DLL劫持技术例子: HijackDll

控制台程序:DllLoader

Dll加载器,用于动态加载目标Dll,并动态调用目标函数

 #include <cstdio>

 #include <windows.h>

 typedef int (*pAdd) (int a, int b);

 int main()

 {

     HMODULE hModule = GetModuleHandleA("Dll.dll") != NULL ? GetModuleHandleA("Dll.dll") : LoadLibraryA("Dll.dll");

     pAdd Add = (pAdd)GetProcAddress(hModule, "Add");

     if (NULL == Add)

         printf("Failed\n");

     else

         printf("Succeed\n1 + 1 = %d\n", Add(, ));

     system("pause > nul");

     return ;

 }

main.cpp

原Dll:Dll

很简单的一个Dll,只有一个隐式函数Add.仅仅是一个简单的加法..

 #include <cstdio>

 #include <windows.h>

 #define EXTERNC extern "C"

 #define EXPORT __declspec(dllexport)

 #define ECEP EXTERNC EXPORT

 BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)

 {

     switch(fdwReason)

     {

     case DLL_PROCESS_ATTACH:

         MessageBoxA(NULL, "Attach", "", MB_ICONINFORMATION);

         break;

     case DLL_PROCESS_DETACH:

         MessageBoxA(NULL, "Detach", "", MB_ICONINFORMATION);

         break;

     default:

         break;

     }

     return TRUE;

 }

 ECEP int Add(int a, int b)

 {

     return a + b;

 }

main.cpp

劫持Dll:HijackDll

用于劫持原Dll,并转发原程序的动态调用

 //last code by gwsbhqt at 20150727

 #include <cstdio>

 #include <windows.h>

 #define EXTERNC extern "C"

 #define NAKED __declspec(naked)

 #define EXPORT __declspec(dllexport)

 #define ECEP EXTERNC EXPORT

 #define ENCDECL EXTERNC NAKED void __cdecl

 #define EENSTD EXTERNC EXPORT NAKED void __stdcall

 #define EENFAST EXTERNC EXPORT NAKED void __fastcall

 #define ENDEF ENCDECL

 #define JMPFARPROC(lpModuleName, hProcName) \

     HMODULE hModule; \

     hModule = GetModuleHandleA((lpModuleName)); \

     if (NULL == hModule) hModule = LoadLibraryA((lpModuleName)); \

     if (NULL != GetProcAddress(hModule, (hProcName))) __asm JMP EAX;

 #pragma comment (linker, "/EXPORT:Add=_Add,@1")

 ENDEF Add()

 {

     JMPFARPROC("Dll.tmp", "Add");

 }

 BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)

 {

     switch (fdwReason)

     {

     case DLL_PROCESS_ATTACH:

         MessageBoxA(NULL, "Hijack Dll Attach", "", MB_ICONINFORMATION);

         break;

     case DLL_PROCESS_DETACH:

         MessageBoxA(NULL, "Hijack Dll Detach", "", MB_ICONINFORMATION);

         break;

     default:

         break;

     }

     return TRUE;

 }

main.cpp

此处的宏JMPFARPROC看起来似乎每次转发函数都会加载一次hModule,其实不会,先GetModuleHandle获得的hModule是不会增加引用计数的.

所以即使是大量的转发,也应该不会出现内存泄漏的问题.

都是些很简单的代码,仔细认真看看就好了

测试是只需要新建一个工程,工程下新建三个项目,分别是一个控制台程序和两个动态链接库,

在每个项目新建main.cpp文件,将代码贴入,生成工程之后.在Debug/Release文件夹下,将Dll.dll更名为Dll.tmp,将HijackDll.dll更名为Dll.dll...

即可完成Dll劫持...

DLL劫持技术例子: HijackDll的相关教程结束。