WooYun.org

#COMPILE DLL
#DIM ALL
%USEMACROS = 1
#INCLUDE "D:\PowerBasic\MAINDIR\WinAPI\Win32API.inc"
GLOBAL ghInstance AS DWORD
'-- INJECT.INC --------------------------------------------------------------
DECLARE FUNCTION Get_hModule(BYVAL PID AS DWORD, DllPath$) AS DWORD
DECLARE FUNCTION Inject_DLL(BYVAL PID AS DWORD, DllPath$) AS LONG
DECLARE FUNCTION Eject_DLL(BYVAL PID AS DWORD, BYVAL hModule AS DWORD) AS LONG
'-- Declares not found in WIN32API.INC
DECLARE FUNCTION EnumProcessModules LIB "PSAPI.DLL" ALIAS "EnumProcessModules" _
      (BYVAL hProcess AS DWORD, hModule AS DWORD, _
       BYVAL cb AS DWORD, cbNeeded AS DWORD) AS DWORD
DECLARE FUNCTION GetModuleFileNameEx LIB "PSAPI.DLL" ALIAS "GetModuleFileNameExA" _
      (BYVAL hProcess AS DWORD, BYVAL hModule AS DWORD, _
       Filename AS ASCIIZ, BYVAL nSize AS DWORD) AS DWORD
'====================
FUNCTION Get_hModule(BYVAL PID AS DWORD, DllPath$) AS DWORD
'-- Returns handle to running module specified in DllPath$, or zero if not found
'-- PID = process ID of running process; DllPath$ = path+filename of DLL
REGISTER i&, result&
LOCAL  cb, cbNeeded, nModules AS LONG, hProcess, found, hModules() AS DWORD
LOCAL dll$, ModuleName AS ASCIIZ * %MAX_PATH
hProcess = OpenProcess(%PROCESS_QUERY_INFORMATION OR %PROCESS_VM_READ, %FALSE, PID)
IF hProcess THEN
   cb = 100
   DO
      REDIM hModules(1 TO cb \ 4)
      result = EnumProcessModules(hProcess, hModules(1), cb, cbNeeded)
      IF result = 0 THEN 'call failed
         cbNeeded = 0 : EXIT DO
      END IF
      IF cb > cbNeeded THEN EXIT DO
      cb = cb * 2
   LOOP
   nModules = cbNeeded \ 4
   DLL = UCASE$(DllPath$)
   FOR i = 1 TO nModules
      result = GetModuleFileNameEx(hProcess, hModules(i), _
                                   ModuleName, SIZEOF(ModuleName))
      IF result THEN
         IF UCASE$(RTRIM$(ModuleName,$NUL)) = DLL THEN
            found = hModules(i) : EXIT FOR
         END IF
      END IF
   NEXT i
   CloseHandle hProcess
END IF 'hProcess
FUNCTION = found
END FUNCTION
'====================
FUNCTION Inject_DLL(BYVAL PID AS DWORD, DllPath$) AS LONG
REGISTER hProcess&, hThread&
LOCAL ecode&, pLoadLibraryA, pRemoteBuffer AS DWORD
ecode = -1  'default to error
hProcess = OpenProcess(%PROCESS_CREATE_THREAD OR %PROCESS_QUERY_INFORMATION OR _
                       %PROCESS_VM_OPERATION  OR %PROCESS_VM_READ OR _
                       %PROCESS_VM_WRITE, %FALSE, PID)
IF hProcess THEN
   pLoadLibraryA = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA")
   pRemoteBuffer = VirtualAllocEx(hProcess, BYVAL %NULL, LEN(DllPath$), _
                                  %MEM_COMMIT, %PAGE_READWRITE)
   IF pRemoteBuffer AND pLoadLibraryA THEN
      IF WriteProcessMemory(BYVAL hProcess, BYVAL pRemoteBuffer, _
                            BYVAL STRPTR(DllPath$), LEN(DllPath$), %NULL) THEN
         hThread = CreateRemoteThread(BYVAL hProcess, BYVAL %NULL, 0&, _
                                      BYVAL pLoadLibraryA, BYVAL pRemoteBuffer, _
                                      0, %NULL)
         IF hThread THEN
            WaitForSingleObject hThread, %INFINITE
            CloseHandle hThread
            ecode = 0
         END IF
      END IF
      VirtualFreeEx hProcess, pRemoteBuffer, 0, %MEM_RELEASE
   END IF 'pRemoteBuffer AND pLoadLibraryA
   CloseHandle hProcess
END IF 'hProcess
FUNCTION = ecode
END FUNCTION
'====================
FUNCTION Eject_DLL(BYVAL PID AS DWORD, BYVAL hModule AS DWORD) AS LONG
REGISTER hProcess&, hThread&
LOCAL ecode&, pFreeLibrary, pRemoteBuffer AS DWORD
ecode = -1  'default to error
hProcess = OpenProcess(%PROCESS_CREATE_THREAD OR %PROCESS_QUERY_INFORMATION OR _
                       %PROCESS_VM_OPERATION  OR %PROCESS_VM_READ OR _
                       %PROCESS_VM_WRITE, %FALSE, PID)
IF hProcess THEN
   pFreeLibrary = GetProcAddress(GetModuleHandle("Kernel32"), "FreeLibrary")
   IF pFreeLibrary THEN
      hThread = CreateRemoteThread(BYVAL hProcess, BYVAL %NULL, 0&, _
                                   BYVAL pFreeLibrary, BYVAL hModule, 0, %NULL)
      IF hThread THEN
         WaitForSingleObject hThread, %INFINITE
         CloseHandle hThread
         ecode = 0
      END IF
   END IF
   CloseHandle hProcess
END IF 'hProcess
FUNCTION = ecode
END FUNCTION
'-- END INJECT.INC ----------------------------------------------------------
FUNCTION LIBMAIN (BYVAL hInstance   AS LONG, _
                  BYVAL fwdReason   AS LONG, _
                  BYVAL lpvReserved AS LONG) AS LONG
    DIM sFileName AS ASCIIZ * 256
    DIM sModuleFilePath AS ASCIIZ * %MAX_PATH
    DIM sNameCut AS ASCIIZ * %MAX_PATH
    
    LOCAL ecode&, hmodule, pid AS DWORD
    LOCAL DllPath$, exepath AS ASCIIZ * %MAX_PATH
    GetModuleFileName GetModuleHandle(""), exepath, SIZEOF(exepath)
    DllPath = "D:\PowerBasic\MAINDIR\t2.dll"
    IF pid = 0 THEN pid = VAL(INPUTBOX$("Enter target process id", DllPath))
    IF pid = 0 THEN EXIT FUNCTION
    hModule = Get_hModule(pid, DllPath)
    IF hModule THEN
       MSGBOX "已被注入，尝试清除中",,DllPath
       ecode = Eject_DLL(pid, hModule)
       MSGBOX "Final eject ecode:" + STR$(ecode),,DllPath
    ELSE
       MSGBOX "未被注入，尝试注入中",,DllPath
       ecode = Inject_DLL(pid, DllPath)
       MSGBOX "Final inject ecode:" + STR$(ecode),,DllPath
    END IF
    
    
    
  '  SELECT CASE fwdReason
  '  CASE %DLL_PROCESS_ATTACH
  '      ghInstance = hInstance
  '      FUNCTION = 1   'success!
        GetModuleFileName(hInstance, sFileName, 255)
        CALL GetModuleFileName( CDWD(&H0), sModuleFilePath, CDWD(%MAX_PATH) )
       ' sNameCut = Parse$( sModuleFilePath, "\", ParseCount(sModuleFilePath, "\") )
       ' sModuleFilePath = RTrim$( sModuleFilePath, sNameCut )
        MSGBOX "The dll" + sFileName + " is being attached into : " + sModuleFilePath
        'FUNCTION = 0   'failure!  This will prevent the EXE from running.
'    CASE %DLL_PROCESS_DETACH
'         FUNCTION = 1   'success!
'     CASE %DLL_THREAD_ATTACH
'         FUNCTION = 1   'success!
'    CASE %DLL_THREAD_DETACH
'         FUNCTION = 1   'success!
 '   END SELECT
END FUNCTION