課程設(shè)計(jì)題目：自動(dòng)內(nèi)存駐留程序院、系：計(jì)算機(jī)科學(xué)與技術(shù)學(xué)院網(wǎng)絡(luò)工程系班級(jí)學(xué)號(hào)：姓名:同組成員:指導(dǎo)教師:成績(jī):2014年06月27日一.系統(tǒng)設(shè)計(jì)的目標(biāo)編寫(xiě)程序，把指定代碼注入相應(yīng)程序中，達(dá)到操作簡(jiǎn)單，并且容易實(shí)現(xiàn)駐留在內(nèi)存的目的，另一個(gè)目的是使注入程序在管理員不注意下不會(huì)輕易被發(fā)現(xiàn)，有一定的隱藏性。系統(tǒng)原理：采用遠(yuǎn)程注入和動(dòng)態(tài)鏈接庫(kù)技術(shù)，把動(dòng)態(tài)鏈接庫(kù)注入到目標(biāo)進(jìn)程，讓動(dòng)態(tài)鏈接庫(kù)在目標(biāo)進(jìn)程的內(nèi)存中運(yùn)行，從而達(dá)到駐留在內(nèi)存的效果。系統(tǒng)功能分析：這個(gè)程序較小，操作簡(jiǎn)單，非計(jì)算機(jī)專業(yè)的人員也容易執(zhí)行，占用內(nèi)存少，運(yùn)行速度較快，方便對(duì)內(nèi)存的注入，暫無(wú)發(fā)現(xiàn)不能容忍的bug,一般情況下能夠正常運(yùn)行，但是缺點(diǎn)在于容易被發(fā)現(xiàn)。系統(tǒng)實(shí)現(xiàn):詳細(xì)設(shè)計(jì)首先先編譯動(dòng)態(tài)鏈接庫(kù):然后編譯mfc：

最后先選擇動(dòng)態(tài)鏈接庫(kù)的路徑，然后選擇相應(yīng)的進(jìn)程，雙擊它，再選擇注入：寥DllProisq心件*?1MyOiyHoolchSimVimjj)stdAbch&2敘件寥DllProisq心件*?1MyOiyHoolchSimVimjj)stdAbch&2敘件BifiWDIIProcess.cppLIde司DIIProces$.def■pmcjMyDiyHook.cpp<>jstdafx.cppff1二赍源文件ReadMe.txtBEG衛(wèi)MFCBnUr$以取件ENDB9汝文件<>jMFCEnter.cpp一〃」以MFCEnterDIg.cpp<I以stdafx.cpp宙_1細(xì)位件ReadMe.txt源程序代碼：〃動(dòng)態(tài)鏈接庫(kù)中的代碼:DllProcess.h#pragmaonce#ifndefDEF_DLL_PORT#defineDEF_DLL_PORT_declspec(dllimport)#endifDllProcess.cpp//DllProcess.cpp:定義DLL應(yīng)用程序的入口點(diǎn)。//#include"stdafx.h”#defineDEF_DLL_PORT_declspec(dllexport)#include"DllProcess.h"#include<tchar.h>#ifdef_MANAGED#pragmamanaged(push,off)#endifBOOL__stdcallMyCreateProcess(LPCTSTRlpApplicationName,LPTSTRlpCommandLine,LPSECURITY_ATTRIBUTESlpProcessAttributes,LPSECURITY_ATTRIBUTESlpThreadAttributes,BOOLbInheritHandles,DWORDdwCreationFlags,LPVOIDlpEnvironment,LPCTSTRlpCurrentDirectory,LPSTARTUPINFOlpStartupInfo,LPPROCESS_INFORMATIONlpProcessInformation)(returnTRUE;}BOOLAPIENTRYDllMain(HMODULEhModule,DWORDul_reason_for_call,LPVOIDlpReserved)(switch(ul_reason_for_call)(caseDLL_PROCESS_ATTACH:MessageBox(NULL,_T("注入成功?????！〃)，0,0);//自己想要運(yùn)行的程序//////break;caseDLL_PROCESS_DETACH:MessageBox(NULL,_T(〃卸載成功~!〃)，0,0);break;}returnTRUE;}#ifdef_MANAGED#pragmamanaged(pop)#endif//源程序代碼：MFCEnter.h//MFCEnter.h:PROJECT_NAME應(yīng)用程序的主頭文件//#pragmaonce#ifndef__AFXWIN_H__#error”在包含此文件之前包含“stdafx.h”以生成PCH文件”#endif#include"resource.h"http://主符號(hào)//CMFCEnterApp://有關(guān)此類的實(shí)現(xiàn)，請(qǐng)參閱MFCEnter.cpp//classCMFCEnterApp:publicCWinApp{public:CMFCEnterApp();//重寫(xiě)public:virtualBOOLInitInstance();//實(shí)現(xiàn)DECLARE_MESSAGE_MAP()};externCMFCEnterApptheApp;MFCEnterDlg.h//MFCEnterDlg.h:頭文件//#pragmaonce#include"afxwin.h"#include<Tlhelp32.h>#include"afxcmn.h"#include<Psapi.h>//路徑函數(shù)的庫(kù)#pragmacomment(lib,"Kernel32.lib")#pragmacomment(lib,"Psapi.lib")//CMFCEnterDlg對(duì)話框classCMFCEnterDlg:publicCDialog{//構(gòu)造public:CMFCEnterDlg(CWnd*pParent=NULL);//標(biāo)準(zhǔn)構(gòu)造函數(shù)//對(duì)話框數(shù)據(jù)enum{IDD=IDD_MFCENTER_DIALOG};protected:virtualvoidDoDataExchange(CDataExchange*pDX);//DDX/DDV支持//實(shí)現(xiàn)protected:HICONm_hIcon;//生成的消息映射函數(shù)virtualBOOLOnInitDialog();afx_msgvoidOnSysCommand(UINTnID,LPARAMlParam);afx_msgvoidOnPaint();afx_msgHCURSOROnQueryDragIcon();DECLARE_MESSAGE_MAP()public:afx_msgvoidOnBnClickedEnter();public:CEditm_ediProcessID;public:CEditm_edtDllPath;public:afx_msgvoidOnBnClickedGetdllPath();public:afx_msgvoidOnBnClickedUnist();afx_msgvoidGetToolShot();afx_msgvoidInitList();public:CListCtrlm_ListProcess;public:afx_msgvoidOnBnClickedOpenprocess();public:afx_msgvoidOnNMClickListProcess(NMHDR*pNMHDR,LRESULT*pResult);public:afx_msgvoidOnNMDblclkListProcess(NMHDR*pNMHDR,LRESULT*pResult);};MFCEnter.cpp//MFCEnter.cpp:定義應(yīng)用程序的類行為。//#include"stdafx.h"#include"MFCEnter.h"#include"MFCEnterDlg.h"#ifdef_DEBUG#definenewDEBUG_NEW#endif//CMFCEnterAppBEGIN_MESSAGE_MAP(CMFCEnterApp,CWinApp)ON_COMMAND(ID_HELP,&CWinApp::OnHelp)END_MESSAGE_MAP()//CMFCEnterApp構(gòu)造CMFCEnterApp::CMFCEnterApp(){//TODO:在此處添加構(gòu)造代碼，//將所有重要的初始化放置在InitInstance中}//唯一的一個(gè)CMFCEnterApp對(duì)象CMFCEnterApptheApp;//CMFCEnterApp初始化BOOLCMFCEnterApp::InitInstance(){//如果一個(gè)運(yùn)行在WindowsXP上的應(yīng)用程序清單指定要//使用ComCtl32.dll版本6或更高版本來(lái)啟用可視化方式，〃則需要InitCommonControlsEx()。否則，將無(wú)法創(chuàng)建窗口。INITCOMMONCONTROLSEXInitCtrls;InitCtrls.dwSize=sizeof(InitCtrls);//將它設(shè)置為包括所有要在應(yīng)用程序中使用的//公共控件類。InitCtrls.dwICC=ICC_WIN95_CLASSES;InitCommonControlsEx(&InitCtrls);CWinApp::InitInstance();AfxEnableControlContainer();//標(biāo)準(zhǔn)初始化〃如果未使用這些功能并希望減小//最終可執(zhí)行文件的大小，則應(yīng)移除下列//不需要的特定初始化例程//更改用于存儲(chǔ)設(shè)置的注冊(cè)表項(xiàng)//TODO:應(yīng)適當(dāng)修改該字符串，//例如修改為公司或組織名SetRegistryKey(_T("應(yīng)用程序向?qū)傻谋镜貞?yīng)用程序”))；CMFCEnterDlgdlg;m_pMainWnd=&dlg;INT_PTRnResponse=dlg.DoModal();if(nResponse==IDOK){//TODO:在此處放置處理何時(shí)用“確定”來(lái)關(guān)閉//對(duì)話框的代碼}elseif(nResponse==IDCANCEL){//TODO:在此放置處理何時(shí)用“取消”來(lái)關(guān)閉//對(duì)話框的代碼}//由于對(duì)話框已關(guān)閉，所以將返回FALSE以便退出應(yīng)用程序，//而不是啟動(dòng)應(yīng)用程序的消息泵。returnFALSE;}MFCEnterDlg.cpp//MFCEnterDlg.cpp:實(shí)現(xiàn)文件//#include"stdafx.h"#include"MFCEnter.h”#include"MFCEnterDlg.h"#ifdef_DEBUG#definenewDEBUG_NEW#endif//用于應(yīng)用程序“關(guān)于”菜單項(xiàng)的CAboutDlg對(duì)話框classCAboutDlg:publicCDialog{public:CAboutDlg();//對(duì)話框數(shù)據(jù)enum{IDD=IDD_ABOUTBOX};protected:virtualvoidDoDataExchange(CDataExchange*pDX);//DDX/DDV支持//實(shí)現(xiàn)protected:DECLARE_MESSAGE_MAP()};CAboutDlg::CAboutDlg():CDialog(CAboutDlg::IDD){}voidCAboutDlg::DoDataExchange(CDataExchange*pDX){CDialog::DoDataExchange(pDX);}BEGIN_MESSAGE_MAP(CAboutDlg,CDialog)END_MESSAGE_MAP()//CMFCEnterDlg對(duì)話框CMFCEnterDlg::CMFCEnterDlg(CWnd*pParent/*=NULL*/):CDialog(CMFCEnterDlg::IDD,pParent){m_hIcon=AfxGetApp()->LoadIcon(IDR_MAINFRAME);}voidCMFCEnterDlg::DoDataExchange(CDataExchange*pDX){CDialog::DoDataExchange(pDX);DDX_Control(pDX,IDC_PROCESS_ID,m_ediProcessID);DDX_Control(pDX,IDC_DLL_PATH,m_edtDllPath);DDX_Control(pDX,IDC_LIST_PROCESS,m_ListProcess);}BEGIN_MESSAGE_MAP(CMFCEnterDlg,CDialog)ON_WM_SYSCOMMAND()ON_WM_PAINT()ON_WM_QUERYDRAGICON()//}}AFX_MSG_MAPON_BN_CLICKED(IDC_ENTER,&CMFCEnterDlg::OnBnClickedEnter)ON_BN_CLICKED(IDC_GETDLL_PATH,&CMFCEnterDlg::OnBnClickedGetdllPath)ON_BN_CLICKED(IDC_UNIST,&CMFCEnterDlg::OnBnClickedUnist)ON_BN_CLICKED(IDC_OPENPROCESS,&CMFCEnterDlg::OnBnClickedOpenprocess)//ON_NOTIFY(HDN_ITEMDBLCLICK,0,&CMFCEnterDlg::OnHdnItemdblclickListProcess)//ON_NOTIFY(LVN_COLUMNCLICK,IDC_LIST_PROCESS,&CMFCEnterDlg::OnLvnColumnclickListProcess)ON_NOTIFY(NM_CLICK,IDC_LIST_PROCESS,&CMFCEnterDlg::OnNMClickListProcess)ON_NOTIFY(NM_DBLCLK,IDC_LIST_PROCESS,&CMFCEnterDlg::OnNMDblclkListProcess)END_MESSAGE_MAP()//CMFCEnterDlg消息處理程序BOOLCMFCEnterDlg::OnInitDialog(){CDialog::OnInitDialog();//將“關(guān)于...”菜單項(xiàng)添加到系統(tǒng)菜單中。//IDM_ABOUTBOX必須在系統(tǒng)命令范圍內(nèi)。ASSERT((IDM_ABOUTBOX&0xFFF0)==IDM_ABOUTBOX);ASSERT(IDM_ABOUTBOX<0xF000);CMenu*pSysMenu=GetSystemMenu(FALSE);if(pSysMenu!=NULL){CStringstrAboutMenu;strAboutMenu.LoadString(IDS_ABOUTBOX);if(!strAboutMenu.IsEmpty()){pSysMenu->AppendMenu(MF_SEPARATOR);pSysMenu->AppendMenu(MF_STRINGIDM_ABOUTBOX,strAboutMenu);}}//I殳置此對(duì)話框的圖標(biāo)。當(dāng)應(yīng)用程序主窗口不是對(duì)話框時(shí)，框架將自動(dòng)//執(zhí)行此操作SetIcon(m_hIcon,TRUE);//設(shè)置大圖標(biāo)SetIcon(m_hIcon,FALSE);//設(shè)置小圖標(biāo)//TODO:在此添加額外的初始化代碼InitList();returnTRUE;//除非將焦點(diǎn)設(shè)置到控件，否則返回TRUE}voidCMFCEnterDlg::OnSysCommand(UINTnID,LPARAMlParam){if((nID&0xFFF0)==IDM_ABOUTBOX){CAboutDlgdlgAbout;dlgAbout.DoModal();}else{CDialog::OnSysCommand(nID,lParam);}}//如果向?qū)υ捒蛱砑幼钚』粹o，則需要下面的代碼//來(lái)繪制該圖標(biāo)。對(duì)于使用文檔/視圖模型的MFC應(yīng)用程序，//這將由框架自動(dòng)完成。voidCMFCEnterDlg::OnPaint(){if(IsIconic()){CPaintDCdc(this);用/于^制的設(shè)備上下文SendMessage(WM_ICONERASEBKGND,reinterpret_cast<WPARAM>(dc.GetSafeHdc()),0);//使圖標(biāo)在工作矩形中居中intcxIcon=GetSystemMetrics(SM_CXICON);intcyIcon=GetSystemMetrics(SM_CYICON);CRectrect;GetClientRect(&rect);intx=(rect.Width()-cxIcon+1)/2;inty=(rect.Height()-cylcon+1)/2;//繪制圖標(biāo)dc.DrawIcon(x,y,m_hIcon);}else{CDialog::OnPaint();}}〃當(dāng)用戶拖動(dòng)最小化窗口時(shí)系統(tǒng)調(diào)用此函數(shù)取得光標(biāo)顯示。//HCURSORCMFCEnterDlg::OnQueryDragIcon(){returnstatic_cast<HCURSOR>(m_hIcon);}voidCMFCEnterDlg::OnBnClickedEnter(){//TODO:在此添加控件通知處理程序代碼〃獲得目標(biāo)進(jìn)程句柄//1.獲得目標(biāo)進(jìn)程的IDHANDLEhProcess=NULL;HMODULEhDll=NULL;HANDLEhRemoteThread=NULL;CStringstrDllPath;CStringstrProcessID;DWORDdwID=0;m_ediProcessID.GetWindowText(strProcessID);dwID=_ttoi(strProcessID);if(dwID<=0){MessageBox(_T("進(jìn)程ID有誤?!”))；return;}//2.通過(guò)進(jìn)程ID獲得進(jìn)程句柄hProcess=OpenProcess(PROCESS_CREATE_THREADIPROCESS_QUERY_INFORMATIONIPROCESS_VM_OPERATIONIPROCESS_VM_WRITEIPROCESS_VM_READ,FALSE,dwID);if(NULL==hProcess){MessageBox(_T("進(jìn)程句柄獲取失敗?!"));return;}〃獲得線程函數(shù)(LoadLibrary)的地址//1,得至Ukernel32.dll的句柄hDll=GetModuleHandle(_T("Kernel32.dll"));if(NULL==hDll){CloseHandle(hProcess);MessageBox(_T("獲得線程函數(shù)句柄失敗?!”))；return;}//2.通過(guò)句柄獲得函數(shù)的地址#ifdef_UNICODELPTHREAD_START_ROUTINEfarProc=(LPTHREAD_START_ROUTINE)GetProcAddress(hDll,"LoadLibraryW");#elseLPTHREAD_START_ROUTINEfarProc=GetProcAddress(hDll,"LoadLibraryA");#endifif(NULL==farProc){CloseHandle(hProcess);MessageBox(_T("獲取進(jìn)程函數(shù)失敗?!”))；return;}//3.獲得動(dòng)態(tài)鏈接庫(kù)的路徑，把他寫(xiě)入目標(biāo)進(jìn)程的內(nèi)存中m_edtDllPath.GetWindowText(strDllPath);DWORDdwSize=(strDllPath.GetLength()+1)*sizeof(TCHAR);//3.1在目標(biāo)進(jìn)程中申請(qǐng)空間LPVOIDlpStart=VirtualAllocEx(hProcess,NULL,dwSize,MEM_COMMIT,PAGE_READWRITE);if(NULL==lpStart){CloseHandle(hProcess);MessageBox(_T("申請(qǐng)空間失敗?!”))；return;}//3.2把動(dòng)態(tài)鏈接庫(kù)的地址寫(xiě)入申請(qǐng)的空間中if(0==WriteProcessMemory(hProcess,lpStart,strDllPath,dwSize,NULL)){VirtualFreeEx(hProcess,lpStart,dwSize,MEM_COMMIT);CloseHandle(hProcess);MessageBox(_T("寫(xiě)入失敗~!”));}〃執(zhí)行遠(yuǎn)程線程hRemoteThread=CreateRemoteThread(hProcess,NULL,0,farProc,IpStart,0,NULL);if(NULL==hRemoteThread){intiError=GetLastError();VirtualFreeEx(hProcess,lpStart,dwSize,MEM_COMMIT);CloseHandle(hProcess);MessageBox(_T("創(chuàng)建執(zhí)行遠(yuǎn)程線程失敗~!”));return;}WaitForSingleObject(hRemoteThread,INFINITE);CloseHandle(hRemoteThread);VirtualFreeEx(hProcess,lpStart,dwSize,MEM_COMMIT);CloseHandle(hProcess);return;}voidCMFCEnterDlg::OnBnClickedGetdllPath(){//TODO:在此添加控件通知處理程序代碼CFileDialogfileDialog(TRUE);if(IDOK==fileDialog.DoModal()){m_edtDllPath.SetWindowText(fileDialog.GetPathName());}}voidCMFCEnterDlg::OnBnClickedUnist(){//TODO:在此添加控件通知處理程序代碼//目標(biāo)進(jìn)程的句柄hProcessHANDLEhProcess=NULL;HMODULEhDll=NULL;HANDLEhRemoteThread=NULL;CStringstrDllPath;CStringstrProcessID;DWORDdwID=0;m_ediProcessID.GetWindowText(strProcessID);dwID=_ttoi(strProcessID);if(dwID<=0){MessageBox(_T("進(jìn)程ID有誤?!”))；return;}//2.通過(guò)進(jìn)程ID獲得進(jìn)程句柄hProcess=OpenProcess(PROCESS_CREATE_THREADIPROCESS_QUERY_INFORMATIONIPROCESS_VM_OPERATIONIPROCESS_VM_WRITEIPROCESS_VM_READ,FALSE,dwID);if(NULL==hProcess){MessageBox(_T("進(jìn)程句柄獲取失敗?!"))；return;}〃獲得線程函數(shù)(FreeLibrary)的地址//1.得至Ukernel32.dll的句柄hDll=GetModuleHandle(_T("Kernel32.dll"));if(NULL==hDll){CloseHandle(hProcess);MessageBox(_T("獲得線程函數(shù)句柄失敗?!”))；return;}//2.通過(guò)句柄獲得函數(shù)的地址LPTHREAD_START_ROUTINEfarProc=(LPTHREAD_START_ROUTINE)GetProcAddress(hDll,"FreeLibrary");if(NULL==farProc){CloseHandle(hProcess);MessageBox(_T("獲取進(jìn)程函數(shù)失敗?!”))；return;}//3.獲得動(dòng)態(tài)鏈接庫(kù)的路徑m_edtDllPath.GetWindowText(strDllPath);DWORDdwSize=(strDllPath.GetLength()+1)*sizeof(TCHAR);〃獲得動(dòng)態(tài)鏈接庫(kù)的句柄，通過(guò)進(jìn)程快照HANDLEhandleProcess=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,dwID);if(INVALID_HANDLE_VALUE==handleProcess){CloseHandle(hProcess);MessageBox(_T("獲取快照失敗?!"))；return;}〃獲取進(jìn)程快照的第一行MODULEENTRY32o_Module32;〃給結(jié)構(gòu)體初始化memset(&o_Module32,0,sizeof(o_Module32));o_Module32.dwSize=sizeof(o_Module32);if(FALSE==Module32First(handleProcess,&o_Module32)){CloseHandle(hProcess);CloseHandle(handleProcess);MessageBox(_T("獲取第一行進(jìn)程快照失敗?!”))；return;}do{//取出結(jié)構(gòu)體里面的路徑，看是不是和m_edtDllPath.setwindowtext相等CStringstrtemp=o_Module32.szExePath;if(strtemp==strDllPath){hDll=o_Module32.hModule;break;}}while(Module32Next(handleProcess,&o_Module32));hRemoteThread=CreateRemoteThread(hProcess,NULL,0,farProc,hDll,0,NULL);if(NULL==hRemoteThread){CloseHandle(hProcess);CloseHandle(handleProcess);MessageBox(_T("遠(yuǎn)程線程失敗?!”))；return;}WaitForSingleObject(hRemoteThread,INFINITE);〃關(guān)閉句柄CloseHandle(hProcess);CloseHandle(handleProcess);CloseHandle(hRemoteThread);return;}voidCMFCEnterDlg::GetToolShot(){m_ListProcess.DeleteAllItems();HANDLEHandleProcess=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);CStringstrvalue;DWORDProcessID;TCHARProcessPath[MAX_PATH];if(INVALID_HANDLE_VALUE==HandleProcess){MessageBox(_T("獲取進(jìn)程快照失敗"));return;}〃取出進(jìn)程快照第一行PROCESSENTRY32process32;memset(&process32,0,sizeof(process32));process32.dwSize=sizeof(process32);Process32First(HandleProcess,&process32);if(FALSE==Process32First(HandleProcess,&process32)){MessageBox(_T("獲取快照第一行失敗"))；return;}〃取出下一行do{〃獲取IDstrvalue.Format(_T("%d"),process32.th32ProcessID);m_ListProcess.InsertItem(0,strvalue);〃獲取名字m_ListProcess.SetItemText(0,1,process32.szExeFile);〃獲取路徑//通過(guò)進(jìn)程的ID獲得進(jìn)程的句柄HANDLEProces=::OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,FALSE,process32.th32ProcessID);if(NULL==Proces){memset(&process32,0,sizeof(process32));process32.dwSize=sizeof(process32);continue;}if(0==GetModuleFileNameEx(Proces,NULL,ProcessPath,MAX_PATH)){memset(&process32,0,sizeof(process32));process32.dwSize=sizeof(process32);CloseHandle(Proces);continue;}〃顯示路徑m_ListProcess.SetItemText(0,2,ProcessPath);〃關(guān)閉句柄memset(&process32,0,sizeof(process32));process32.dwSize=sizeof(process32);CloseHandle(Proces);}while(Process32Next(HandleProcess,&process32));return;}voidCMFCEnterDlg::InitList(){m_ListProcess.SetExtendedStyle(LVS_LIST|LVS_EX_GRIDLINES|LVS_EX_FULLROWSELECT);CRectrect;CStringstrValue;m_ListProcess.GetClientRect(&rect);UINTColumn[][3]={PROCESS_ID,LVC