Delphi DLL注入x86/x64/Win2k~Win8.1全可用-木庄网络博客

本文整理自网络，侵删。
 program Inject;
 
{$APPTYPE CONSOLE}
 
 
{$IF CompilerVersion >= 21.0}
{$WEAKLINKRTTI ON}
{$RTTI EXPLICIT METHODS([]) PROPERTIES([]) FIELDS([])}
{$IFEND}
 
uses
  Winapi.Windows;
   
Type
  NtCreateThreadExProc = Function(Var hThread:THandle; Access:DWORD; Attributes:Pointer; hProcess:THandle; pStart:Pointer; pParameter:Pointer; Suspended:BOOL; StackSize, u1, u2:DWORD; Unknown:Pointer):DWORD; stdcall; 
 
 
Function CheckOs():Boolean;
Var
  lpVersionInformation :TOSVersionInfoW;
begin
  Result := False;
  if GetVersionExW(lpVersionInformation) then
  begin
    if lpVersionInformation.dwPlatformId = VER_PLATFORM_WIN32_NT Then
    begin
      if (lpVersionInformation.dwMajorVersion < 6) then
      begin
        Result := True;
      end; 
    end; 
  end;
end;
 
Function EnableDebugPrivilege():Boolean;
Var
  hToKen   :THandle;
  TokenPri :TTokenPrivileges;
begin
  Result := False;
  if(OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES, hToKen)) Then
  begin
    TokenPri.PrivilegeCount  := 1;
    If LookupPrivilegeValueW(Nil, 'SeDebugPrivilege', TokenPri.Privileges[0].Luid) Then
    begin
      TokenPri.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
      Result := AdjustTokenPrivileges(hToken, False, TokenPri, SizeOf(TTokenPrivileges),  Nil, PDWORD(Nil)^);
    end Else Writeln('LookupPrivilege Error');
    CloseHandle(hToKen);
  end;
end;
 
Function RemoteThread(hProcess:THandle; pThreadProc:Pointer; pRemote:Pointer):THandle;
Label NtCreate, Create;
Var
  pFunc    :Pointer;
  hThread  :THandle;
begin
  hThread := 0;
  if Not CheckOs() then //根据系统版本来选择使用的API
  begin
    NtCreate:
    pFunc   := GetProcAddress(LoadLibraryW('ntdll.dll'), 'NtCreateThreadEx');
    if pFunc = Nil then Goto Create; 
    NtCreateThreadExProc(pFunc)(hThread, $1FFFFF, Nil, hProcess, pThreadProc, pRemote, False, 0, 0, 0, Nil);
    if hThread = 0 then Goto Create;
  end Else
  begin
    Create:
    hThread := CreateRemoteThread(hProcess, Nil, 0, pThreadProc, pRemote, 0, PDWORD(Nil)^);        
  end;
  Writeln('RemoteThread Ok!');
  Result := hThread;
end; 
 
Function InjectDll2Pid(szPath:PWideChar; uPID:DWORD):Boolean;
Var
  hProcess  :THandle;
  hThread   :THandle;
  szRemote  :PWideChar;
  uSize     :SIZE_T;
  uWrite    :SIZE_T;
  pStartAddr:Pointer;
begin
  Result := False;
  if EnableDebugPrivilege then
  begin //先提升下进程的权限
    hProcess := OpenProcess(PROCESS_ALL_ACCESS, false, uPID);
    if hProcess > 0 then
    begin
      uSize    := lstrlenW(szPath) * 2 + 4;
      szRemote := VirtualAllocEx(hProcess, Nil, uSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
      if WriteProcessMemory(hProcess, szRemote, szPath, uSize, uWrite) And (uWrite = uSize) then
      begin
        pStartAddr := GetProcAddress(LoadLibrary('Kernel32.dll'), 'LoadLibraryW');
        hThread := RemoteThread(hProcess, pStartAddr, szRemote);
        Result  := hThread <> 0;
        CloseHandle(hThread);
      end Else
      begin
        Writeln('WriteMemory Error');
      end; 
    end; 
  end; 
end; 
 
Function StrToInt(S: String): Integer;
Var
  E: Integer;
Begin
  Val(S, Result, E);
End;
 
begin
  InjectDll2Pid(PWideChar(ParamStr(2)), StrToInt(ParamStr(1)));
end.

来源：https://www.7xcode.com/archives/90.html
Delphi DLL注入x86/x64/Win2k~Win8.1全可用

相关推荐

评论
