C＃中的Dll注入不起作用

Question

我有以下代码。

    using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Threading;
using ClassLibrary1;

namespace Injection
{
    class Program
    {
        static void Main(string[] args)
        {
            //ClassLibrary1.Class1.Main();
            Program p = new Program();
            String strDLLName = "C:\\Users\\pente\\Documents\\Visual Studio 2015\\Projects\\Injection\\ClassLibrary1\\obj\\Debug\\ClassLibrary1.dll";
            String strProcessName = "notepad";

            Int32 ProcID = p.GetProcessId(strProcessName);
            if (ProcID >= 0)
            {
                IntPtr hProcess = (IntPtr)OpenProcess(0x1F0FFF, 1, ProcID);
                if (hProcess == null)
                {
                   Console.WriteLine("OpenProcess() Failed!");
                    return;
                }
                else
                    p.InjectDLL(hProcess, strDLLName);
            }
        }

        public void InjectDLL(IntPtr hProcess, String strDLLName)
        {
            IntPtr bytesout;

            // Length of string containing the DLL file name +1 byte padding 
            Int32 LenWrite = strDLLName.Length + 1;
            // Allocate memory within the virtual address space of the target process 
            IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory 

            // Write DLL file name to allocated memory in target process 
            WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
            // Function pointer "Injector" 
            UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

            if (Injector == null)
            {
                Console.WriteLine(" Injector Error! \\n ");
                // return failed 
                return;
            }

            // Create thread in target process, and store handle in hThread 
            IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);
            // Make sure thread handle is valid 
            if (hThread == null)
            {
                //incorrect thread handle ... return failed 
                Console.WriteLine(" hThread [ 1 ] Error! \\n ");
                return;
            }
            // Time-out is 10 seconds... 
            int Result = WaitForSingleObject(hThread, 10 * 1000);
            // Check whether thread timed out... 
            if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
            {
                /* Thread timed out... */
                Console.WriteLine(" hThread [ 2 ] Error! \\n ");
                // Make sure thread handle is valid before closing... prevents crashes. 
                if (hThread != null)
                {
                    //Close thread in target process 
                    CloseHandle(hThread);
                }
                return;
            }
            // Sleep thread for 1 second 
            Thread.Sleep(1000);
            // Clear up allocated space ( Allocmem ) 
            VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
            // Make sure thread handle is valid before closing... prevents crashes. 
            if (hThread != null)
            {
                //Close thread in target process 
                CloseHandle(hThread);
            }
            // return succeeded 
            return;
        }
        [DllImport("kernel32")]
        public static extern IntPtr CreateRemoteThread(
      IntPtr hProcess,
      IntPtr lpThreadAttributes,
      uint dwStackSize,
      UIntPtr lpStartAddress, // raw Pointer into remote process 
      IntPtr lpParameter,
      uint dwCreationFlags,
      out IntPtr lpThreadId
    );

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(
            UInt32 dwDesiredAccess,
            Int32 bInheritHandle,
            Int32 dwProcessId
            );

        [DllImport("kernel32.dll")]
        public static extern Int32 CloseHandle(
        IntPtr hObject
        );

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern bool VirtualFreeEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            UIntPtr dwSize,
            uint dwFreeType
            );

        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
        public static extern UIntPtr GetProcAddress(
            IntPtr hModule,
            string procName
            );

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            uint dwSize,
            uint flAllocationType,
            uint flProtect
            );

        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            string lpBuffer,
            UIntPtr nSize,
            out IntPtr lpNumberOfBytesWritten
        );

        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern IntPtr GetModuleHandle(
            string lpModuleName
            );

        [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
        internal static extern Int32 WaitForSingleObject(
            IntPtr handle,
            Int32 milliseconds
            );

        public Int32 GetProcessId(String proc)
        {
            Process[] ProcList;
            ProcList = Process.GetProcessesByName(proc);
            return ProcList[0].Id;
        }
    }
}

上面的代码是我的主程序。我有一个dll，其代码如下图所示，我尝试注入记事本。

    using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace ClassLibrary1
{
    public class Class1
    {
        public static void Main()
        {
            Console.WriteLine("Succeeded!!");
            Console.ReadLine();
        }

    }
}

我添加了库代码作为主代码的dll引用。

代码运行，基本上什么都不做。我错过了什么？为什么它不起作用？

Answer 1

您的代码尝试调用本机库但链接到.NET库，因此您的.NET库Main永远不会被调用。所以最好的解决方案是创建一个本机库（例如C ++）并将.Net Framework加载到您的宿主程序中，然后运行托管的Main-Method。

tl; dr：LoadLibrary等仅加载本机库