最近在看dll注入的内容,于是抄了一段代码下来试用一下dll注入,结果发现DLLMain怎么都进不去!
代码如下:
#include <Windows.h>
#include <iostream>
using namespace std;
// 用于注入的 DLL 代码
const char* DLL_CODE = R"(
#include <Windows.h>
HHOOK hHook = NULL;
LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {
if (nCode >= 0) {
KBDLLHOOKSTRUCT* pKbdStruct = (KBDLLHOOKSTRUCT*)lParam;
if (wParam == WM_KEYDOWN) {
// 处理键盘事件
MessageBox(NULL, "Key pressed in injected process!", "Hook Message", MB_OK);
}
}
// 继续链中的下一个钩子或者默认过程
return CallNextHookEx(hHook, nCode, wParam, lParam);
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
MessageBox(NULL, "正在进行钩子安装", "Hook Message", NULL);
if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
// 安装键盘钩子
hHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardProc, GetModuleHandle(NULL), 0);
if (hHook == NULL) {
MessageBox(NULL, "Failed to install hook in injected process!", "Hook Message", MB_OK | MB_ICONERROR);
return FALSE;
} else {
MessageBox(NULL, "钩子安装成功", "Hook Message", NULL);
}
}
return TRUE;
}
)";
int main() {
// 获取目标进程的句柄
DWORD dwProcessId = 14984;
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
if (hProcess == NULL) {
std::cerr << "Failed to open process. Error code: " << GetLastError() << std::endl;
return 1;
}
else {
cout << "进程已打开" << endl;
}
// 在目标进程中分配内存
LPVOID pRemoteCode = VirtualAllocEx(hProcess, NULL, strlen(DLL_CODE) + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (pRemoteCode == NULL) {
std::cerr << "Failed to allocate memory in remote process. Error code: " << GetLastError() << std::endl;
CloseHandle(hProcess);
return 1;
}
else {
cout << "已分配内存" << endl;
}
// 在目标进程中写入 DLL 代码
WriteProcessMemory(hProcess, pRemoteCode, DLL_CODE, strlen(DLL_CODE) + 1, NULL);
// 在目标进程中创建远程线程以加载 DLL
HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pRemoteCode, 0, NULL);
if (hRemoteThread == NULL) {
std::cerr << "Failed to create remote thread. Error code: " << GetLastError() << std::endl;
VirtualFreeEx(hProcess, pRemoteCode, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 1;
}
else {
cout << "远程线程已创建" << endl;
}
// 等待远程线程结束
WaitForSingleObject(hRemoteThread, INFINITE);
// 进入消息循环,等待钩子事件
MSG msg;
while (GetMessage(&msg, NULL, 0, 0) != 0) {
TranslateMessage(&msg);
DispatchMessage(&msg);
}
// 清理资源
CloseHandle(hRemoteThread);
VirtualFreeEx(hProcess, pRemoteCode, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 0;
}
这里怎么都不会弹出MessageBox的消息框出来,说明DLLMain函数是没进去的,在我调试的过程中我已经检查了打开进程,分配内存,远程线程创建等过程都是成功的,唯独DLLMain没进去。我也考虑了可能是消息循环造成的影响,但是消息循环的代码放在waitForSingleObject前,后,删除,也都不会进去DLLMain。