Question

我简化了UWP应用和桌面应用。此代码将ConsoleApplication1.dll文件注入到桌面是正常的，但是我无法注入UWP应用。我有两个问题：为什么此代码无法注入到UWP应用？以及如何解决？

此代码注入DLL文件

#include "pch.h"
#include <vector>
#include <string>
#include <windows.h>
#include <Tlhelp32.h>

using std::vector;
using std::string;

int main(void)
{
while (true)
{
    vector<string>processNames;
    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(PROCESSENTRY32);
    HANDLE hTool32 = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    BOOL bProcess = Process32First(hTool32, &pe32);
    if (bProcess == TRUE)
    {
        while ((Process32Next(hTool32, &pe32)) == TRUE)
        {
            processNames.push_back(pe32.szExeFile);
            if (strcmp(pe32.szExeFile, "ConsoleApplication4.exe") == 0 || strcmp(pe32.szExeFile, "UWP.exe") == 0)
            {
                printf("Hooked %s, %d \n", pe32.szExeFile, pe32.th32ProcessID);
                char* DirPath = new char[MAX_PATH];
                char* FullPath = new char[MAX_PATH];
                GetCurrentDirectory(MAX_PATH, DirPath);
                sprintf_s(FullPath, MAX_PATH, "%s\\..\\ConsoleApplication1\\ConsoleApplication1.dll", DirPath);
                FILE *pFile;
                if (fopen_s(&pFile, FullPath, "r") || !pFile)
                {
                    OutputDebugString("[Hook] File name or file does not exist");
                    OutputDebugString(FullPath);
                    return -1;
                }
                fclose(pFile);

                HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
                LPVOID LoadLibraryAddr = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
                LPVOID LLParam = (LPVOID)VirtualAllocEx(hProcess, NULL, strlen(FullPath), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

                bool result = WriteProcessMemory(hProcess, LLParam, FullPath, strlen(FullPath), NULL);
                CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibraryAddr, LLParam, NULL, NULL);

                CloseHandle(hProcess);
                delete[] DirPath;
                delete[] FullPath;

                OutputDebugString("[Hook] Hooked success");

                system("pause");

                return 0;
            }
        }
    }
    CloseHandle(hTool32);
}
return 0;
}

谢谢

Answer 1

这是为UWP流程设计的。 UWP appcontainer不允许动态加载不属于部署程序包的代码。

Answer 2

DLL注入UWP应用程序与注入Win32程序没有什么不同。相同的技术和通用的DLL注入器将适用于UWP应用。但是，如果只是尝试将任何常规DLL注入到UWP应用中，则该DLL可能不会加载。这样做的原因是因为ALL APPLICATION PACKAGES组必须对要注入的DLL具有读取和执行权限。

要手动设置这些权限：右键单击DLL，进入属性，转到安全性选项卡，单击“编辑”，单击“添加”，在弹出的对话框中键入“ ALL”，然后单击“确定”。在英语系统上，这会将所有应用程序包添加到默认情况下启用读/执行的权限列表中；对于非英语系统，该组的名称将有所不同。

https://www.unknowncheats.me/forum/general-programming-and-reversing/177183-basic-intermediate-techniques-uwp-app-modding.html

谢谢

将dll文件注入UWP

2 个答案: