Delphi通过开启远程线程注射DLL至目标进程

 unit Inject;

interface

uses Windows, SysUtils, Messages, Classes;

//再目标进程中申请空间，写入注射代码后 ，开启远程线程以执行

function InjectDll(pid: thandle; dllname: string; timeout: cardinal = 7000):

boolean;

//参数 pid 进程ID ，dllname 欲注射dll的名字

//调用样例 InjectDll(pid,'./inject.dll');

//原理 使得目标进程通过API函数LoadLibraryA主动加载欲注射的DLL。

var

RemoteCode: array[0..18] of char = (#$60, #$9C, #$B8, #$88, #$77, #$66, #$55,

#$BA, #$44, #$33, #$22, #$11, #$52, #$FF, #$D0, #$9D, #$61, #$C3, #$00);

{

注射的代码

60 pushad

9C pushfd

B8 88776655 mov eax, 55667788

BA 44332211 mov edx, 11223344

52 push edx

FFD0 call eax

9D popfd

61 popad

C3 retn

}

implementation

function InjectDll(pid: thandle; dllname: string; timeout: cardinal = 7000):

boolean;

var

Rpid: thandle;

RemotePoint, RemoteFilename: pointer;

LoadLibptr: pointer;

rcode: longbool;

temp: cardinal;

threadid: cardinal;

begin

result := false;

Rpid := OpenProcess(PROCESS_ALL_ACCESS, false, pid); //打开目标进程

if Rpid = 0 then

exit; //打开失败则退出

RemoteFilename := VirtualAllocEx(Rpid, nil, length(dllname) + 1, MEM_COMMIT,

PAGE_READWRITE);

//在目标进程中申请空间 大小为欲注射dll名字长度+1 权限为可读写

if RemoteFilename = nil then

begin

CloseHandle(Rpid);

exit; //申请空间失败则退出

end;

rcode := WriteProcessMemory(Rpid, RemoteFileName, @dllname[1],

length(dllname), temp);

//将欲注射dll名字写入刚刚已经申请的空间中

if not rcode then

begin

CloseHandle(rpid);

exit; //写入失败则退出

end;

LoadLibptr := GetProcAddress(GetModuleHandle('Kernel32.dll'), 'LoadLibraryA');

//获取LoadLibraryA函数的地址指针

if LoadLibptr = nil then

begin

CloseHandle(rpid);

exit; //获取失败则退出

end;

RemotePoint := VirtualAllocEx(Rpid, nil, sizeof(RemoteCode) + 1, MEM_COMMIT,

PAGE_EXECUTE_READWRITE);

//在目标进程中申请空间 大小为注射代码的字节数+1 权限为可执行可读写

if RemotePoint = nil then

begin

CloseHandle(rpid);

exit; //申请失败则退出

end;

{

注射的代码

60 pushad

9C pushfd

B8 88776655 mov eax, 55667788

BA 44332211 mov edx, 11223344

52 push edx

FFD0 call eax

9D popfd

61 popad

C3 retn

}

CopyMemory(@RemoteCode[3], @LoadLibptr, 4);

//将LoadLibraryA的地址指针(4字节)写入 将如上88776655覆盖

CopyMemory(@RemoteCode[8], @RemoteFilename, 4);

//将dll名字的首地址指针(4字节)写入 将如上44332211覆盖

rcode := WriteProcessMemory(Rpid, RemotePoint, @RemoteCode[0],

sizeof(Remotecode), temp); //将注射代码写入申请的空间中

if rcode then

begin

result := CreateRemoteThread(rpid, nil, 0, RemotePoint, nil, 0, threadid) <>

0; //写入成功则开启一个远程线程执行

CloseHandle(rpid);

end;

end;

end.