DLL劫持技术

00401496   EB 29    jmp     short 004014C1

unsigned char p401496[2] = {0xEB, 0x29};IXPUB技术博客6S!Q*[3u)f
lU
WriteProcessMemory(hProcess,(LPVOID)0x401496, p401496, 2, NULL);

#pragma comment(linker, "/EXPORT:SomeFunc=DllWork.someOtherFunc")

#pragma comment(linker, "/EXPORT:WSAStartup=_MemCode_WSAStartup,@115")

ALCDECL MemCode_WSAStartup(void)IXPUB技术博客8h:d8j.rV}
{
+F
Nm8q%xN$G'?"d+f"N0GetAddress("WSAStartup");IXPUB技术博客-@^S?
Q
__asm JMP EAX;//转到系统ws2_32.dll的WSAStartup输出函数
b[*vo#uGK0ZA0}

// MemCode 命名空间IXPUB技术博客{\	Rc!Y4DQ
namespace MemCode
*D"J'Qd0lK+H'zko9C8x0@0{IXPUB技术博客7hBxPd'_8T
HMODULE m_hModule = NULL;     //原始模块句柄
|hm;j5I0DWORD m_dwReturn[500] = {0};     //原始函数返回地址
cS
`5I6uQ@
M1B0// 加载原始模块
n8|M]5j)hq&v0inline BOOL WINAPI Load()IXPUB技术博客6[(}/e
_@X@
{
M)m3wg@7mO_G)\;\0TCHAR tzPath[MAX_PATH]={0};IXPUB技术博客N`bpa[v&d
TCHAR tzTemp[MAX_PATH]={0};
DZF
X!{F~0GetSystemDirectory(tzPath, sizeof(tzPath));IXPUB技术博客Wh-U%WpN9p#KB
e
strcat(tzPath,"\\ws2_32.dll");
p.P"n%[(mC&L;JA0m_hModule = LoadLibrary(tzPath);//加载系统系统目录下ws2_32.dllIXPUB技术博客Xx^)ZT%QF*{
if (m_hModule == NULL)
*ben*E%K.YV|h0{IXPUB技术博客!FD*u(\A
wsprintf(tzTemp, TEXT("无法加载 %s，程序无法正常运行。"), tzPath);IXPUB技术博客-Ze!Z`wI4Ht
MessageBox(NULL, tzTemp, TEXT("MemCode"), MB_ICONSTOP);IXPUB技术博客)A+A{)Y!y
Lzm
}IXPUB技术博客&oq*rT0L|3n
return (m_hModule != NULL); 
/k*MN4U!U7`2Ck.y
C0}

// 释放原始模块IXPUB技术博客`r*`F0W*o r
inline VOID WINAPI Free()IXPUB技术博客*J#Ty1e&q[Q
{IXPUB技术博客 S
X^~,E%_!L%S
if (m_hModule)IXPUB技术博客0T2?!I@c:WwE
FreeLibrary(m_hModule);
?&T
Dd3u0}

}#Q{!zW \0// 获取原始函数地址
:k&Oe0\8Ig6HR0FARPROC WINAPI GetAddress(PCSTR pszProcName)
JT8C2h3O4M.o0{
$U$JysU0FARPROC fpAddress;
%m6w&BXf0A9q-p0TCHAR szProcName[16]={0};IXPUB技术博客 @3A;M k7Y']A6Z
TCHAR tzTemp[MAX_PATH]={0};IXPUB技术博客Z|zc
s.Be

rZ(n
d;gKD0if (m_hModule == NULL)IXPUB技术博客4m+B&qy1c
{
8X"C4}T9{S_GG!R0if (Load() == FALSE)IXPUB技术博客.n3g/v:X+m RE!r+s&M
ExitProcess(-1);
"z{.G#h*ZR0}
.E"_#]iT3f&i*B0IXPUB技术博客Q{5g
K6RM#h4Ur
fpAddress = GetProcAddress(m_hModule, pszProcName);
1o)lZ-T-Yz3U0if (fpAddress == NULL)IXPUB技术博客:^+M
p
f6j?z;W
{IXPUB技术博客${0Zn3u/D1gFP
if (HIWORD(pszProcName) == 0)
AfOj)WT.U9{0{IXPUB技术博客3xv,Rc#L;LO0mJdd+\
wsprintf(szProcName, "%d", pszProcName);IXPUB技术博客.b2lt'^I&|)z
pszProcName = szProcName;
&Sz,p2`Q9[&e0}IXPUB技术博客
Qi
t6WMO
wsprintf(tzTemp, TEXT("无法找到函数 %hs，程序无法正常运行。"), pszProcName);IXPUB技术博客`x[Sj{F
MessageBox(NULL, tzTemp, TEXT("MemCode"), MB_ICONSTOP);IXPUB技术博客4r~};LtIdJ
ExitProcess(-2);
_	z[,b
x O{0}IXPUB技术博客]7n	|ncc6C7_8v
return fpAddress;IXPUB技术博客
HIIs,yr.]
}
-z/Gm;y
L6g,JZRl0}
}2O2s-e8Hh+n%y0using namespace MemCode;

.text:10001CC0 ; int __stdcall WSACleanup()IXPUB技术博客"o	p$H6bf
.text:10001CC0 WSACleanup   proc nearIXPUB技术博客Wzf ?P
.text:10001CC0                push    offset aWsacleanup ;"WSACleanup"
$a5NC\8y)Y.y6?0.text:10001CC5                call    sub_10001000    ;GetAddress(WSACleanup)IXPUB技术博客
I3@5S}$f
.text:10001CCA                jmp     eax
!U6O wcx)A	Q8O)V
L0.text:10001CCA WSACleanup   endp

ALCDECL MemCode_WSAStartup(void)
1\(vauQ~
t-~0{
D;K)\| ^%xS0hijack();
g([he,xd]L#Pg0GetAddress("WSAStartup");IXPUB技术博客/c2b
g~,V6|
__asm JMP EAX;IXPUB技术博客R"S)a
u6S5F9W]
}

void hijack()
t)t6W+Q!uAQWiq0{
	E
]$o"LFXG
K0if (isTarget(GetCurrentProcess()))   //判断主程序是不是目标程序，是则补丁之
J4{C*]?)}Ya0{IXPUB技术博客4pP8{;N
^V
}
PatchProcess(GetCurrentProcess());
x'Q[|Q0}IXPUB技术博客/M
{Bk:F:Ek7V
}