Question

我正在尝试做一些dll注入。我想我尽我所能，但不幸的是没有解决问题。我总是得到ERROR CODE 127，这意味着ERROR_PROC_NOT_FOUND。我使用的是Windows 7 64位。

#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>

using namespace std;

char FileToInject[] = "theDll.dll";
char ProcessName[] = "calc.exe";

typedef HINSTANCE (*fpLoadLibrary)(char*);

bool InjectDLL(DWORD processId);

int main() {
    DWORD processId = NULL;

    PROCESSENTRY32 pre32 = {sizeof(PROCESSENTRY32)};
    HANDLE hProcSnap;
    cout << "BEFORECreateToolhelo32Snapshot:" << GetLastError() <<endl;
    while(!processId) {

            system("CLS");
            cout << "Searching..." << endl;
            hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
            cout << "CreateToolhelo32Snapshot:" << GetLastError() <<endl;

            if(Process32First(hProcSnap, &pre32)) {

                    do {

                        if(!(strcmp(pre32.szExeFile, ProcessName))) {

                           processId = pre32.th32ProcessID;
                           break;

                        }

                    }
                    while(Process32Next(hProcSnap, &pre32));
            }
            Sleep(1000);
    }
    cout << GetLastError() <<endl;
    while(!InjectDLL(processId)) {
        cout << "DLL Injection failed" << endl;
        Sleep(1000);
    }

    cout << "DLL Injected successfully" << endl;
    getchar();
    CloseHandle(hProcSnap);

    return 0;
}

bool InjectDLL(DWORD processId) {

    HANDLE hProc;
    LPVOID paramAddr;
    cout << "START:" << GetLastError() <<endl;
    HINSTANCE hDll = LoadLibrary("KERNEL32");
    cout << "LoadLibrary:" << GetLastError() <<endl;

    fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");
    cout << "LoadLibraryArr:" << GetLastError() <<endl;
    hProc = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
    cout << "OpenProcess:" << GetLastError() <<endl;
    char DllPath[250] = "C:\\Hacks\test.dll";

    paramAddr = VirtualAllocEx(hProc, 0, strlen(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
    cout << "VirtualAlloxEx:" <<GetLastError() <<endl;
    bool MemoryWritten = WriteProcessMemory(hProc, paramAddr, DllPath, strlen(DllPath) + 1, NULL);
    cout << "WriteProcessMemory:" << GetLastError() <<endl;
    CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryAddr, paramAddr, 0, 0);
    cout << "CreateRemoteThread:" <<GetLastError() <<endl;
    CloseHandle(hProc);
    return MemoryWritten;
}

输出如下：

Searching...
CreateToolhelp32Snapshot: 18 ERROR_NO_MORE_FILES
LoadLibrary:18 ERROR_NO_MORE_FILES
LoadLibraryArr:127 ERROR_PROC_NOT_FOUND
OpenProcess:127 ERROR_PROC_NOT_FOUND
VirtualAlloxEx:127 ERROR_PROC_NOT_FOUND
WriteProcessMemory:127 ERROR_PROC_NOT_FOUND
CreateRemoteThread:5 ACCESS DENIED
DLL Injected successfully

程序发现calc.exe作为一个没有问题的进程，但在那之后出现了问题。有人可以帮帮我吗？

谢谢，

的Tamas

Answer 1

这是一个问题：

char DllPath[250] = "C:\\Hacks\test.dll";

最后一个反斜杠未转义。改为：

char DllPath[250] = "C:\\Hacks\\test.dll";

该功能称为LoadLibraryA()，而不是LibraryLoadA()：

fpLoadLibrary LoadLibraryAddr =
    (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");

其他一些建议：

仅检查GetLastError()以前的WINAPI功能是否失败。
如果先前的WINAPI代码（或其他代码）成功，则仅继续处理。

Answer 2

在

fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");

您应该解析字符串LoadLibraryA。在

OpenProcess:127 ERROR_PROC_NOT_FOUND
VirtualAlloxEx:127 ERROR_PROC_NOT_FOUND (<-- sic)
WriteProcessMemory:127 ERROR_PROC_NOT_FOUND

错误是由于您使用GetLastError引起的，即使这些功能可能甚至没有失败。因此，在调用GetLastError之前，请确保这些函数产生错误返回值（NULL等）。

DLL注入失败，代码为127

2 个答案: