[DLL Injection] DLL Injector

DLLInjector.cpp

C++로 작성한 DLL Injector.

Eject 기능은 없습니다.

사용법은 소스에 있듯이 " DLLInjector.exe [Target] [DLL] " 입니다.

인젝션 및 후킹 공부 진행하면서 작성하였습니다.

CreateRemoteThread를 이용해 LoadLibraryA 함수를 실행하게 하여 DLL을 삽입합니다.

디버깅 편의상 gle를 자주 출력하도록 해 두었습니다.

삽입할 DLL 내부에서 Thread를 돌리게 했더니 에러가 나기도 하더군요...

#include <stdio.h>
#include <Windows.h>
#include <TlHelp32.h>
 
DWORD findPID(LPCTSTR szProcessName);
BOOL injectDLL(DWORD dwPID, LPCTSTR szDLLName);
 
int main(int argc, char *argv[])
{
    if (argc != 3) {
        printf("[*] Usage : %s [Target] [DLL]", argv[0]);
        return 1;
    }
 
    DWORD pid = findPID(argv[1]);
    if (pid == 0xFFFFFFFF) {
        printf("[*] Process not found\n");
        return 1;
    }
    else {
        printf("[*] pid : %u\n", pid);
    }
    if (!injectDLL(pid, argv[2])) {
        printf("[*] Injection Failed\n");
        return 1;
    }
    else {
        printf("[*] Injection Successed\n");
    }
    return 0;
}
 
DWORD findPID(LPCTSTR szProcessName)
{
    DWORD dwPID = 0xFFFFFFFF;
    HANDLE hSnapshot = INVALID_HANDLE_VALUE;
    PROCESSENTRY32 pe;
    
    pe.dwSize = sizeof(PROCESSENTRY32);
    hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
    if (hSnapshot == INVALID_HANDLE_VALUE) {
        printf("[*] CreateToolhelp32Snapshot Error");
        return 0xFFFFFFFF;
    }
 
    Process32First(hSnapshot, &pe);
    do {
        if (!_stricmp(szProcessName, pe.szExeFile)) {
            dwPID = pe.th32ProcessID;
            break;
        }
    } while (Process32Next(hSnapshot, &pe));
 
    CloseHandle(hSnapshot);
    return dwPID;
}
 
BOOL injectDLL(DWORD dwPID, LPCTSTR szDLLName)
{
    HANDLE hProcess, hThread;
    HMODULE hMod;
 
    LPVOID pRemoteBuf;
    DWORD dwBufSize = lstrlen(szDLLName) + 1;
    LPTHREAD_START_ROUTINE pThreadProc;
 
    if (!(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID))) return FALSE;
    if (hProcess == INVALID_HANDLE_VALUE) {
        printf("[*] OpenProcess Error");
        return FALSE;
    }
    printf("gle : %u\n", GetLastError());
    pRemoteBuf = VirtualAllocEx(hProcess, NULL, dwBufSize, MEM_COMMIT, PAGE_READWRITE);
    if (pRemoteBuf == INVALID_HANDLE_VALUE) {
        printf("[*] VirtualAllocEx Error");
        return FALSE;
    }
    printf("gle : %u\n", GetLastError());
    WriteProcessMemory(hProcess, pRemoteBuf, szDLLName, dwBufSize, NULL);
 
    hMod = GetModuleHandle("kernel32.dll");
    pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(hMod, "LoadLibraryA");
    if (pThreadProc == INVALID_HANDLE_VALUE) {
        printf("[*] GetProcAddress Error");
        return FALSE;
    }
    printf("gle : %u\n", GetLastError());
    hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, pRemoteBuf, 0, NULL);
    if (hThread == INVALID_HANDLE_VALUE) {
        printf("[*] CreateRemoteThread Error");
        return FALSE;
    }
    printf("gle : %u\n", GetLastError());
 
    WaitForSingleObject(hThread, INFINITE);
 
    CloseHandle(hThread);
    CloseHandle(hProcess);
    printf("gle : %u\n", GetLastError());
    return TRUE;
}