DLL注入 + VEH 的方式处理异常

从个人年久失修的git博客搬运

• test.cpp

#include "stdafx.h"
#include <process.h>

int main()
{
	printf("输入\n");
	int a, b;
	scanf_s("%d", &a);
	b = 1 / a;
	printf("%d\n", b);
	system("pause");
    return 0;
}

• dllmain.dll

// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "stdafx.h"
#include "stdio.h"
#include "windows.h"

LONG WINAPI veh(EXCEPTION_POINTERS* pExce)
{
	if (pExce->ExceptionRecord->ExceptionCode == EXCEPTION_INT_DIVIDE_BY_ZERO)
	{
		pExce->ContextRecord->Eip += 3;
		printf("fdsf\n");
	return EXCEPTION_CONTINUE_EXECUTION;
	}

	return EXCEPTION_CONTINUE_SEARCH;
} 

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		//1. 将异常处理函数注册到系统
		AddVectoredExceptionHandler(TRUE, veh);
		printf("注册异常处理函数成功！\n");
		break;
	case DLL_THREAD_ATTACH:
		break;
	case DLL_THREAD_DETACH:
		break;
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

• 注入器

// 远程注入.cpp: 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include "windows.h"


bool injectDll(DWORD dwPid, const char* pszDllPath);

int main()
{
	DWORD dwPid;
	char szDllPath[MAX_PATH] = { "C:\\Users\\Administrator\\source\\repos\\VEH_Dll\\Debug\\VEH_Dll.dll"};

 	printf("输入要注入到的进程PID：");
 	scanf_s("%d[*]", &dwPid);

	injectDll(dwPid, szDllPath);
    return 0;
}

bool injectDll(DWORD dwPid, const char* pszDllPath)
{
	bool	bRet = false;
	HANDLE	hProcess = 0;
	HANDLE	hRemoteThread = 0;
	LPVOID	pRemoteBuff = NULL;
	SIZE_T 	dwWrite = 0;
	DWORD	dwSize = 0;

	//打开进程
	hProcess = OpenProcess(
		PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,/*创建线程和写入内存权限*/
		FALSE, dwPid/*进程ID*/);

	if (hProcess == NULL)
	{
		printf("打开进程失败,可能由于本程序的权限太低,请以管理员身份运行再尝试\n");
		goto _EXIT;
	}

	
	//1. 在远程进程上开辟内存空间
	pRemoteBuff = VirtualAllocEx(
		hProcess,
		NULL,
		64*1024,/*大小：64Kb*/
		MEM_COMMIT,/*预定并提交*/
		PAGE_EXECUTE_READWRITE/*可读可写可执行的属性*/
		);
	if (pRemoteBuff == NULL)
	{
		printf("在远程进程上开辟空降失败\n");
		goto _EXIT;
	}


	//2. 将DLL路径写入到新开的内存空间中
	dwSize = strlen(pszDllPath) + 1;
	WriteProcessMemory(
		hProcess,
		pRemoteBuff,/* 要写入的地址 */
		pszDllPath,	/* 要写入的内容的地址*/
		dwSize,		/* 写入的字节数 */
		&dwWrite	/* 输入：函数实际写入的字节数*/
	);

	if (dwWrite != dwSize)
	{
		printf("写入Dll路径失败\n");
		goto _EXIT;
	}


	//3. 创建远程线程
	//   远程线程创建成功后,DLL就会被加载,DLL被加载后DllMain函数
	//	 就会被执行,如果想要执行什么代码,就在DllMain中调用即可.

	hRemoteThread = CreateRemoteThread(
		hProcess,
		0, 0,
		(LPTHREAD_START_ROUTINE)LoadLibraryA,  /* 线程回调函数 */
		pRemoteBuff,							/* 回调函数参数 */
		0, 0);

	// 等待远程线程退出.
	// 退出了才释放远程进程的内存空间.
	WaitForSingleObject(hRemoteThread, -1);


	bRet = true;


_EXIT:
	// 释放远程进程的内存
	VirtualFreeEx(hProcess, pRemoteBuff, 0, MEM_RELEASE);
	// 关闭进程句柄
	CloseHandle(hProcess);

	return bRet;
}