PE注入

 // PE注入.cpp : 定义控制台应用程序的入口点。
 //

 #include "stdafx.h"

 #include <windows.h>

 #include <tlhelp32.h>

 #include <process.h>

 #include <stdio.h>

 #pragma comment (lib, "winmm.lib")

 #pragma comment (lib, "kernel32.lib")

 /*获取进程ID号*/

 DWORD GetProcessIdByName(LPWSTR name)

 {

     PROCESSENTRY32 pe32;

     HANDLE snapshot = NULL;

     DWORD pid = ;

     snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, );

     if (snapshot != INVALID_HANDLE_VALUE)

     {

         pe32.dwSize = sizeof(PROCESSENTRY32);

         if (Process32First(snapshot, &pe32))

         {

             do

             {

                 if (!lstrcmp(pe32.szExeFile, name))

                 {

                     pid = pe32.th32ProcessID;

                     break;

                 }

             } while (Process32Next(snapshot, &pe32));

         }

         CloseHandle(snapshot);

     }

     return pid;

 }

 extern "C" void mainCRTStartup();
 DWORD main();

 /**
  
  * 远程进程内存中注入PE
   
   */

 HMODULE injectModule(HANDLE proc, LPVOID module)

 {

     DWORD i = ;

     DWORD_PTR delta = NULL;

     DWORD_PTR olddelta = NULL;

     /* 获取模块PE头 */

     PIMAGE_NT_HEADERS headers = (PIMAGE_NT_HEADERS)((LPBYTE)module + ((PIMAGE_DOS_HEADER)module)->e_lfanew);

     PIMAGE_DATA_DIRECTORY datadir;

     /* 计算注入代码长度 */

     DWORD moduleSize = headers->OptionalHeader.SizeOfImage;

     LPVOID distantModuleMemorySpace = NULL;

     LPBYTE tmpBuffer = NULL;

     BOOL ok = FALSE;

     if (headers->Signature != IMAGE_NT_SIGNATURE)

         return NULL;

     if (IsBadReadPtr(module, moduleSize))

         return NULL;

     distantModuleMemorySpace = VirtualAllocEx(proc, NULL, moduleSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

     if (distantModuleMemorySpace != NULL)

     {

         tmpBuffer = (LPBYTE)VirtualAlloc(NULL, moduleSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

         if (tmpBuffer != NULL)

         {

             RtlCopyMemory(tmpBuffer, module, moduleSize);

             datadir = &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];

             if (datadir->Size >  && datadir->VirtualAddress > )

             {

                 delta = (DWORD_PTR)((LPBYTE)distantModuleMemorySpace - headers->OptionalHeader.ImageBase);

                 olddelta = (DWORD_PTR)((LPBYTE)module - headers->OptionalHeader.ImageBase);

                 PIMAGE_BASE_RELOCATION reloc = (PIMAGE_BASE_RELOCATION)(tmpBuffer + datadir->VirtualAddress);

                 while (reloc->VirtualAddress != )

                 {

                     if (reloc->SizeOfBlock >= sizeof(IMAGE_BASE_RELOCATION))

                     {

                         DWORD relocDescNb = (reloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);

                         LPWORD relocDescList = (LPWORD)((LPBYTE)reloc + sizeof(IMAGE_BASE_RELOCATION));

                         for (i = ; i < relocDescNb; i++)

                         {

                             if (relocDescList[i] > )

                             {

                                 DWORD_PTR *p = (DWORD_PTR *)(tmpBuffer + (reloc->VirtualAddress + (0x0FFF & (relocDescList[i]))));

                                 *p -= olddelta;

                                 *p += delta;

                             }

                         }

                     }

                     reloc = (PIMAGE_BASE_RELOCATION)((LPBYTE)reloc + reloc->SizeOfBlock);

                 }

                 tmpBuffer[(DWORD)main - (DWORD)module] = 0x55;

                 ok = WriteProcessMemory(proc, distantModuleMemorySpace, tmpBuffer, moduleSize, NULL);

             }

             VirtualFree(tmpBuffer, , MEM_RELEASE);

         }

         if (!ok)

         {

             VirtualFreeEx(proc, distantModuleMemorySpace, , MEM_RELEASE);

             distantModuleMemorySpace = NULL;

         }

     }

     return (HMODULE)distantModuleMemorySpace;

 }

 /**
  
  * 获取DEBUG权限
   
   */

 BOOL EnableDebugPrivileges(void)

 {

     HANDLE token;

     TOKEN_PRIVILEGES priv;

     BOOL ret = FALSE;

     if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))

     {

         priv.PrivilegeCount = ;

         priv.Privileges[].Attributes = SE_PRIVILEGE_ENABLED;

         if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &priv.Privileges[].Luid) != FALSE &&

             AdjustTokenPrivileges(token, FALSE, &priv, , NULL, NULL) != FALSE)

         {

             ret = TRUE;

         }

         CloseHandle(token);

     }

     return ret;

 }

 BOOL peInjection(DWORD pid, LPTHREAD_START_ROUTINE callRoutine)

 {

     HANDLE proc, thread;

     HMODULE module, injectedModule;

     BOOL result = FALSE;

     proc = OpenProcess(PROCESS_CREATE_THREAD |

         PROCESS_QUERY_INFORMATION |

         PROCESS_VM_OPERATION |

         PROCESS_VM_WRITE |

         PROCESS_VM_READ,

         FALSE,

         pid);

     if (proc != NULL)

     {

         module = GetModuleHandle(NULL);

         injectedModule = (HMODULE)injectModule(proc, module);

         if (injectedModule != NULL)

         {

             LPTHREAD_START_ROUTINE remoteThread = (LPTHREAD_START_ROUTINE)((LPBYTE)injectedModule + (DWORD_PTR)((LPBYTE)callRoutine - (LPBYTE)module));

             thread = CreateRemoteThread(proc, NULL, , remoteThread, NULL, , NULL);

             if (thread != NULL)

             {

                 CloseHandle(thread);

                 result = TRUE;

             }

             else

             {

                 VirtualFreeEx(proc, module, , MEM_RELEASE);

             }

         }

         CloseHandle(proc);

     }

     return result;

 }

 DWORD WINAPI entryThread(LPVOID param)

 {

     DWORD newModuleD = (DWORD)param;

     MessageBox(NULL, L"Injection success.Now initializing runtime library.", NULL, );

     //mainCRTStartup();

     MessageBox(NULL, L"This will never be called.", NULL, );

     return ;

 }

 void entryPoint()

 {

     MessageBox(NULL, L"entryPoint", NULL, );

     EnableDebugPrivileges();

     //peInjection(GetProcessIdByName(L"explorer.exe"), entryThread);
     peInjection( , entryThread);

 }
 DWORD main()

 {

     //MessageBox(NULL, L"In Main ", NULL, 0);

     printf("This printf can work because runtime library is now initialized.\n");
     entryPoint();

     //(NULL, L"In main end", NULL, 0);

     ExitThread();

     return ;

 }

通过此方法可将一个进程的完整镜像完全注入到另外一个进程的内存空间中，从而在一个进程空间中包含了两套不同的代码。与DLL注入相比，PE注入的主要优势是不需要很多文件，只需要MAIN.EXE注入到其他进程并唤起自身代码即可。