, NULL, &threadID);
    if(hRemoteThread == nullptr) MessageBox(NULL, L"CRT Failed", L"Injection Failed", NULL);



    return 0;
}

findProcess 函式（tlhelp32 快照）

HANDLE findProcess(const wchar_t* processName, const DWORD pid)
{
    HANDLE hProcessSnap;
    HANDLE hProcess;
    PROCESSENTRY32 pe32;
    DWORD dwPriorityClass;

    // Take a snapshot of all processes in the system.
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE) {
        return NULL;
    }

    pe32.dwSize = sizeof(PROCESSENTRY32);

    if (!Process32First(hProcessSnap, &pe32)) {
        CloseHandle(hProcessSnap);
        return FALSE;
    }

    if (processName == nullptr && pid != NULL) {
        do {

            if (pe32.th32ProcessID == pid) {

                hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
                if (hProcess != NULL) {
                    return hProcess;
                }
                else {
                    return NULL;
                }
            }

        } while (Process32Next(hProcessSnap, &pe32));
    }
    else if (processName != nullptr && pid == NULL) {
        do {

            if (!wcscmp(pe32.szExeFile, processName)) {

                hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
                if (hProcess != NULL) {
                    return hProcess;
                }
                else {
                    return NULL;
                }
            }

        } while (Process32Next(hProcessSnap, &pe32));
    }
    else return NULL;



    return NULL;
}

注入 HelloWorldDLL.dll 源的 DLL：

#define WIN32_LEAN_AND_MEAN
#include <windows.h>

DWORD WINAPI MessageBoxThread(LPVOID lpParam) {
    MessageBox(NULL, L"Hello world!", L"Hello World!", MB_OK);
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    switch (ul_reason_for_call) {
    case DLL_PROCESS_ATTACH:
        CreateThread(NULL, NULL, MessageBoxThread, NULL, NULL, NULL);
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

我犯了一些愚蠢的錯誤嗎？我已經在 x64 中編譯了兩者。

我已經將除錯字串輸出到所有行程句柄、函式指標、記憶體緩沖區的輸出控制臺，它們似乎都有一些看似有效的值，不知道發生了什么。我嘗試完全關閉 Windows Defender 防病毒軟體，以防萬一。沒運氣。獲取完整路徑名獲取 dll 路徑，一切正常。

uj5u.com熱心網友回復：

當我嘗試你的代碼時，我遇到了兩個問題。第一個是我自己的。我將 DLL 編譯為 32 位而不是 64 位。在 64 位程式中加載 32 位 DLL 是不可能的。所以請確保 DLL 是 64 位的（以及 EXE）。

第二個問題是因為 wcslen()。此函式回傳 WCHAR 的數量，而不是它在記憶體中占用的大小。每個 WCHAR 占用記憶體中的兩個位元組。這在下面的代碼中得到了修復。

我還添加了一個額外的字符以包含零終止字符。在這種情況下不需要特殊性，因為 VirtualAllocEx 將始終分配超過 261 個 WCHAR 并將其初始化為零。但在其他情況下，如果您需要超過 261 個 WCHAR，強烈建議您不要忘記終止零。

進行此更改后，它應該可以作業。

int main(int argc, wchar_t** argv){
    
    wchar_t bufdebug[MAX_PATH];

    HANDLE hTargetProcess = findProcess(L"explorer.exe", NULL);
    

    wchar_t dllfullpath[MAX_PATH];
    wchar_t* filepart = new wchar_t[MAX_PATH];
    wchar_t dllname[] = L"HelloWorldDLL.dll";

    GetFullPathName(dllname, MAX_PATH, dllfullpath, (LPWSTR*)&filepart);

    //MessageBox(NULL, dllfullpath, filepart, MB_OK);

    LPVOID lpBufTargetProc = VirtualAllocEx(hTargetProcess, NULL, (wcslen(dllfullpath) 1)*2, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if(lpBufTargetProc == nullptr) MessageBox(NULL, L"VEX Failed", NULL, MB_OK);

    size_t nbyteswritten = 0;

    int res = WriteProcessMemory(hTargetProcess, lpBufTargetProc, dllfullpath, (wcslen(dllfullpath) 1)*2, &nbyteswritten);
    if(res == FALSE) MessageBox(NULL, L"WPM Failed", NULL, MB_OK);

    wsprintf(bufdebug, L"Bytes Written in target process: %d\n", nbyteswritten);

    //MessageBox(NULL, bufdebug, NULL, MB_OK);

    LPVOID pFuncLLW = (LPVOID)GetProcAddress(LoadLibrary(L"kernel32"), "LoadLibraryW");
    if (pFuncLLW == nullptr) MessageBox(NULL, L"GPA for LLW in kernel32 failed", L"Injection Failed", NULL);

    DWORD threadID = NULL;

    HANDLE hRemoteThread = CreateRemoteThread(hTargetProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)pFuncLLW, lpBufTargetProc, NULL, &threadID);
    if(hRemoteThread == nullptr) MessageBox(NULL, L"CRT Failed", L"Injection Failed", NULL);



    return 0;
}

標籤：C视窗温纳皮dlldll注入

上一篇：Windows如何在關閉時終止沒有視窗或控制臺的應用程式？

下一篇：Google表格根據值鎖定除一列之外的整列