x32의 DLL 숨기기
// dllmain.cpp : DLL 。
#include "stdafx.h"
#include
#include
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
/*
DLL
1. DLL. DLLModule
2. PEB . ->DllBae, DLL hModule .
*/
#define LDRP_STATIC_LINK 0x00000002
#define LDRP_IMAGE_DLL 0x00000004
#define LDRP_LOAD_IN_PROGRESS 0x00001000
#define LDRP_UNLOAD_IN_PROGRESS 0x00002000
#define LDRP_ENTRY_PROCESSED 0x00004000
#define LDRP_ENTRY_INSERTED 0x00008000
#define LDRP_CURRENT_LOAD 0x00010000
#define LDRP_FAILED_BUILTIN_LOAD 0x00020000
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000
#define LDRP_COR_IMAGE 0x00400000
#define LDR_COR_OWNS_UNMAP 0x00800000
#define LDRP_SYSTEM_MAPPED 0x01000000
#define LDRP_IMAGE_VERIFYING 0x02000000
#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000
#define LDRP_ENTRY_NATIVE 0x08000000
#define LDRP_REDIRECTED 0x10000000
#define LDRP_NON_PAGED_DEBUG_INFO 0x20000000
#define LDRP_MM_LOADED 0x40000000
#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union
{
LIST_ENTRY HashLinks;
PVOID SectionPointer;
};
ULONG CheckSum;
union
{
ULONG TimeDateStamp;
PVOID LoadedImports;
};
PVOID EntryPointActivationContext;
PVOID PatchInformation;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
typedef struct _PEB_LDR_DATA {
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList; //
LIST_ENTRY InMemoryOrderModuleList; //
LIST_ENTRY InInitializationOrderModuleList;//
PVOID EntryInProgress;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
typedef struct _LDR_MODULE {
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;
} LDR_MODULE, *PLDR_MODULE;
void PreprocessUnloadDll(HMODULE hLibModule)
{
PPEB_LDR_DATA pLdr = NULL;
PLDR_MODULE FirstModule = NULL;
PLDR_MODULE GurrentModule = NULL;
__try
{
__asm
{
mov esi, fs:[0x30]
mov esi, [esi + 0x0C]
mov pLdr, esi
}
FirstModule = (PLDR_MODULE)(pLdr->InLoadOrderModuleList.Flink);
GurrentModule = FirstModule;
while (!(GurrentModule->BaseAddress == hLibModule))
{
GurrentModule = (PLDR_MODULE)(GurrentModule->InLoadOrderModuleList.Blink);
if (GurrentModule == FirstModule)
{
return;
}
}
//
// LDRP_PROCESS_ATTACH_CALLED
//
GurrentModule->Flags |= LDRP_PROCESS_ATTACH_CALLED;
//
//
//
int oldLoadCount = GurrentModule->LoadCount;
GurrentModule->LoadCount = 1;
return;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return;
}
}
VOID HideModule(HMODULE hLibModule)
{
PPEB_LDR_DATA pLdr = NULL;
PLDR_MODULE FirstModule = NULL;
PLDR_MODULE GurrentModule = NULL;
__try
{
__asm
{
mov esi, fs:[0x30]
mov esi, [esi + 0x0C]
mov pLdr, esi
}
FirstModule = (PLDR_MODULE)(pLdr->InLoadOrderModuleList.Flink);
GurrentModule = FirstModule;
while (!(GurrentModule->BaseAddress == hLibModule)) //
{
GurrentModule = (PLDR_MODULE)(GurrentModule->InLoadOrderModuleList.Blink);
if (GurrentModule == FirstModule)
break;
}
if (GurrentModule->BaseAddress != hLibModule)
return;
//
// Dll
//
((PLDR_MODULE)(GurrentModule->InLoadOrderModuleList.Flink))->InLoadOrderModuleList.Blink = GurrentModule->InLoadOrderModuleList.Blink;
((PLDR_MODULE)(GurrentModule->InLoadOrderModuleList.Blink))->InLoadOrderModuleList.Flink = GurrentModule->InLoadOrderModuleList.Flink;
memset(GurrentModule->FullDllName.Buffer, 0, GurrentModule->FullDllName.Length);
memset(GurrentModule, 0, sizeof(PLDR_MODULE));
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)hLibModule;
PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)(LPBYTE(hLibModule) + dosHeader->e_lfanew);
if ((dosHeader->e_magic == IMAGE_DOS_SIGNATURE) && (ntHeaders->Signature == IMAGE_NT_SIGNATURE))
{
memset(dosHeader, 0, sizeof(*dosHeader));
memset(ntHeaders, 0, sizeof(*ntHeaders));
}
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return;
}
}
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
HideModule(hModule);
return TRUE;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
체크:
MEMORY_BASIC_INFORMATION mbi_thunk;
PVOID AllocationBase = NULL;
TCHAR FilePath[MAX_PATH];
for (LPSTR Addr = (LPSTR)0x00000000; ::VirtualQueryEx(hProcess, Addr, &mbi_thunk, sizeof(mbi_thunk)); Addr = LPSTR(mbi_thunk.BaseAddress) + mbi_thunk.RegionSize)
{
if ((mbi_thunk.AllocationBase > AllocationBase) && (GetMappedFileName(hProcess, mbi_thunk.BaseAddress, FilePath, _countof(FilePath)) > 0))
{
AllocationBase = mbi_thunk.AllocationBase;
KdPrint((_T("MODULE:%x, %s\r
"), AllocationBase, FilePath));
}
}
이 내용에 흥미가 있습니까?
현재 기사가 여러분의 문제를 해결하지 못하는 경우 AI 엔진은 머신러닝 분석(스마트 모델이 방금 만들어져 부정확한 경우가 있을 수 있음)을 통해 가장 유사한 기사를 추천합니다:
다양한 언어의 JSONJSON은 Javascript 표기법을 사용하여 데이터 구조를 레이아웃하는 데이터 형식입니다. 그러나 Javascript가 코드에서 이러한 구조를 나타낼 수 있는 유일한 언어는 아닙니다. 저는 일반적으로 '객체'{}...
텍스트를 자유롭게 공유하거나 복사할 수 있습니다.하지만 이 문서의 URL은 참조 URL로 남겨 두십시오.
CC BY-SA 2.5, CC BY-SA 3.0 및 CC BY-SA 4.0에 따라 라이센스가 부여됩니다.