Autor
|
Tema: Inyectar una DLL en un proceso con vb (Leído 2,473 veces)
|
XP.
Desconectado
Mensajes: 121
|
Hola, estuve buscando y buscando y buscando por dias hasta que encontre un codigo que funcione bien. El tema es que el que consegui Ejecuta la aplicacion y le inyecta la DLL, lo que yo necesito es que inyecte la dll en un proceso, no que CREEE un proceso y le inyecte la dll, no se si se entiende.. El proceso ya esta corriendo no hay que crearlo. aca posteo el inyector, si alguien puede ayudarme mil gracias! Private Declare Function ForceLibrary Lib "forcelibrary.dll" (ByVal szDll As String, lpProcessInformation As PROCESS_INFORMATION) As Long Private Declare Function CreateProcess Lib "kernel32" Alias "CreateProcessA" _ (ByVal lpApplicationName As Long, ByVal lpCommandLine As String, _ ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, _ ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, _ ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, _ lpStartupInfo As STARTUPINFO, _ lpProcessInformation As PROCESS_INFORMATION) As Long Private Declare Function ResumeThread Lib "kernel32.dll" (ByVal hThread As Long) As Long
Private Type STARTUPINFO cb As Long lpReserved As String lpDesktop As String lpTitle As String dwX As Long dwY As Long dwXSize As Long dwYSize As Long dwXCountChars As Long dwYCountChars As Long dwFillAttribute As Long dwFlags As Long wShowWindow As Integer cbReserved2 As Integer lpReserved2 As Long hStdInput As Long hStdOutput As Long hStdError As Long End Type
Private Type PROCESS_INFORMATION hProcess As Long hThread As Long dwProcessID As Long dwThreadID As Long End Type
Private Sub Command4_Click() Dim ret As Long Dim inicio As STARTUPINFO Dim proce As PROCESS_INFORMATION
inicio.cb = Len(inicio) proce.hProcess = -1 proce.hThread = -1
ret& = CreateProcess(0&, "C:\Archivos de programa\Valve\hl.exe -nomaster -game cstrike", 0&, 0&, 0&, CREATE_SUSPENDED, 0&, 0, inicio, proce) If ret = 0 Then MsgBox ("Error en CreateProcess") End If
ret = ForceLibrary(CurDir & "\hook.dll", proce) If ret = 0 Then MsgBox ("Error en ForceLibrary") End If
ret = ResumeThread(proce.hThread) End Sub
|
|
« Última modificación: 15 Julio 2006, 05:23 am por XP. »
|
En línea
|
|
|
|
NekroByte
|
Pues para empezar tendrías que deshacerte del CreateProccess.
Yo ni idea de cómo trabajar con funciones enfocadas al nivel binario, pero el algoritmo vendría siendo un código que haga un GetProcess, luego un ReadFile para obtener los datos binarios. Cuando tengas en tu poder el programa descompuesto a instrucciones de nivel máquina, buscas la dirección de memoria en la que se encuentren las dependencias del programa y le agregarías, no sé, una referencia hacia el archivo DLL.
Lo que no sé es si para eso tendrías que correr todas las direcciones para que quepa tu offset de código o hacer unos JMP que redireccionen.
Repito, ni idea de aquella zona de VB pero creo que esa es la forma.
Hilsen.
|
|
|
En línea
|
|
|
|
XP.
Desconectado
Mensajes: 121
|
mmm, la tengo complicada parece
|
|
|
En línea
|
|
|
|
XP.
Desconectado
Mensajes: 121
|
dios, puse el mismo code 2 veces
|
|
« Última modificación: 19 Julio 2006, 18:16 pm por XP. »
|
En línea
|
|
|
|
|
XP.
Desconectado
Mensajes: 121
|
Deja los cheats y aprende a jugar CS Quien dijo que uso cheats?? todo lo contrario maestro... estoy haciendo un anticheat y quiero inyectarle mi AC al hl.exe de esa manera si inyectan cheats lo hacen sobre mi programa y los va a banear entendes?
|
|
|
En línea
|
|
|
|
NYlOn
Desconectado
Mensajes: 842
OOOOHHHHHH, TARAGÜIIII xDDDDDD
|
Antes q nada disculpas por la acusacion . Pero hay algo que no entiendo, como pretendes que la gente abra tu programa? Osea, si yo quiero jugar con cheats, simplemente no abro tu programa y listo... Podrias explicarme? Me da curiosidad Un saludo.-
|
|
|
En línea
|
|
|
|
XP.
Desconectado
Mensajes: 121
|
si lo pongo aca ya me hackean el programa
|
|
« Última modificación: 19 Julio 2006, 21:05 pm por XP. »
|
En línea
|
|
|
|
|
XP.
Desconectado
Mensajes: 121
|
en este post http://foro.elhacker.net/index.php/topic,123615.0.htmle encontrado este code: Option Explicit
Public hModule As Long Public hProcess As Long Public dwSize As Long Public dwPid As Long Public dwBytesWritten As Long Public dwTid As Long
Public SE As SECURITY_ATTRIBUTES
Public Const PAGE_READONLY As Long = &H2 Public Const PAGE_READWRITE As Long = &H4 Public Const PAGE_EXECUTE As Long = &H10 Public Const PAGE_EXECUTE_READ As Long = &H20 Public Const PAGE_EXECUTE_READWRITE As Long = &H40 Public Const MEM_RELEASE As Long = &H8000 Public Const MEM_COMMIT As Long = &H1000 Public Const MEM_RESERVE As Long = &H2000 Public Const MEM_RESET As Long = &H80000 Public Const STANDARD_RIGHTS_REQUIRED As Long = &HF0000 Public Const SYNCHRONIZE As Long = &H100000 Public Const PROCESS_ALL_ACCESS As Long = (STANDARD_RIGHTS_REQUIRED Or SYNCHRONIZE Or &HFFF) Public Const INFINITE As Long = &HFFFFFF
Public Type SECURITY_ATTRIBUTES nLength As Long lpSecurityDescriptor As Long bInheritHandle As Long End Type
Private Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Long, ByVal lpAddress As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long Private Declare Function VirtualFreeEx Lib "kernel32" (ByVal hProcess As Long, lpAddress As Any, ByVal dwSize As Long, ByVal dwFreeType As Long) As Long Public Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Long, lpThreadAttributes As SECURITY_ATTRIBUTES, ByVal dwStackSize As Long, lpStartAddress As Long, lpParameter As Any, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Long, lpdwProcessId As Long) As Long Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long Public Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Sub Main() Inject App.Path & "\Ejemplo.dll", "Notepad" End Sub
Public Function Inject(szDll As String, szTargetWindowClassName As String) As Boolean Dim hWnd As Long Dim k32LL As Long Dim Thread As Long
SE.nLength = Len(SE) SE.lpSecurityDescriptor = False 'Encontrar la ventana y abrir el proceso hWnd = FindWindow(szTargetWindowClassName, vbNullString) GetWindowThreadProcessId hWnd, dwPid hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, dwPid) If hProcess = 0 Then GoTo Inject_Error k32LL = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA") 'Reservamos memoria hModule = VirtualAllocEx(hProcess, 0, LenB(szDll), MEM_COMMIT, PAGE_READWRITE) If hModule = 0 Then GoTo Inject_Error WriteProcessMemory hProcess, ByVal hModule, ByVal szDll, LenB(szDll), dwBytesWritten Thread = CreateRemoteThread(hProcess, SE, 0, ByVal k32LL, ByVal hModule, 0, dwTid) If Thread = 0 Then GoTo Inject_Error 'Clean up a bit WaitForSingleObject Thread, 100 VirtualFreeEx hProcess, hModule, 0&, MEM_RELEASE CloseHandle Thread
Exit Function
Inject_Error: Inject = False MsgBox "error" Exit Function End Function
probe con ese, la dll se inyecta perfecto pero no corre, alguna sugerencia?
|
|
|
En línea
|
|
|
|
|
|