ShellCode注入程序

程序功能是利用NtQueueApcThreadEx注入ShellCode到一个进程中,程序运行后会让你选择模式,按1为普通模式,所需的常规API接口都是使用Windows原本正常的API;在有游戏保护的进程中Windows原本正常的API无法使用,这时候需要选择内核模式,按2选择内核模式。

内核模式下使用的一些关键API都是我自己在ring0从0实现的,本帖仅开源普通模式下的代码。内核模式下使用的关键API以及调用框架不开源。

选择模式之后需要输入被注入进程的PID

项目包含三个源代码文件:1.源.cpp

2.fun.asm

3.fun.h

首先是源.cpp文件代码:

|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 | 插入代码 ````````````/*` `*` `函数原型:` `NTSTATUS NtQueueTHreadApcEx(` `_in HANDLE thread,` `_in UCHAR flags,0:常规用户APC,1:特殊用户APC` `_in PAPCFUNC apcRoutine,` `_in PVOID context1,` `_in PVOID arg1,` `_in PVOID arg2` `);` `需要从Ntdll.dll模块显式导出(GetProcAddress)` `*/` `#define _CRT_SECURE_NO_WARNINGS` `#include<stdio.h>` `#include<Windows.h>` `#include<Tlhelp32.h>` `#include"fun.h"` `HWND hwndG =` `0;` `BOOL` `CALLBACK EnumWindowsProc(` ` HWND hwnd,` ` LPARAM lParam)` `{` ` WCHAR path[MAX_PATH] =` `{ 0` `};` ` WCHAR*` `text =` `(WCHAR*)lParam;` ` GetWindowText(hwnd, path, MAX_PATH);` ` if` `(lstrcmpW(text, path) ==` `0)` ` {` ` hwndG =` `hwnd;` ` return` `FALSE;` ` }` ` else` ` {` ` hwndG =` `0;` ` return` `TRUE;` ` }` `}` `DWORD WINAPI GetThreadIdByProcessId(DWORD dwProcessId)` `{` ` THREADENTRY32 th32;` ` th32.dwSize =` `sizeof(THREADENTRY32);` ` DWORD dwThreadId =` `0;` ` HANDLE hdTool =` `CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, dwProcessId);` ` if` `(Thread32First(hdTool, &th32))` ` {` ` do` ` {` ` if` `(th32.th32OwnerProcessID ==` `dwProcessId)` ` {` ` dwThreadId =` `th32.th32ThreadID;` ` //printf("%d\n", dwThreadId);` ` break;` ` }` ` } while` `(Thread32Next(hdTool, &th32));` ` }` ` else` ` {` ` DWORD dwErro =` `GetLastError();` ` //printf("遍历进程失败!------%d", dwErro);` ` return` `dwErro;` ` }` ` ` ` return` `dwThreadId;` `}` `BOOL` `WINAPI PrivilegeAdjust()` `{` ` BOOL` `flag;` ` HANDLE token;` ` if` `(!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))` ` {` ` //printf("打开令牌失败!\n");` ` flag =` `FALSE;` ` }` ` LUID pid;` ` if` `(!LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &pid))` ` {` ` //printf("查看特权ID失败\n");` ` flag =` `FALSE;` ` }` ` TOKEN_PRIVILEGES tp;` ` tp.PrivilegeCount =` `1;` ` tp.Privileges[0].Luid =` `pid;` ` tp.Privileges[0].Attributes =` `SE_PRIVILEGE_ENABLED;` ` if` `(!AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL))` ` {` ` //printf("提升特权失败!\n");` ` flag =` `FALSE;` ` }` ` return` `TRUE;` `}` `typedef BOOL(*MYTYPE)(HANDLE, LPVOID, LPVOID, SIZE_T, SIZE_T*);` `typedef HANDLE(*OPPS)(DWORD, BOOL, DWORD);` `typedef BOOL(*WRMEMEX)(HANDLE, LPVOID, LPVOID, SIZE_T, SIZE_T*);` `typedef HANDLE(*OPTS)();` `typedef ULONG64(*GETPEB)(DWORD);` `typedef NTSTATUS(*NTQUEAPC)(HANDLE, UCHAR, PVOID, PVOID, PVOID, PVOID);` `WRMEMEX Read;` `WRMEMEX Write;` `OPPS OpenPro;` `OPTS OpenThr;` `NTQUEAPC NtQueueUserApcEx;` `VOID InitFrmak()` `{` ` printf("内核\n");` ` NtQueueUserApcEx =` `NULL;` ` HMODULE mod =` `LoadLibraryA("ApiSystemCall.dll");` ` Read =` `(WRMEMEX)GetProcAddress(mod, "YhReadProcessMemory");` ` Write =` `(WRMEMEX)GetProcAddress(mod, "YhWriteProcessMemory");` ` OpenPro =` `(OPPS)GetProcAddress(mod, "YhOpenProcess");` ` OpenThr =` `(OPTS)GetProcAddress(mod, "YhOpenThread");` ` NtQueueUserApcEx =` `(NTQUEAPC)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueueApcThreadEx");` ` if` `(NtQueueUserApcEx ==` `NULL)` ` {` ` MessageBoxA(NULL, "获取函数失败", 0, 0);` ` }` `}` `VOID InitFrmakEx()` `{` ` NtQueueUserApcEx =` `NULL;` ` ` ` printf("普通\n");` ` Read =` `ReadProcessMemory;` ` Write =` `WriteProcessMemory;` ` OpenPro =` `OpenProcess;` ` OpenThr =` `OpenThread;` ` NtQueueUserApcEx =` `(NTQUEAPC)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueueApcThreadEx");` ` if` `(NtQueueUserApcEx ==` `NULL)` ` {` ` MessageBoxA(NULL, "获取函数失败", 0, 0);` ` }` `}` `typedef VOID(*FUN)();` `int` `main()` `{` ` DWORD pid;` ` SIZE_T size=0;` ` CONTEXT text;` ` VirtualProtect(fun, 0x60, PAGE_EXECUTE_READWRITE, &pid);` ` (ULONG64)(&(((UCHAR*)fun2)[0x34])) =` `MessageBoxA;` ` *(ULONG64*)(&(((UCHAR*)fun2)[0x9f])) =` `SetWindowsHookExA;` ` //fun(NULL,NULL,NULL);` ` printf("请输入模式:\n1.普通模式\n2.内核模式\n");` ` scanf("%d", &size);` ` (size==1)? InitFrmakEx(): InitFrmak();` ` printf("请输入进程PID:\n");` ` scanf("%d", &pid);` ` PrivilegeAdjust();` ` ` ` HANDLE hd =` `OpenPro(PROCESS_ALL_ACCESS, FALSE, pid);` ` PVOID mem =` `VirtualAllocEx(hd, NULL, 0X1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);` ` DWORD tid =` `GetThreadIdByProcessId(pid);` ` HANDLE td;` ` if` `(size ==` `1)` ` {` ` td =` `OpenThr(THREAD_ALL_ACCESS,FALSE,tid);` ` }` ` else` ` {` ` td =` `OpenThr(tid, hd, THREAD_ALL_ACCESS, FALSE);` ` }` ` if` `(!Write(hd, mem, fun2, 0x100, &size))` ` {` ` MessageBoxA(0, "写入失败", 0, 0);` ` }` ` SuspendThread(td);` ` NTSTATUS code =` `NtQueueUserApcEx(td, 1, (PVOID)(((ULONG64)mem)+0x53), tid, 0, 0);` ` if(code!=0)` ` {` ` ` ` printf("%x\n", code);` ` MessageBox(0, 0, 0, 0);` ` }` ` ResumeThread(td);` ` system("pause");` ` return` `0``;` `}` |

fun.asm文件

|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 | .code MessageBoxA proto fun2 proc ``push rbp; ``mov rbp,rsp; ``sub rsp,``060h``; ``xor rax,rax; ``cmp rcx,rax; ``jnz sub_1; ``cmp rdx,``09h``;;虚拟键代码``0x9``为键盘的TAB键 ``jnz sub_1; ``xor rcx,rcx; ``lea rdx,qword ptr[lab_2]; ``xor r8,r8; ``xor r9,r9; ``mov rax,qword ptr[lab_1]; ``call rax; sub_1: ``mov rsp,rbp; ``pop rbp; ``ret; fun2 endp lab_1: ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; lab_2: ``db ``0c2h``; ``db ``0edh``; ``db ``0bbh``; ``db ``0afh``; ``db ``0cch``; ``db ``0dah``; ``db ``0cah``; ``db ``0c7h``; ``db ``0c9h``; ``db ``0b5h``; ``db ``0b1h``; ``db ``0c6h``; ``db ``0a3h``; ``db ``0a1h``; ``db ``00ah``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; fun proc ``push rbp; ``mov rbp,rsp; ``sub rsp,``080h``; ``mov r9,rcx; ``mov rcx,``02h``; ``lea rdx,qword ptr [fun2]; ``xor r8,r8; ``mov rax,qword ptr [sub_2]; ``call rax; ``cmp rax,``0``; ``jnz lab_3; ``xor rcx,rcx; ``xor rdx,rdx; ``xor r8,r8; ``mov r9,``02h``; ``mov rax,qword ptr [lab_1]; ``call rax; lab_3: ``mov rsp,rbp; ``pop rbp; ``ret; sub_2: ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; ``db ``00h``; fun endp end |

fun.h文件

|-------|-----------------------------------------------------------------------------|
| 1 2 3 | #pragma once #include<Windows.h> void fun(PVOID a, PVOID b, PVOID c); |

shellCode的功能是给被注入进程设置一个键盘钩子,TAB键。

相关推荐
程序员yt1 小时前
双非一本电子信息专业自学嵌入式,学完 Linux 后咋走?单片机 & FreeRTOS 要补吗?
linux·运维·单片机
CSDN_PBB4 小时前
[STM32 - 野火] - - - 固件库学习笔记 - - - 十五.设置FLASH的读写保护及解除
笔记·stm32·学习
楼台的春风4 小时前
【GPIO详解及实践示例】
c语言·stm32·单片机·嵌入式硬件·mcu·物联网·嵌入式
sinat_360704829 小时前
STM32 低功耗模式
stm32·单片机·嵌入式硬件
jmlinux11 小时前
STM32 HAL库USART串口中断编程:演示数据丢失
stm32·单片机·嵌入式硬件
星糖曙光11 小时前
开发一个音响控制板程序,需要从硬件架构设计、通信协议选择、核心功能实现三个层面进行系统化开发。以下是基于工业级开发流程的实施方案
stm32·课程设计·emacs·ai编程·设计规范
沐欣工作室_lvyiyi14 小时前
基于物联网的智能蔬菜仓库设计(论文+源码)
人工智能·stm32·单片机·嵌入式硬件·物联网·fpga
万能的小裴同学14 小时前
MFC 自定义十六进制显示控件
开发语言·c++·mfc
奇偶变不变15 小时前
单片机中有FLASH为啥还需要EEROM?
单片机·嵌入式硬件
我不是加奈15 小时前
摄像头畸变矫正
python·单片机·opencv