驱动中给进程注入DLL，模拟GlobaHook，不完整，某些情况下报错

深藏阁楼爱情的钟 2022-08-19 15:07 78阅读 0赞

利用 PsSetLoadImageNotifyRoutine 设置回调，等有镜像被加载的时候，根据进程PID获取基址，然后和镜像基址对比，  
如果相同，则加载的是进程EXE的镜像，这个时候通过修改镜像头中的导入表 来注入DLL。  
修改导入表部分的代码，是修改的MS的detours库来的。  
经过测试大部分进程注入都没问题，碰到一些比较特殊的进程运行的时候会报错，请教高手。。。  
一下是核心代码：  
  
//获取进程基址  
PVOID GetProcessBaseAddress(IN HANDLE PID)  
\{   
 NTSTATUS status;  
 HANDLE hProcess = NULL;  
 CLIENT\_ID clientid;  
 OBJECT\_ATTRIBUTES ObjectAttributes;  
 PPROCESS\_BASIC\_INFORMATION pProcessBaseInfo;  
 ULONG returnedLength;  
 PMY\_PEB Peb;  
 PVOID ImageBase = NULL;  
  
 if(KeGetCurrentIrql() >= DISPATCH\_LEVEL)  
 \{   
 return ImageBase;  
 \}  
  
 InitializeObjectAttributes(&ObjectAttributes, 0, OBJ\_CASE\_INSENSITIVE|OBJ\_KERNEL\_HANDLE, 0, 0);  
 clientid.UniqueProcess = PID;  
 clientid.UniqueThread = 0;  
 //通过PID获得进程句柄  
 status = ZwOpenProcess(&hProcess, PROCESS\_ALL\_ACCESS, &ObjectAttributes, &clientid);  
 if(!NT\_SUCCESS(status))  
 \{   
 DbgPrint("\[GetProcessBaseAddress\] ZwOpenProcess 调用失败\\n");  
 return ImageBase;  
 \}  
  
 pProcessBaseInfo = (PPROCESS\_BASIC\_INFORMATION)ExAllocatePoolWithTag(NonPagedPool, sizeof(PROCESS\_BASIC\_INFORMATION), 'sam1');  
 if (pProcessBaseInfo == NULL)  
 \{   
 DbgPrint("\[GetProcessBaseAddress\]ExAllocatePoolWithTag 分配内存失败\\n");  
 ZwClose(hProcess);  
 return ImageBase;   
 \}  
 RtlZeroMemory(pProcessBaseInfo, sizeof(PROCESS\_BASIC\_INFORMATION));  
  
 //获得文件镜像名  
 status = ZwQueryInformationProcess(hProcess, ProcessBasicInformation, pProcessBaseInfo, sizeof(PROCESS\_BASIC\_INFORMATION), &returnedLength);  
 if(NT\_SUCCESS(status))   
 \{   
 Peb = (PMY\_PEB)pProcessBaseInfo->PebBaseAddress;  
 ImageBase = Peb->Reserved3\[1\];  
 \}  
 else  
 \{   
 DbgPrint("\[GetProcessBaseAddress\]2.ZwQueryInformationProcess 调用失败\\n");  
 \}  
  
 ZwClose(hProcess);  
 ExFreePool(pProcessBaseInfo);  
 return ImageBase;  
\}  
//-----------------------------------------------------------------------------------------------------  
  
  
//---------------------------------------  
ULONG PadToDword(ULONG dw)  
\{   
 return (dw + 3) & ~3u;  
\}  
  
ULONG PadToDwordPtr(ULONG dw)  
\{   
 return (dw + 7) & ~7u;  
\}  
  
BOOLEAN StringCchCopyA(CHAR \*pszDest, size\_t cchDest, const CHAR \*pszSrc)  
\{   
 BOOLEAN hr = TRUE;  
  
 if (cchDest == 0)  
 \{   
 hr = FALSE;  
 \}  
 else  
 \{   
 while (cchDest && (\*pszSrc != '\\0'))  
 \{   
 \*pszDest++ = \*pszSrc++;  
 cchDest--;  
 \}  
  
 if (cchDest == 0)  
 \{   
 // we are going to truncate pszDest  
 pszDest--;  
 hr = FALSE;  
 \}  
  
 \*pszDest= '\\0';  
 \}  
  
 return hr;  
\}  
  
//修改导入表注入DLL  
BOOLEAN XXXXXDLL(IN HANDLE ProcessId, IN PVOID pImageBase, PCHAR lpDlls\[\], ULONG nDlls)  
\{   
 NTSTATUS ntStatus;  
  
 PEPROCESS EProcess;  
 KAPC\_STATE ApcState;  
 HANDLE hProcessHandle;  
 CHAR curProcessName\[16\] = \{0\};  
  
 PIMAGE\_DOS\_HEADER pDos; //DOS头  
 PIMAGE\_NT\_HEADERS pHeader; //NT头  
 PIMAGE\_IMPORT\_DESCRIPTOR pImportDesc; //原始导入表  
 PDETOUR\_CLR\_HEADER pClr;  
  
 ULONG nBound = 0;  
 ULONG dwFileSize = 0;  
 ULONG dwSec = 0;  
  
 PVOID pbNewIid = NULL;  
 PVOID pbNew = NULL;  
 ULONG cbNew = 0;  
 ULONG obRem = 0;  
 ULONG obTab = 0;  
 ULONG obDll = 0;  
 ULONG obStr = 0;  
 ULONG cbTmp = 0;  
 ULONG obBase = 0;  
 ULONG i=0, n=0;  
  
 ULONG OldProtect = 0;  
 PVOID lpTemp1 = NULL;  
 ULONG dwTemp1 = 0;  
  
 if(ProcessId == 0 || pImageBase == NULL)  
 \{   
 return FALSE;  
 \}  
  
 pDos =(PIMAGE\_DOS\_HEADER) pImageBase;  
 pHeader = (PIMAGE\_NT\_HEADERS)((ULONG)pImageBase + (ULONG)pDos->e\_lfanew);  
 pImportDesc = (PIMAGE\_IMPORT\_DESCRIPTOR)((ULONG)pImageBase + pHeader->IMPORT\_DIRECTORY.VirtualAddress);  
  
 if(pHeader->IMPORT\_DIRECTORY.VirtualAddress == 0)  
 \{   
 return FALSE;  
 \}  
  
 if(PsLookupProcessByProcessId( (PVOID)ProcessId, (PEPROCESS \*)&EProcess) != STATUS\_SUCCESS)   
 \{   
 DbgPrint("\[XXXXXDLL\] PsLookupProcessByProcessId failed\\n");  
 return FALSE;  
 \}  
  
 \_\_try  
 \{   
 KeStackAttachProcess(EProcess, &ApcState);  
  
 ntStatus = ObOpenObjectByPointer(EProcess, OBJ\_KERNEL\_HANDLE, NULL, 0x008, NULL, KernelMode, &hProcessHandle);  
 if(!NT\_SUCCESS(ntStatus))   
 \{   
 DbgPrint("\[XXXXXDLL\] ObOpenObjectByPointer failed error \[%08X\]\\n", ntStatus);  
 \_\_leave;  
 \}  
  
 lpTemp1 = (PVOID)(&pHeader->BOUND\_DIRECTORY.VirtualAddress);  
 dwTemp1 = 4;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, PAGE\_EXECUTE\_READWRITE, &OldProtect);  
 pHeader->BOUND\_DIRECTORY.VirtualAddress = 0;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, OldProtect, NULL);  
  
 lpTemp1 = (PVOID)(&pHeader->BOUND\_DIRECTORY.Size);  
 dwTemp1 = 4;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, PAGE\_EXECUTE\_READWRITE, &OldProtect);  
 pHeader->BOUND\_DIRECTORY.Size = 0;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, OldProtect, NULL);  
  
  
 dwSec = (ULONG)pDos->e\_lfanew + FIELD\_OFFSET( IMAGE\_NT\_HEADERS, OptionalHeader ) + pHeader->FileHeader.SizeOfOptionalHeader;  
 for (i=0; i<pHeader->FileHeader.NumberOfSections; i++)   
 \{   
 PIMAGE\_SECTION\_HEADER pSectionHeader;  
 pSectionHeader = (PIMAGE\_SECTION\_HEADER)((ULONG)pImageBase + dwSec + (sizeof(IMAGE\_SECTION\_HEADER) \* i));  
  
 // 如果该文件不具有IAT\_DIRECTORY，我们创建一个.  
 if (pHeader->IAT\_DIRECTORY.VirtualAddress == 0 &&  
 pHeader->IMPORT\_DIRECTORY.VirtualAddress >= pSectionHeader->VirtualAddress &&  
 pHeader->IMPORT\_DIRECTORY.VirtualAddress < pSectionHeader->VirtualAddress +pSectionHeader->SizeOfRawData  
 )   
 \{   
 lpTemp1 = (PVOID)(&pHeader->IAT\_DIRECTORY.VirtualAddress);  
 dwTemp1 = 4;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, PAGE\_EXECUTE\_READWRITE, &OldProtect);  
 pHeader->IAT\_DIRECTORY.VirtualAddress = pSectionHeader->VirtualAddress;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, OldProtect, NULL);  
  
 lpTemp1 = (PVOID)(&pHeader->IAT\_DIRECTORY.Size);  
 dwTemp1 = 4;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, PAGE\_EXECUTE\_READWRITE, &OldProtect);  
 pHeader->IAT\_DIRECTORY.Size = pSectionHeader->SizeOfRawData;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, OldProtect, NULL);  
 \}  
  
 // Find the end of the file...  
 if (dwFileSize < pSectionHeader->PointerToRawData + pSectionHeader->SizeOfRawData)  
 \{   
 dwFileSize = pSectionHeader->PointerToRawData + pSectionHeader->SizeOfRawData;  
 \}  
 \}  
  
 obRem = sizeof(IMAGE\_IMPORT\_DESCRIPTOR) \* nDlls;  
 obTab = PadToDwordPtr(obRem + pHeader->IMPORT\_DIRECTORY.Size);  
 obDll = obTab + sizeof(DWORD\_PTR) \* 4 \* nDlls;  
 obStr = obDll;  
 cbNew = obStr;  
  
 for(n=0; n<nDlls; n++)   
 \{   
 cbNew += PadToDword((DWORD)strlen(lpDlls\[n\]) + 1);  
 \}  
  
 // 分配本地内存，先在本地内存中构造好输入表  
 pbNew = ExAllocatePoolWithTag(NonPagedPool, cbNew, 'sam1');  
 if (pbNew == NULL)   
 \{   
 DbgPrint("\[XXXXXDLL\] ExAllocatePoolWithTag cbNew faile\\n");  
 \_\_leave;  
 \}  
 RtlZeroMemory(pbNew, cbNew);  
  
 // 在进程中分配和本地内存同样大小的虚拟内存  
 cbTmp = cbNew;  
 ntStatus = ZwAllocateVirtualMemory(hProcessHandle, &pbNewIid, 0, &cbTmp, MEM\_COMMIT|MEM\_TOP\_DOWN, PAGE\_EXECUTE\_READWRITE);  
 if(!NT\_SUCCESS(ntStatus))  
 \{   
 DbgPrint("\[XXXXXDLL\] ZwAllocateVirtualMemory pbNewIid failed error \[%08X\]\\n", ntStatus);  
 \_\_leave;  
 \}  
 RtlZeroMemory(pbNewIid, cbNew);  
  
 // pbNewIid 是我们在远程线程分配的新的输入表的首地址,和pbModule想减后就得到它的RVA了  
 obBase = (ULONG)((ULONG)pbNewIid - (ULONG)pImageBase);  
  
 // 将旧的输入表读入到本地内存,注意有一个偏移obRem  
 RtlCopyMemory((PUCHAR)((ULONG)pbNew + obRem), pImportDesc, pHeader->IMPORT\_DIRECTORY.Size);  
  
 \{   
 PIMAGE\_IMPORT\_DESCRIPTOR piid = (PIMAGE\_IMPORT\_DESCRIPTOR)pbNew;  
 ULONG\_PTR \*pt = NULL;  
 ULONG nOffset = 0;  
  
 for(n=0; n<nDlls; n++)  
 \{   
 if(!StringCchCopyA((char\*)pbNew + obStr, cbNew - obStr, lpDlls\[n\]))  
 \{   
 DbgPrint("StringCchCopyA 拷贝DLL路径失败\\n");  
 \_\_leave;  
 \}  
  
 nOffset = obTab + (sizeof(ULONG\_PTR) \* (4 \* n));  
 piid\[n\].OriginalFirstThunk = obBase + nOffset;  
 pt = ((ULONG\_PTR\*)((ULONG)pbNew + nOffset));  
 pt\[0\] = IMAGE\_ORDINAL\_FLAG + 1;  
 pt\[1\] = 0;  
  
 nOffset = obTab + (sizeof(ULONG\_PTR) \* ((4 \* n) + 2));  
 piid\[n\].FirstThunk = obBase + nOffset;  
 pt = ((ULONG\_PTR\*)((ULONG)pbNew + nOffset));  
 pt\[0\] = IMAGE\_ORDINAL\_FLAG + 1;  
 pt\[1\] = 0;  
  
 piid\[n\].TimeDateStamp = 0;  
 piid\[n\].ForwarderChain = 0;  
 piid\[n\].Name = obBase + obStr;  
  
 obStr += PadToDword((ULONG)strlen(lpDlls\[n\]) + 1);  
 \}  
 \}  
  
 //Update the CLR header.  
 if (pHeader->CLR\_DIRECTORY.VirtualAddress != 0 && pHeader->CLR\_DIRECTORY.Size != 0)   
 \{   
 ULONG flg = 0;  
 pClr = (PDETOUR\_CLR\_HEADER)((ULONG)pImageBase + pHeader->CLR\_DIRECTORY.VirtualAddress);  
 flg = pClr->Flags & 0xfffffffe;  
  
 lpTemp1 = (PVOID)(&pClr->Flags);  
 dwTemp1 = 4;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, PAGE\_EXECUTE\_READWRITE, &OldProtect);  
 pClr->Flags = flg;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, OldProtect, NULL);  
 \}  
  
 if(pHeader->IMPORT\_DIRECTORY.VirtualAddress > 0)  
 \{   
 //拷贝本地内存中的新的输入表数据到虚拟内存中  
 ntStatus = ZwWriteVirtualMemory(hProcessHandle, pbNewIid, pbNew, obStr, NULL);  
 if(!NT\_SUCCESS(ntStatus))  
 \{   
 DbgPrint("\[XXXXXDLL\] ZwWriteVirtualMemory pbNewIid failed error \[%08X\]\\n", ntStatus);  
 \_\_leave;  
 \}  
  
  
 KdPrint(("原导入表: \[%08X\] - \[%d\]\\n", pHeader->IMPORT\_DIRECTORY.VirtualAddress, pHeader->IMPORT\_DIRECTORY.Size));  
 //设置输入表的地址和大小，为刚才分配的虚拟内存  
 lpTemp1 = (PVOID)(&pHeader->IMPORT\_DIRECTORY.VirtualAddress);  
 dwTemp1 = 4;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, PAGE\_EXECUTE\_READWRITE, &OldProtect);  
 pHeader->IMPORT\_DIRECTORY.VirtualAddress = obBase;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, OldProtect, NULL);  
  
 lpTemp1 = (PVOID)(&pHeader->IMPORT\_DIRECTORY.Size);  
 dwTemp1 = 4;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, PAGE\_EXECUTE\_READWRITE, &OldProtect);  
 pHeader->IMPORT\_DIRECTORY.Size = cbNew;  
 ZwProtectVirtualMemory(hProcessHandle, &lpTemp1, &dwTemp1, OldProtect, NULL);  
  
 KdPrint(("新导入表: \[%08X\] - \[%d\]\\n", pHeader->IMPORT\_DIRECTORY.VirtualAddress, pHeader->IMPORT\_DIRECTORY.Size));  
 \}  
 \}  
 \_\_finally  
 \{   
 if(pbNew)  
 \{   
 ExFreePool(pbNew);  
 \}  
  
 if(hProcessHandle)  
 \{   
 ZwClose(hProcessHandle);  
 hProcessHandle = NULL;  
 \}  
  
 KeUnstackDetachProcess(&ApcState);  
 \}  
  
 ObDereferenceObject(EProcess);  
 return TRUE;  
\}  
//--------------------------------------------------------------------------------------  
  
  
//LoadImage回调，在此注入DLL  
VOID LoadImageRoutine(  
 IN PUNICODE\_STRING FullImageName,  
 IN HANDLE ProcessId, // where image is mapped  
 IN PIMAGE\_INFO ImageInfo  
 )  
\{   
 PVOID pProcessBase = NULL;  
  
 if(ImageInfo->SystemModeImage)  
 \{   
 \}  
 else  
 \{   
 pProcessBase = GetProcessBaseAddress(ProcessId);  
 if(pProcessBase == ImageInfo->ImageBase)  
 \{   
 //注入DLL  
 CHAR \*rlpDlls\[2\];  
 ULONG nDlls = 0;  
 rlpDlls\[nDlls++\] = "HookReg.dll";  
 XXXXXDLL(ProcessId, ImageInfo->ImageBase, rlpDlls, nDlls);  
 \}  
 \}  
\}