将 C++ dll 注入器转换为 unicode

Question

好吧，我已经运行并测试了 website 上给出的解决方案，结果是积极的。

现在我已经将其转换为 win32 unicode 项目，没有任何编译错误或运行时错误（它甚至说它注入了 dll）。没有任何明显的错误，除了 dll 在注入后没有执行之外，一切似乎都很好。

请记住，如果未设置 Injectors 字符集，Dll 会工作，但如果转换为 unicode，则不会。我什至将 dll 转换为 unicode 只是为了测试并且它适用于 NON unicode Injector。考虑到这一点，我得出的结论是问题出在转换后的喷油器上。

如果需要更多信息，请随时询问。你可能还会问，为什么要转成unicode呢？这是我个人的喜好。由于我没有自己编写代码，因此转换确实有助于我学习代码。

我确实擦除第二个函数，但该函数从未被调用过，几乎没有用。除了使用不同的变量类型外，它是相同的功能。转换在擦除之前不起作用。

这段代码有什么问题吗？我认为问题出在 Injector.cpp

**现在我认为它是 DLL。将 kernel32.dll 更改为随机值后，我确实通过 GetLastError() 错误 127 收到了预期的错误。但随后其中的程序被注入崩溃。这意味着注入了 dll。 ** 因此，经过深思熟虑后，我在没有向等式中添加 dll 的情况下进行了测试，抛出了相同的错误以及崩溃。似乎它正在注入但它没有注入 dll。 ** DLL_NAME 正在加载到函数中。 wcslen(DLL_NAME) 正在返回一个值，以及 RemoteString（没有加载 dll 时为 0）。
话虽这么说，我已经包括 Dllmain.cpp

// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
#include <Windows.h>
#include <string.h>
#include <stdio.h>

BOOL APIENTRY DllMain(HMODULE hModule,
DWORD  ul_reason_for_call,
LPVOID lpReserved
)
{
wchar_t* helloStr;
wchar_t buf[250];

switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
    helloStr = L"Hello";
    wsprintf(buf, helloStr);
    MessageBoxW(NULL, buf, NULL, NULL);
    break;
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
    helloStr = L"Goodbye";
    wsprintf(buf, helloStr);
    MessageBoxW(NULL, buf, NULL, NULL);
    break;
}
return TRUE;
}

Injector.cpp

#include "stdafx.h"

#include <windows.h>
#include <tlhelp32.h>
#include <shlwapi.h>
#include <conio.h>
#include <stdio.h> 
#include <iostream>
#include "Resource.h"


Injector::Injector(void)
{
}


Injector::~Injector(void)
{
}

#define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ) 

bool Injector::Inject(wchar_t* procName, wchar_t* DLL_NAME)
{
    DWORD pID = GetTargetThreadIDFromProcName(procName);


    HANDLE Proc = 0;
    HMODULE hLib = 0;
    wchar_t buf[50] = { 0 };
    LPVOID RemoteString, LoadLibAddy;

    if (!pID)
        return false;

    Proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);

    if (!Proc)
    {
        swprintf_s(buf, L"OpenProcess() failed: %d", GetLastError());
        MessageBoxW(NULL, buf, L"Loader", MB_OK);
        wprintf(buf);
        return false;
    }

    LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "LoadLibraryW");

    // Allocate space in the process for our DLL 
    RemoteString = (LPVOID)VirtualAllocEx(Proc, NULL, wcslen(DLL_NAME), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

    // Write the string name of our DLL in the memory allocated 
    WriteProcessMemory(Proc, (LPVOID)RemoteString, DLL_NAME, wcslen(DLL_NAME), NULL);

    // Load our DLL 
    CreateRemoteThread(Proc, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL);

    CloseHandle(Proc);
    return true;
}



DWORD Injector::GetTargetThreadIDFromProcName(wchar_t* ProcName)
{
    PROCESSENTRY32 pe;
    HANDLE thSnapShot;
    BOOL retval = false;

    thSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (thSnapShot == INVALID_HANDLE_VALUE)
    {
        MessageBoxW(NULL, L"Error: Unable to create toolhelp snapshot!", L"2MLoader", MB_OK);

        return false;
    }

    pe.dwSize = sizeof(PROCESSENTRY32);

    retval = Process32First(thSnapShot, &pe);
    while (retval)
    {
        if (!wcscmp(pe.szExeFile, ProcName))
        {
            return pe.th32ProcessID;
        }
        retval = Process32Next(thSnapShot, &pe);
    }
    return 0;
}

Resource.h

#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS

#define _APS_NO_MFC                 130
#define _APS_NEXT_RESOURCE_VALUE    129
#define _APS_NEXT_COMMAND_VALUE     32771
#define _APS_NEXT_CONTROL_VALUE     1000
#define _APS_NEXT_SYMED_VALUE       110
#endif
#endif
#pragma once
#include <Windows.h>

class Injector
{
public:
    Injector(void);
    ~Injector(void);

    bool Inject(wchar_t* procName, wchar_t* DLL_NAME);


private:
    DWORD GetTargetThreadIDFromProcName(wchar_t * ProcName);
};

Main.cpp

// DLL_Injector_WIN32.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include "DLL_Injector_WIN32.h"
#include <Commdlg.h>
#include <iostream>
#include <Windows.h>
#include "Resource.h"

#define MAX_LOADSTRING 100
Injector* injector = new Injector();
// Global Variables:
HINSTANCE hInst;                                // current instance
TCHAR szTitle[MAX_LOADSTRING];                  // The title bar text
TCHAR szWindowClass[MAX_LOADSTRING];            // the main window class name
wchar_t szFile[MAX_PATH];
LPTSTR PROC_NAME = new TCHAR[1024];

// Forward declarations of functions included in this code module:
ATOM                MyRegisterClass(HINSTANCE hInstance);
BOOL                InitInstance(HINSTANCE, int);
LRESULT CALLBACK    WndProc(HWND, UINT, WPARAM, LPARAM);
INT_PTR CALLBACK    About(HWND, UINT, WPARAM, LPARAM);
BOOL                FileOpen(HWND hwnd);
int                 start(wchar_t* DLL_PATH, wchar_t* PROC_NAME);

int APIENTRY _tWinMain(_In_ HINSTANCE hInstance,
                     _In_opt_ HINSTANCE hPrevInstance,
                     _In_ LPTSTR    lpCmdLine,
                     _In_ int       nCmdShow)
{
    UNREFERENCED_PARAMETER(hPrevInstance);
    UNREFERENCED_PARAMETER(lpCmdLine);

    // TODO: Place code here.
    MSG msg;
    HACCEL hAccelTable;

    // Initialize global strings
    LoadString(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);
    LoadString(hInstance, IDC_DLL_INJECTOR_WIN32, szWindowClass, MAX_LOADSTRING);
    MyRegisterClass(hInstance);

    // Perform application initialization:
    if (!InitInstance (hInstance, nCmdShow))
    {
        return FALSE;
    }

    hAccelTable = LoadAccelerators(hInstance, MAKEINTRESOURCE(IDC_DLL_INJECTOR_WIN32));

    // Main message loop:
    while (GetMessage(&msg, NULL, 0, 0))
    {
        if (!TranslateAccelerator(msg.hwnd, hAccelTable, &msg))
        {
            TranslateMessage(&msg);
            DispatchMessage(&msg);
        }
    }

    return (int) msg.wParam;
}



//
//  FUNCTION: MyRegisterClass()
//
//  PURPOSE: Registers the window class.
//
ATOM MyRegisterClass(HINSTANCE hInstance)
{
    WNDCLASSEX wcex;

    wcex.cbSize = sizeof(WNDCLASSEX);

    wcex.style          = CS_HREDRAW | CS_VREDRAW;
    wcex.lpfnWndProc    = WndProc;
    wcex.cbClsExtra     = 0;
    wcex.cbWndExtra     = 0;
    wcex.hInstance      = hInstance;
    wcex.hIcon          = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_DLL_INJECTOR_WIN32));
    wcex.hCursor        = LoadCursor(NULL, IDC_ARROW);
    wcex.hbrBackground  = (HBRUSH)(COLOR_WINDOW+1);
    wcex.lpszMenuName   = MAKEINTRESOURCE(IDC_DLL_INJECTOR_WIN32);
    wcex.lpszClassName  = szWindowClass;
    wcex.hIconSm        = LoadIcon(wcex.hInstance, MAKEINTRESOURCE(IDI_SMALL));

    return RegisterClassEx(&wcex);
}

//
//   FUNCTION: InitInstance(HINSTANCE, int)
//
//   PURPOSE: Saves instance handle and creates main window
//
//   COMMENTS:
//
//        In this function, we save the instance handle in a global variable and
//        create and display the main program window.
//
BOOL InitInstance(HINSTANCE hInstance, int nCmdShow)
{
   HWND hWnd;

   hInst = hInstance; // Store instance handle in our global variable


      hWnd = CreateWindowEx(
       WS_EX_CLIENTEDGE,
       szWindowClass,
       szTitle,
       WS_OVERLAPPEDWINDOW,
       CW_USEDEFAULT, CW_USEDEFAULT, 350, 100,
       NULL, NULL, hInstance, NULL);

   if (!hWnd)
   {
      return FALSE;
   }

   ShowWindow(hWnd, nCmdShow);
   UpdateWindow(hWnd);

   return TRUE;
}

//
//  FUNCTION: WndProc(HWND, UINT, WPARAM, LPARAM)
//
//  PURPOSE:  Processes messages for the main window.
//
//  WM_COMMAND  - process the application menu
//  WM_PAINT    - Paint the main window
//  WM_DESTROY  - post a quit message and return
//
//
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
    int wmId, wmEvent;
    PAINTSTRUCT ps;
    HDC hdc;

    switch (message)
    {
    case WM_CREATE:
        CreateWindowEx(
            WS_EX_CLIENTEDGE,
            L"BUTTON",
            L"Inject",
            WS_CHILD | WS_VISIBLE | WS_EX_CLIENTEDGE,
            280, 10, 45, 25,
            hWnd, (HMENU)IDC_INJECT, ((LPCREATESTRUCT)lParam)->hInstance, NULL);
        CreateWindowEx(
            WS_EX_CLIENTEDGE,
            L"BUTTON",
            L"DLL",
            WS_CHILD | WS_VISIBLE | WS_EX_CLIENTEDGE,
            240, 10, 35, 25,
            hWnd, (HMENU)IDC_DLL, ((LPCREATESTRUCT)lParam)->hInstance, NULL);
        CreateWindowEx(
            WS_EX_CLIENTEDGE,
            L"EDIT",
            L"",
            WS_CHILD | WS_VISIBLE | WS_EX_CLIENTEDGE | ES_AUTOHSCROLL,
            65, 10, 170, 25,
            hWnd, (HMENU)IDC_PROCESS, ((LPCREATESTRUCT)lParam)->hInstance, NULL);
        CreateWindowEx(
            0,
            L"STATIC",
            L"Process",
            WS_CHILD | WS_VISIBLE,
            5, 10, 55, 25,
            hWnd, (HMENU)NULL, ((LPCREATESTRUCT)lParam)->hInstance, NULL);
        break;

    case WM_COMMAND:
        wmId    = LOWORD(wParam);
        wmEvent = HIWORD(wParam);
        // Parse the menu selections:
        switch (wmId)
        {
        case IDC_DLL:
        {
            FileOpen(hWnd);
//          MessageBox(NULL, szFile, L"TEST", NULL);
        }
        break;
        case IDC_INJECT:
        {
            GetDlgItemText(hWnd, IDC_PROCESS, PROC_NAME, 1024);

            start(szFile, PROC_NAME);
        }
        break;
        case IDM_ABOUT:
            DialogBox(hInst, MAKEINTRESOURCE(IDD_ABOUTBOX), hWnd, About);
            break;
        case IDM_EXIT:
            DestroyWindow(hWnd);
            break;
        default:
            return DefWindowProc(hWnd, message, wParam, lParam);
        }
        break;
    case WM_PAINT:
        hdc = BeginPaint(hWnd, &ps);
        // TODO: Add any drawing code here...
        EndPaint(hWnd, &ps);
        break;
    case WM_DESTROY:
        PostQuitMessage(0);
        break;
    default:
        return DefWindowProc(hWnd, message, wParam, lParam);
    }
    return 0;
}

// Message handler for about box.
INT_PTR CALLBACK About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
    UNREFERENCED_PARAMETER(lParam);
    switch (message)
    {
    case WM_INITDIALOG:
        return (INT_PTR)TRUE;

    case WM_COMMAND:
        if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL)
        {
            EndDialog(hDlg, LOWORD(wParam));
            return (INT_PTR)TRUE;
        }
        break;
    }
    return (INT_PTR)FALSE;
}
BOOL FileOpen(HWND hwnd)
{
    OPENFILENAME ofn;

    HANDLE hf;


    ZeroMemory(&ofn, sizeof(ofn));
    ofn.lStructSize = sizeof(ofn);
    ofn.hwndOwner = hwnd;
    ofn.lpstrFile = szFile;


    ofn.lpstrFile[0] = '[=13=]';
    ofn.nMaxFile = sizeof(szFile);
    ofn.lpstrFilter = L"DLL[=13=]*.dll[=13=]";
    ofn.nFilterIndex = 1;
    ofn.lpstrFileTitle = NULL;
    ofn.nMaxFileTitle = 0;
    ofn.lpstrInitialDir = NULL;
    ofn.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST;




    if (GetOpenFileNameW(&ofn) == TRUE)
    {
        //CheckDlgButton(hwnd, IDC_PASS_LIST, BST_UNCHECKED);

        hf = CreateFile(ofn.lpstrFile,
            GENERIC_READ,
            FILE_SHARE_READ,
            (LPSECURITY_ATTRIBUTES)NULL,
            OPEN_EXISTING,
            FILE_ATTRIBUTE_NORMAL,
            (HANDLE)NULL);
        return TRUE;
        if (hf == (HANDLE)-1)
        {

            MessageBox(NULL, L"Could not open this file", L"File I/O Error", MB_ICONSTOP);
            return FALSE;
        }




    }
    else
    {

        return FALSE;
    }
}
int start(wchar_t* DLL_PATH, wchar_t* PROC_NAME)
{


    WCHAR dllDir[MAX_PATH];

    wcscpy_s(dllDir, MAX_PATH, DLL_PATH);

    //MessageBox(NULL, dllDir, L"DLL path: ", MB_ICONSTOP);
    //MessageBox(NULL, PROC_NAME, L"Process: ", MB_ICONSTOP);

    if (injector->Inject(PROC_NAME, dllDir)){

        MessageBox(NULL, L"DLL injected!", L"DLL injected!", MB_ICONSTOP);
    }
    else {
        MessageBox(NULL, L"Failed to inject the dll...", L"File I/O Error", MB_ICONSTOP);
    }


    return 0;
}

Answer 1

原来 WriteProcessMemory 想要 DLL_NAME 成为 char。在新的 variable 中将 wchar_t* 转换为 char，现在我没有问题了。

将 C++ dll 注入器转换为 unicode

Converting C++ dll injector into unicode

c++

unicode

dll