侠骨柔肠……
« »
2010年02月9日资源发布

关于远程线程插入的资料

Trying to put together a list of related works for reference. Only interested in User-Mode hooking, and the way should be generally applicable (SetWindowsHook is not generally applicable, for example).

Dll Injection

Win32 LD_PRELOAD
http://www.deez.info/sengelha/code/win32-ldpreload/

InjLib – A Library that implements remote code injection for all Windows versions
http://www.codeproject.com/KB/library/InjLib.aspx

Injected Evil
http://www.rootkit.com/newsread_print.php?newsid=831

Injecting Code Into Privileged Win32 Processes
http://mnin.blogspot.com/2007/05/injecting-code-into-privileged-win32.html

CreateRemoteThread, Vista and separate sessions
http://blog.assarbad.net/20080723/createremotethread-vista-and-separate-sessions/

A More Complete DLL Injection Solution Using CreateRemoteThread
http://69.10.233.10/KB/threads/completeinject.aspx

Injection coverage on Vista with UAC
http://www.celceo.com/blogs/windows-insight/2008/02/injection-coverage-on-vista-wi.html

WoW64

Dll Injection – Vista + UAC
http://forum.madshi.net/viewtopic.php?p=15825

How does one retrieve the 32-bit context of a Wow64 program from a 64-bit process on Windows Server 2003 x64?
http://www.nynaeve.net/?p=191

Beware GetThreadContext on Wow64
http://www.nynaeve.net/?p=129

API Interception

API Spying Techniques for Windows 9x, NT and 2000
http://www.internals.com/articles/apispy/apispy.htm

Powerful x86/x64 Mini Hook-Engine
http://www.ntcore.com/Files/nthookengine.htm

API Hooking Methods
http://help.madshi.net/ApiHookingMethods.htm

Detours: Binary Interception of Win32 Functions
http://research.microsoft.com/~galenh/publications/huntusenixnt99.pdf

DEVIARE API HOOK
http://www.nektra.com/products/deviare/hooklib/index.php

Intercepting System API Calls:
http://softwarecommunity.intel.com/articles/eng/3651.htm

Why hooking system services is more difficult (and dangerous) than it looks
http://www.nynaeve.net/?p=210

User Level API Hooking Mistakes to Avoid
http://www.celceo.com/blogs/windows-insight/2007/09/pitfalls-of-api-hooking-at-the.html

Detour unhooking order
http://www.celceo.com/blogs/windows-insight/2008/02/detour-unhooking-order.html

Lock contention, the loader lock and hidden API locks
http://www.celceo.com/blogs/windows-insight/2007/10/lock-contention-the-loader-loc.html

Summary

Three ways to inject dll:

•CreateRemoteThread (NtCreateThreadEx, RtlCreateUserThread…),
•NtQueueAPCThread,
•SetThreadContext.

The concerns around dll injection are:

•WoW64,
•Different Session (RunAs, RemoteDesktop and TerminalService),
•System Process(Run As User System),
•Native Process(Without Kernel32.dll),
•Create and inject.
API interception concerns:

•Instruction length
•Unhookable instructions
•Concurrency (Installing and Uninstalling time)
•Intercept self (Infinite loop)
•RIP-relative addressing

日志信息 »

该日志于2010-02-09 09:40由 姬良 发表在资源发布分类下， 你可以发表评论。除了可以将这个日志以保留源地址及作者的情况下引用到你的网站或博客，还可以通过RSS 2.0订阅这个日志的所有评论。

7条评论 ▼

  1. 祥 说：
    2010年04月24日 于 11:14 上午

    你好，姬良
    我是个大二学生，最近在学习WINDOWS编程，写了点代码，能成功插入DLL但下面这个问题找了好久都无法解决，想请你帮忙看看：
    Run-Time Check Failure #2 – Stack around the variable ‘u_p0′ was corrupted.
    相关代码：
    typedef struct _NT_PROC_THREAD_ATTRIBUTE_ENTRY
    {
    ULONG Attribute;
    SIZE_T Size;
    PULONG_PTR Value; //这里我改为PULONG_PTR
    ULONG Unknown;
    } NT_PROC_THREAD_ATTRIBUTE_ENTRY, *PNT_PROC_THREAD_ATTRIBUTE_ENTRY;

    typedef struct _NT_PROC_THREAD_ATTRIBUTE_LIST
    {
    ULONG Length;
    NT_PROC_THREAD_ATTRIBUTE_ENTRY Entry[2]; //这里我改为2
    } NT_PROC_THREAD_ATTRIBUTE_LIST,
    *PNT_PROC_THREAD_ATTRIBUTE_LIST;

    NT_PROC_THREAD_ATTRIBUTE_LIST AttributeList;

    memset (&AttributeList,0,sizeof(NT_PROC_THREAD_ATTRIBUTE_LIST));

    DWORD u_p0=0;
    DWORD u_p1=0;

    AttributeList.Length = sizeof(NT_PROC_THREAD_ATTRIBUTE_LIST);
    AttributeList.Entry[0].Attribute = 0×10003;
    AttributeList.Entry[0].Size = 0×8;
    AttributeList.Entry[0].Value = &u_p0;
    AttributeList.Entry[0].Unknown = 0;

    AttributeList.Entry[1].Attribute = 0×10004;
    AttributeList.Entry[1].Size = 4;
    AttributeList.Entry[1].Value = &u_p1;
    AttributeList.Entry[1].Unknown = 0;

    HANDLE hThread=NULL;
    NTSTATUS status = pfnNtCreateThreadEx(&hThread,0x1FFFFF,NULL,hTarget,lpLoadLibrary,
    lpTargetAddress,0,NULL,NULL,NULL,&AttributeList);

    可能是我改动了才会出错，希望有人能帮我看看，非常感谢！
    我的邮箱：cwiig@163.com

  2. 姬良 说：
    2010年04月24日 于 12:45 下午

    http://www.budoou.com/article/134416/

  3. 祥 说：
    2010年04月24日 于 5:35 下午

    谢谢回复，老实说我就是根据你给的网址内容来写的，只是出现
    Run-Time Check Failure #2 – Stack around the variable ‘u_p0′ was corrupted.
    让我试了好久没解决，能不能给点意见我再试试

  4. 姬良 说：
    2010年04月24日 于 9:53 下午

    你的测试平台是怎么个配备。

  5. 祥 说：
    2010年04月24日 于 11:56 下午

    这个“配备”是指我的笔记本，还是指我的VS2008呢？
    刚才干脆就用换用DWORDLONG的u_p0通过了，不懂是不是系统的版本问题，还是偶然因素，不知道根本原因总有点不爽

  6. 姬良 说：
    2010年04月25日 于 8:31 上午

    我指的是你的测试环境和编译环境。你用的那个变量类型会随着系统位宽的变化而变换大小。

  7. 祥 说：
    2010年04月25日 于 11:20 下午

    O 谢谢

发表评论 »


返回顶部