简体   繁体   English

Dll 注入 - LoadLibraryA 失败

[英]Dll injection - LoadLibraryA fails

I'm trying to inject a dll into a process.我正在尝试将一个 dll 注入到一个进程中。 The dll does nothing except return TRUE. dll 除了返回 TRUE 什么都不做。

I attached a debugger to the process that I want to inject into and confirmed that LoadLibraryA is called correctly but returns NULL.我将调试器附加到要注入的进程并确认LoadLibraryA被正确调用但返回 NULL。 Now I think that this might have something to do with my dll's dependencies.现在我认为这可能与我的 dll 的依赖项有关。 So I checked them and found out that it requires vcruntime140.dll .所以我检查了它们,发现它需要vcruntime140.dll The process that I want to inject my dll into does not load that dll.我想将我的 dll 注入的进程不会加载该 dll。

#include "pch.h"

extern "C" int __stdcall APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    return TRUE;
}
#include "Source.h"

const char* DllName = "InjectMe.dll";

int main()
{
    DWORD processID = 0;
    printf("Process ID: ");
    scanf_s("%i", &processID);

    HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
    if (handle == nullptr) {
        printf("Process could not be opened.");
        return -1;
    }
    LPVOID memDllName = VirtualAllocEx(handle, nullptr, strlen(DllName) + 1, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    assert(memDllName != nullptr);
    assert(WriteProcessMemory(handle, memDllName, DllName, strlen(DllName) + 1, nullptr));

    LPVOID loadLibraryAddr = GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    assert(loadLibraryAddr != nullptr);

    HANDLE thread = CreateRemoteThreadEx(handle, nullptr, 0, (LPTHREAD_START_ROUTINE)loadLibraryAddr, memDllName, CREATE_SUSPENDED, nullptr, nullptr);
    assert(thread != nullptr);
    ResumeThread(thread);
    DWORD returnCode = WaitForSingleObject(thread, 5000);
    CloseHandle(thread);
    if (returnCode == WAIT_TIMEOUT) {
        printf("DLL was not loaded. Thread timed out.");
        return -1;
    }
    else if (returnCode == WAIT_OBJECT_0) {
        printf("DLL was successfully injected into the process.");
    }
    CloseHandle(handle);
    std::cin.get();
    return 0;
}

You must use a full file path not a relative file path when calling LoadLibrary()调用 LoadLibrary() 时必须使用完整文件路径而不是相对文件路径

const char* DllName = "InjectMe.dll";

needs to be changed to something like this需要改成这样

const char* DllName = "c:\\Users\User\\Desktop\\InjectMe.dll";

Also make sure you run as administrator if OpenProcess fails or sometimes you also need to use SeDebugPrivelage如果 OpenProcess 失败,请确保您以管理员身份运行,或者有时您还需要使用 SeDebugPrivalage

In order to test if it is a pathing issue, try the following.为了测试它是否是路径问题,请尝试以下操作。 Keep the保持

const char* DllName = "InjectMe.dll";

Then put the InjectMe.dll and your .exe in the same directory and try to run your exe.然后将 InjectMe.dll 和您的 .exe 放在同一目录中并尝试运行您的 exe。 If the dll is loaded successfully, then it is a pathing issue.如果 dll 加载成功,则是路径问题。

To work around that, you can either specify the full path like GuidedHacking said, OR you can put your InjectMe.dll in the same directory as the .vcxproj and .cpp files (not where the .sln file is)要解决这个问题,您可以指定像 GuidedHacking 所说的完整路径,或者您可以将 InjectMe.dll 放在与 .vcxproj 和 .cpp 文件相同的目录中(而不是 .sln 文件所在的位置)

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM