CreateProcess注入程序后DLL恢复，记事本没有问题，剩下的chrome和IE都有问题，OD挂上去看了一下原入口也是还原没问题，指针跳转没问题，求大神，下边是代码
DLL端（用来还原入口代码）
dllmain.h(空文件)
-----------------------------------------------------------------------------------------------------------
dllmain.cpp
-----------------------------------------------------------------------------------------------------------
// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "stdafx.h"
#include "dllmain.h"
// 监视程序和DLL共用的结构体
#pragma pack (push ,1) // 保证下面的结构体采用BYTE对齐（必须）
typedef struct INJECT_CODE
{
BYTE int_PUSHAD; // pushad 0x60
BYTE int_PUSH; // push &szDLL 0x68
DWORD push_Value; // &szDLL = "ApiSpy.dll"的path
BYTE int_MOVEAX; // move eax &LoadLibrary 0xB8
DWORD eax_Value; // &LoadLibrary
WORD call_eax; // call eax 0xD0FF(FF D0) (LoadLibrary("ApiSpy.dll");
BYTE jmp_MOVEAX; // move eax &ReplaceOldCode 0xB8
DWORD jmp_Value; // JMP的参数
WORD jmp_eax; // jmp eax 0xE0FF(FF E0) jmp ReplaceOldCode;
char szDLL[MAX_PATH]; // "ApiSpy.dll"的FullPath
}INJECT_LOADLIBRARY_CODE, *LPINJECT_CODE;
#pragma pack (pop , 1)
typedef struct
{
LPBYTE lpEntryPoint; // 目标进程的入口地址
BYTE oldcode[sizeof(INJECT_CODE)]; // 目标进程的代码保存
}SPY_MEM_SHARE, *LPSPY_MEM_SHARE;
typedef struct
{
DWORD lpEntryPoint;
DWORD OldAddr;
DWORD OldCode[4];
}JMP_CODE, *LPJMP_CODE;
static JMP_CODE _lpCode;
void Start(){
MessageBox(NULL, "准备写回原入口", NULL, MB_OK);
HANDLE hMap;
LPSPY_MEM_SHARE lpMem;
DWORD dwSize;
// 取得FileMapping的句柄
hMap = OpenFileMapping(FILE_MAP_ALL_ACCESS, 0, "MyDllMapView");
if (hMap)
{
lpMem = (LPSPY_MEM_SHARE)MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if (lpMem)
{
_lpCode.lpEntryPoint = (DWORD)lpMem->lpEntryPoint;
// 恢复目标进程的入口代码
WriteProcessMemory(GetCurrentProcess(), lpMem->lpEntryPoint, lpMem->oldcode, sizeof(INJECT_CODE), &dwSize);
UnmapViewOfFile(lpMem);
CloseHandle(hMap);
MessageBox(NULL, "已写回原入口", NULL, MB_OK);
__asm{
popad
jmp _lpCode.lpEntryPoint
}
}
}
}
char szBuffer[MAX_PATH];
BOOL APIENTRY DllMain(HMODULE hModule,DWORD ul_reason_for_call,LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:{
Start();
break;
}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
EXE端，关键代码
--------------------------------------------------------------------------------------------------------
USES_CONVERSION;
CString sRunFile;
sRunFile = "C:\\windows\\system32\\calc.exe";
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi = {0};
CString sRunCommandLine;
sRunCommandLine.Format(_TEXT("%s"), sRunFile.GetString());
BOOL bRet = CreateProcess(NULL, sRunCommandLine.GetBuffer(0), NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
if (bRet){
LPBYTE pEntryPoint = GetExeEntryPointI(pi.hProcess,T2A(sRunFile));
if (pEntryPoint){
HANDLE hMap = CreateFileMapping((HANDLE)0xFFFFFFFF, NULL, PAGE_READWRITE, 0, sizeof(SPY_MEM_SHARE), TEXT("MyDllMapView"));
LPSPY_MEM_SHARE lpMap = (LPSPY_MEM_SHARE)MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0);
SIZE_T stRead;
ReadProcessMemory(pi.hProcess, pEntryPoint, &lpMap->oldcode, sizeof(INJECT_CODE),&stRead);
lpMap->lpEntryPoint = pEntryPoint;
INJECT_CODE newCode;
GetCurrentDirectoryA(MAX_PATH, newCode.szDLL);
strcat_s(newCode.szDLL, "\\dll.dll");
// 准备硬代码（汇编代码）
newCode.int_PUSHAD = 0x60;
newCode.int_PUSH = 0x68;
newCode.int_MOVEAX = 0xB8;
newCode.call_eax = 0xD0FF;
newCode.jmp_MOVEAX = 0xB8;
newCode.jmp_eax = 0xE0FF;
newCode.eax_Value = (DWORD)&LoadLibraryA;
newCode.push_Value = (DWORD)(pEntryPoint + offsetof(INJECT_CODE, szDLL));
DWORD dwNew***, dwOld***;
dwNew*** = PAGE_READWRITE;
VirtualProtectEx(pi.hProcess, (LPVOID)pEntryPoint, sizeof(DWORD), dwNew***, &dwOld***);
WriteProcessMemory(pi.hProcess, pEntryPoint, &newCode, sizeof(newCode), NULL);//&dwWrited);
//WriteProcessMemory(pi.hProcess, pEntryPoint, &lpMap->oldcode, sizeof(INJECT_CODE),NULL);
VirtualProtectEx(pi.hProcess, (LPVOID)pEntryPoint, sizeof(DWORD), dwOld***, &dwNew***);
UnmapViewOfFile(lpMap);
ResumeThread(pi.hThread);
}
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
}
--------------------------------------------------------------------------------------------------------
求大神指点，以下是两个工程打包附件
ProxyDLL.rar 为EXE代码
Main.rar为MFC代码
bin.rar为编译文件
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
