Question

我正在尝试为18岁的游戏创建mod loader，以帮助我更好地使用c ++。现在，我只是想将一个dll注入到mod loader的相同进程中。该示例dll仅将一些文本输出到命令窗口，但没有。我认为我加载dll入口点的代码无法正常工作，因为一切正常，直到我在ModLoader.exe中调用示例dll的入口点功能，而Visual Studio才抛出访问冲突。我在Visual Studio的调试模式下通过内存查看器戳了一下，以查看我的ModLoader程序认为dll入口点位于dll中的位置，但地址仅指向一堆零。我最近学习了PE文件格式，并试图了解我在YouTube上按照教程进行操作时编写的所有代码，因此请原谅我的经验不足。我没有显示的其他代码是定位并找到目标进程，读取dll二进制文件，从dll中获取标头，在dll的目标进程上分配空间，最后编写所有节头数据进入目标过程。我可以提供大家都希望看到的其他任何代码！

Injector.h

using ModLoader_LoadLibrary = HINSTANCE(WINAPI*)(const char* filename); 
using ModLoader_GetProcAddress = UINT_PTR(WINAPI*)(HINSTANCE module, const char* procName);
using ModLoader_DllEntry = BOOL(WINAPI*)(HINSTANCE dll, DWORD reason, LPVOID reserved);

struct ModLoader_ManualMapping_Data
{
    ModLoader_LoadLibrary ML_LoadLibrary;       //Function pointer to the windows load library function
    ModLoader_GetProcAddress ML_ProcAddress;    //Function pointer to a function to be called 
    HINSTANCE ML_Module;                            //dll instance
};

Injector.cpp：将与目标可执行文件一起运行的Shellcode函数

    void __stdcall Shellcode(ModLoader_ManualMapping_Data* data)
{
    if (!data)
        return;
BYTE* pData = reinterpret_cast<BYTE*>(data);

IMAGE_OPTIONAL_HEADER& optHeader = reinterpret_cast<IMAGE_NT_HEADERS*>(pData + reinterpret_cast<IMAGE_DOS_HEADER*>(pData)->e_lfanew)->OptionalHeader;

auto loadLibrary = data->ML_LoadLibrary;
auto procAddress = data->ML_ProcAddress;
auto dllLoad = reinterpret_cast<ModLoader_DllEntry>(pData + optHeader.AddressOfEntryPoint); //Loads entry point func from dll
BYTE* locationDelta = pData - optHeader.ImageBase; //pData = the new address | ImageBase = preferred address -> Get the difference between the two to add to every address in the relocation table
if (locationDelta) //THIS DOES NOT GET RAN
{
    //Adds the delta value to all addresses within the base relocation table 
}

//Import table
if (optHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size)
{
    IMAGE_IMPORT_DESCRIPTOR* imgImport = reinterpret_cast<IMAGE_IMPORT_DESCRIPTOR*>(pData
        + optHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
    while (imgImport->Name) //THIS DOES NOT GET RAN B\C imgImport is all zeros.
    {
        //Loops through import table
    }
}
if (optHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].Size) //THIS DOES NOT GET RAN
{
    //Calls the callback functions within dll
}
dllLoad(reinterpret_cast<HINSTANCE>(pData), DLL_PROCESS_ATTACH, nullptr); //PROBLEM: ACCESS VIOLATION
}

Injector.cpp：bool ManualMapping（HANDLE进程，const char * dllFilepath） -在main.cpp中调用此函数。 srcData变量只是dll的二进制内容

ModLoader_ManualMapping_Data loadData = { 0 };
loadData.ML_LoadLibrary =  LoadLibraryA;
loadData.ML_ProcAddress = reinterpret_cast<ModLoader_GetProcAddress>(GetProcAddress);

memcpy(srcData, &loadData, sizeof(loadData));
WriteProcessMemory(process, locOfDll, srcData, 0x1000, nullptr);
void* shellCodeBase = VirtualAllocEx(process, nullptr, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); //Allocates 0x1000 bytes in the process memory for the shellcode
WriteProcessMemory(process, shellCodeBase, Shellcode, 0x1000, nullptr); //Injects the Shellcode function into the process
HANDLE thread = nullptr;
thread = CreateRemoteThread(process, nullptr, 0, reinterpret_cast<PTHREAD_START_ROUTINE>(shellCodeBase), locOfDll, 0, nullptr); //Runs

最后是示例dll代码

#include <Windows.h>

BOOL WINAPI DllMain(HINSTANCE hModule, DWORD reason_for_call, LPVOID lpReserved)
{
    switch (reason_for_call)
    {
        case DLL_PROCESS_ATTACH:
            OutputDebugStringA("Injected!");
            break;
    }
    return TRUE;
}

编辑重写所有代码并整日查看之后，我终于弄清楚了。我只需要确保在调用dllLoad时参数正确即可！

为什么在我的程序中找不到dll的入口点？ PE文件

0 个答案: