标签：des io ar os sp for 数据 on art
将dll从进程模块列表中移除并保持正常运行，这玩意想想是挺简单，n久前byshell就用了，
简单的思路就是给当前的dll内存映像做份拷贝，然后跳到那份拷贝的地址空间的代码，回头free掉原来的dll，
然后马上用VirtualAlloc在原基址上申请块同样大小的空间，并将那份拷贝还原回去，再跳回去执行。完。
代码写完后再实际程序中应用后发现问题，一旦调用到malloc或new的话就会崩溃，
于是去看了下byshell的代码，发现他申请内存是用VirtualAlloc，但是我大量的代码都是用new来分配，而且类对象不好用VirtualAlloc来分配吧~
经调式才清楚，原来每个dll，windows都会给其分配一个heap，
在freelibrary时系统会将其完全destroy掉，不怕你内存泄露。
调试时在FreeLibrary后HeapDestroy断点正好触发一次，就是这一次那个heap给销毁了。
解决办法就是在FreeLibrary前修改HeapDestroy的第一条指令为return，FreeLibrary后再修复。
实践证明，稳定......
*/
#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
#include <psapi.h>
#pragma comment(lib, "Psapi.lib")
#define __printf printf
void HideLibrary(HMODULE hModule, LPVOID pCallBackAddr, LPVOID lParam);
typedef struct
{
HMODULE lpDllBase;
LPVOID lpNewDllBase;
PTHREAD_START_ROUTINE pAddress;
LPVOID lParam;
}UNLOADLIB_CALLBACK, *PUNLOADLIB_CALLBACK;
typedef
LPVOID WINAPI VIRTUALALLOC(
LPVOID lpAddress,
SIZE_T dwSize,
DWORD flAllocationType,
DWORD flProtect
);
typedef
BOOL WINAPI VIRTUALFREE(
LPVOID lpAddress,
SIZE_T dwSize,
DWORD dwFreeType
);
typedef
BOOL WINAPI HEAPDESTROY(
HANDLE hHeap
);
typedef
HMODULE WINAPI LOADLIBRARY(
LPCTSTR lpFileName
);
typedef
HANDLE WINAPI CREATETHREAD(
LPSECURITY_ATTRIBUTES lpThreadAttributes,
SIZE_T dwStackSize,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
DWORD dwCreationFlags,
LPDWORD lpThreadId
);
typedef void * __cdecl MEMCPY(void *, const void *, size_t);
BOOL incLibraryCount(HMODULE hMe)
{
//FreeLibrary后很多系统dll也会free掉，所以将所有已加载的再load一次以增加计数
HANDLE hModsSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
if(INVALID_HANDLE_VALUE == hModsSnap)
{
return FALSE;
}
MODULEENTRY32 meModuleEntry;
meModuleEntry.dwSize = sizeof(MODULEENTRY32);
if(!Module32First(hModsSnap, &meModuleEntry))
{
CloseHandle(hModsSnap);
return FALSE;
}
do
{
if(LoadLibrary(meModuleEntry.szModule) == hMe)
FreeLibrary(hMe);
} while(Module32Next(hModsSnap, &meModuleEntry));
CloseHandle(hModsSnap);
return TRUE;
}
//枚举指定进程的所有线程
DWORD WINAPI EnumAndSetThreadState(LPVOID lParam)
{
HANDLE hThreadSnap = NULL;
THREADENTRY32 te32;
memset(&te32,0,sizeof(te32));
te32.dwSize = sizeof(THREADENTRY32);
hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,0);
DWORD myThreadId = GetCurrentThreadId();
DWORD pid = GetCurrentProcessId();
if (Thread32First(hThreadSnap, &te32))
{
do
{
if (pid == te32.th32OwnerProcessID)
{
if(myThreadId != te32.th32ThreadID)
{
HANDLE hThread = OpenThread(
THREAD_SUSPEND_RESUME,
FALSE,
te32.th32ThreadID);
if(hThread != NULL)
{
if((int)lParam)
ResumeThread(hThread);
else
SuspendThread(hThread);
CloseHandle(hThread);
}
}
}
}
while (Thread32Next(hThreadSnap,&te32));
}
CloseHandle( hThreadSnap );
return 0;
}
DWORD WINAPI GotoCallBackAddr(LPVOID lParam)
{
PUNLOADLIB_CALLBACK cbFunc = (PUNLOADLIB_CALLBACK)lParam;
DWORD dwThreadId;
HANDLE hThread;
if(cbFunc->pAddress)
{
hThread = CreateThread(
NULL,
0,
cbFunc->pAddress,
cbFunc->lParam,
0,
&dwThreadId);
if(hThread)
CloseHandle(hThread);
}
//那份dll的拷贝不需要了，释放~
VirtualFree(cbFunc->lpNewDllBase, 0, MEM_DECOMMIT);
delete cbFunc;
return 0;
}
DWORD WINAPI UnLoadLibrary(LPVOID lParam)
{
//__asm INT 3
__printf("UnLoadLibrary Entry.\r\n");
BYTE HeapDestroy_HookCode_bak[4];
BYTE HeapDestroy_HookCode[4] = "\xC2\x04\x00";//RETN 0004
MODULEINFO modinfo;
DWORD oldProtect;
PUNLOADLIB_CALLBACK cbFunc = (PUNLOADLIB_CALLBACK)lParam;
HMODULE hDllInstance = cbFunc->lpDllBase;
char dllpath_bak[MAX_PATH];
GetModuleFileName(hDllInstance, dllpath_bak, sizeof(dllpath_bak));
GetModuleInformation(GetCurrentProcess(), hDllInstance, &modinfo, sizeof(MODULEINFO));
//给所有dll(除了自己)增加计数,防止FreeLibrary的时候那些dll给系统卸载掉
incLibraryCount(hDllInstance);
//保险起见，挂起其他线程，搞定后再恢复
EnumAndSetThreadState((LPVOID)FALSE);
//FreeLibrary之后原来存放api地址的内存也会被释放，
//但是FreeLibrary之后还有些动作，趁现在还没free，关键API记下来
VIRTUALALLOC *_VirtualAlloc = (VIRTUALALLOC*)
GetProcAddress(GetModuleHandle("kernel32.dll"), "VirtualAlloc");
LOADLIBRARY *_LoadLibrary = (LOADLIBRARY*)
GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
CREATETHREAD *_CreateThread = (CREATETHREAD*)
GetProcAddress(GetModuleHandle("kernel32.dll"), "CreateThread");
MEMCPY *_memcpy = (MEMCPY*)
GetProcAddress(GetModuleHandle("ntdll.dll"), "memcpy");
//这个很关键，并不是我要调用，是 FreeLibrary 时系统会调用，我要hook它,
//不能给系统破坏这个heap，否则之后的dll貌似能工作，
//但却不能用new或malloc申请内存, VirtualAlloc可以代替之，
//但如果改写好多代码是划不来的，况且一些代码不好改,如list<T>的push内部的new
HEAPDESTROY *_HeapDestroy = (HEAPDESTROY*)
GetProcAddress(GetModuleHandle("kernel32.dll"), "HeapDestroy");
VirtualProtect(_HeapDestroy, 3, PAGE_EXECUTE_READWRITE, &oldProtect);
//修改第一条指令为直接返回
_memcpy(HeapDestroy_HookCode_bak, _HeapDestroy, 3);
_memcpy(_HeapDestroy, HeapDestroy_HookCode, 3);
//Sleep(100);
//终于到这里了~~~^_^!
FreeLibrary(hDllInstance);//释放
//修复刚hook的函数
_memcpy(_HeapDestroy, HeapDestroy_HookCode_bak, 3);
//_memcpy(_RtlFreeHeap, RtlFreeHeap_HookCode_bak, 3);
//在原来的dll基址申请同样大小的内存，并把之前的那份dll拷贝还原回去
if(_VirtualAlloc(hDllInstance,
modinfo.SizeOfImage,
MEM_COMMIT|MEM_RESERVE,
PAGE_EXECUTE_READWRITE) == NULL
)
{
//失败，加载原来dll, 以正常方式工作
//注意，不宜在dllmain中调用HideLibrary，LoadLibrary将导致dllmain再次被调用,导致死循环啦
HMODULE hDll = _LoadLibrary(dllpath_bak);
//重新计算回调函数在hDll地址空间的地址
cbFunc->pAddress = (LPTHREAD_START_ROUTINE)
((DWORD)cbFunc->pAddress - (DWORD)hDllInstance + (DWORD)hDll);
LPTHREAD_START_ROUTINE pFunc1 = (LPTHREAD_START_ROUTINE)
((DWORD)EnumAndSetThreadState - (DWORD)hDllInstance + (DWORD)hDll);
//恢复被挂起的线程
_CreateThread(0, 0, pFunc1, (LPVOID)TRUE, 0, 0);
//调用回调函数
if(cbFunc->pAddress)
_CreateThread(0, 0, cbFunc->pAddress, cbFunc->lParam, 0, 0);
return 0;
}
_memcpy(hDllInstance, cbFunc->lpNewDllBase, modinfo.SizeOfImage);
//恢复被挂起的线程
EnumAndSetThreadState((LPVOID)TRUE);
//跳回原dll地址空间的GotoCallBackAddr，由它来释放这边VirtualAlloc申请的指针
_CreateThread(0, 0, GotoCallBackAddr, cbFunc, 0, 0);
return 0;
}
DWORD WINAPI HideLibrary02(LPVOID lParam)
{
//__asm INT 3
__printf("HideLibrary02 Entry.\r\n");
PUNLOADLIB_CALLBACK cbFunc = (PUNLOADLIB_CALLBACK)lParam;
MODULEINFO modinfo;
GetModuleInformation(GetCurrentProcess(), cbFunc->lpDllBase, &modinfo, sizeof(MODULEINFO));
//申请一块和当前dll同样大小的内存
cbFunc->lpNewDllBase = VirtualAlloc(NULL, modinfo.SizeOfImage, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if(cbFunc->lpNewDllBase == NULL)
return FALSE;
//给当前dll做份拷贝，复制所有数据到刚申请的内存，
memcpy(cbFunc->lpNewDllBase, modinfo.lpBaseOfDll, modinfo.SizeOfImage);
//计算在copy中UnLoadLibrary的地址,并另起线程到该地址执行
void *pNewUnLoadLibrary = LPVOID((DWORD)cbFunc->lpNewDllBase + (DWORD)UnLoadLibrary - (DWORD)modinfo.lpBaseOfDll);
DWORD ThreadId;
HANDLE hThread = CreateThread(0,0,
(LPTHREAD_START_ROUTINE)pNewUnLoadLibrary, (LPVOID)cbFunc, CREATE_SUSPENDED, &ThreadId);
if(hThread == NULL)
{
VirtualFree(cbFunc->lpNewDllBase, 0, MEM_DECOMMIT);
delete cbFunc;
return FALSE;
}
ResumeThread(hThread);
CloseHandle(hThread);
return TRUE;
}
void HideLibrary(HMODULE hModule, LPVOID pCallBackAddr, LPVOID lParam)
{
__printf("HideLibrary Entry.\r\n");
PUNLOADLIB_CALLBACK lparam = new UNLOADLIB_CALLBACK;
lparam->lpDllBase = hModule;
lparam->lpNewDllBase = NULL;
lparam->pAddress = (PTHREAD_START_ROUTINE)pCallBackAddr;
lparam->lParam = lParam;
HANDLE hThread = CreateThread(0,0,
HideLibrary02, (LPVOID)lparam, 0, NULL);
if(hThread == NULL)
{
__printf("CreateThread HideLibrary02 Failed.\r\n");
delete lparam;
return;
}
CloseHandle(hThread);
return;
}
///////////////////////////////////////////////////////////
//example
//rundll32 UnloadLibrary.dll,Test
DWORD WINAPI testThread(LPVOID lParam)
{
char *ptest = new char[512];
sprintf(ptest, "My Pid: %d\r\n 用一些软件查看下，找不到这个dll吧?", GetCurrentProcessId());
MessageBox(0, ptest, (char*)lParam, 0);
delete ptest;
return 0;
}
DWORD WINAPI testThread02(LPVOID lParam)
{
HMODULE hModule = (HMODULE)lParam;
char *ptest = new char[512];
sprintf(ptest, "testThread02\r\n");
Sleep(500);
MessageBox(0, ptest, "start", 0);
//不设置回调函数，成功还好，一旦失败则gameover
HideLibrary(hModule, 0, 0);
sprintf(ptest, "My Pid: %d\r\n 用一些软件查看下，找不到这个dll吧?", GetCurrentProcessId());
MessageBox(0, ptest, "ok", 0);
delete ptest;
return 0;
}
HMODULE hDll;
extern "C"
{
__declspec(dllexport) int Test();
}
int Test()
{
//1
//主要线程开始工作后再HideLibrary不是很安全
//CreateThread(0, 0, testThread02, hDll, 0, 0);
//
//2
//free掉dll后再开启主要工作线程妥当些
char *p = strdup("hello");
HideLibrary(hDll, testThread, p);
Sleep(60000);
return 0;
}
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
hDll = (HMODULE)hModule;
}
break;
}
return TRUE;
}
标签：des io ar os sp for 数据 on art
原文地址：http://www.cnblogs.com/myprograms/p/4115672.html
