相信大多数人对DELPHI语言并不陌生
此类dll外挂说白了就是通过窗口钩子搭建DLL注入
下面奉上本人对此DLL编写的部分代码
1. 要在目标行程内执行的程式
procedure myMessageBegin(param: PParam); stdcall;
type
LoadLibraryFunc = function(lib: PChar): DWORD; stdcall;
GetProcAddressFunc = function(lib: DWORD; name: PChar): DWORD; stdcall;
MessageBoxFunc = function(handle: DWORD; msg, title: PChar; flag: DWORD): DWORD; stdcall;
var
myLoad: LoadLibraryFunc;
myGetProc: GetProcAddressFunc;
myMsg: MessageBoxFunc;
hlib: DWORD;
begin
myLoad := LoadLibraryFunc(param^.fLoadLibrary);
myGetProc := GetProcAddressFunc(param^.fGetProcAddress);
hlib := myLoad(@param^.sUser[0]);
myMsg := MessageBoxFunc(myGetProc(hlib, @param^.sMessage[0]));
myMsg(0, @param^.sUser[0], @param^.sMessage[0], MB_OK);
end; (相当繁琐)
耐心看看一定会有收获
2. 注入函数的参数型别定义（这里就不做详细说明了，没什么必要）
下面奉上注入程式
procedure TForm1.btnInjectClick(Sender: TObject);
var
hwin, pid: DWORD;
hprocess: DWORD;
param: TParam;
pparam, pfunc: Pointer;
hlib: DWORD;
hthread: DWORD;
s: string;
v: DWORD;
iSize: DWORD;
begin
hwin := FindWindow(nil, PChar(edtName.Text));
if hwin = 0 then begin
MessageBox(self.Handle, '找不到指定的视窗!', '讯息', MB_OK or MB_ICONWARNING);
Exit;
end;
GetWindowThreadProcessId(hwin, pid);
if pid = 0 then begin
MessageBox(self.Handle, '找不到行程ID', '讯息', MB_OK or MB_ICONWARNING);
Exit;
end;
hprocess := OpenProcess(PROCESS_ALL_ACCESS, False, pid);
if hprocess = 0 then begin
MessageBox(self.Handle, '无法开启行程', '讯息', MB_OK or MB_ICONWARNING);
Exit;
end;
pparam := VirtualAllocEx(hprocess, nil, SizeOf(param), MEM_COMMIT, PAGE_READWRITE);
if pparam = nil then begin
MessageBox(self.Handle, '要求参数记忆体失败', '讯息', MB_OK or MB_ICONWARNING);
CloseHandle(hprocess);
Exit;
end;
// 这里定义一个 myMessageEnd 空函数来判断 myMessageBegin 大小
iSize := DWORD(@myMessageEnd)-DWORD(@myMessageBegin)+1;
pfunc := VirtualAllocEx(hprocess, nil, iSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if pfunc = nil then begin
MessageBox(self.Handle, '要求函数记忆体失败', '讯息', MB_OK or MB_ICONWARNING);
CloseHandle(hprocess);
Exit;
end;
FillChar(param, SizeOf(param), 0);
hlib := GetModuleHandle('Kernel32.dll');
param.fLoadLibrary := DWORD(GetProcAddress(hlib, 'LoadLibraryA'));
param.fGetProcAddress := DWORD(GetProcAddress(hlib, 'GetProcAddress'));
s := 'user32.dll';
Move(s[1], param.sUser[0], Length(s));
s := 'MessageBoxA';
Move(s[1], param.sMessage[0], Length(s));
WriteProcessMemory(hprocess, pparam, @param, SizeOf(param), v);
WriteProcessMemory(hprocess, pfunc, @myMessageBegin, iSize, v);
hthread := createRemoteThread(hprocess, nil, 0, pfunc, pparam, 0, v);
WaitForSingleObject(hthread, INFINITE);
VirtualFreeEx(hprocess, pfunc, iSize, MEM_DECOMMIT);
VirtualFreeEx(hprocess, pparam, SizeOf(param), MEM_DECOMMIT);
CloseHandle(hprocess);
end;
