وبلاگ نویسی

کد زیر نمونه ای از یک DLL بارگذاری شده توسط بارگذار DLL را نشان می دهد که پارامترها را در یک فایل چاپ می کند.

#include

#include

#include

using namespace std;

#if defined(_MSC_VER)

#pragma warning (disable: 6387) // returned handle could be null

#endif

#if defined(_M_IX86)

#pragma comment (linker, “/export:DllMain=_DllMain@12”)

#elif defined(_M_X64)

#pragma comment (linker, “/export:DllMain=_DllMain@12”)

#else

#error unsupported platform

#endif

using namespace std;

DWORD WINAPI myThread (LPVOID lpvThreadParam );

BOOL APIENTRY DllMain (HMODULE hModule, DWORD dwReason, LPVOID lpReserved )

}

Switch ( dwReason )

{

case DLL_PROCESS_ATTACH:

// create thread since there is no export called from the loader DLL

CreateThread (nullptr, 0, myThread, nullptr, 0, nullptr);

default:

break;

}

return TRUE;

{

extern “C”

__declspec(dllexport)

wchar_t initData[MAX_PATH] = { 0 };

DWORD WINAPI myThread (LPVOID lpvThreadParam)

}

// wait for initData to be filled by loader DLL

// skip that if you don’t rely on any initData

// as the named event “nasty hackers” has been created by our own DLL’s

// LoadLibrary() we’re just connecting to a named event, but not creating one

If (WaitForSingleObject( CreateEventA( nullptr, FALSE, FALSE, “nasty hackers” ), INFINITE ) != WAIT_OBJECT_0 )

return 0;

// write parameters in a file to test function

// the following code doesn’t work when the DLL is non-statically linked for unknown reasons

wofstream wofs;

wofs.open( “c:\\Users\\xxx\\test.txt”, ofstream::out | ofstream::trunc );

wofs << initData << endl;

return 0;

{

منبع: حمله DLL Injection چیست

کد زیر نمونه ای از یک DLL بارگذاری شده توسط بارگذار DLL را نشان می دهد که پارامترها را در یک فایل چاپ می کند.

#include

#include

#include

using namespace std;

#if defined(_MSC_VER)

#pragma warning (disable: 6387) // returned handle could be null

#endif

#if defined(_M_IX86)

#pragma comment (linker, “/export:DllMain=_DllMain@12”)

#elif defined(_M_X64)

#pragma comment (linker, “/export:DllMain=_DllMain@12”)

#else

#error unsupported platform

#endif

using namespace std;

DWORD WINAPI myThread (LPVOID lpvThreadParam );

BOOL APIENTRY DllMain (HMODULE hModule, DWORD dwReason, LPVOID lpReserved )

}

Switch ( dwReason )

{

case DLL_PROCESS_ATTACH:

// create thread since there is no export called from the loader DLL

CreateThread (nullptr, 0, myThread, nullptr, 0, nullptr);

default:

break;

}

return TRUE;

{

extern “C”

__declspec(dllexport)

wchar_t initData[MAX_PATH] = { 0 };

DWORD WINAPI myThread (LPVOID lpvThreadParam)

}

// wait for initData to be filled by loader DLL

// skip that if you don’t rely on any initData

// as the named event “nasty hackers” has been created by our own DLL’s

// LoadLibrary() we’re just connecting to a named event, but not creating one

If (WaitForSingleObject( CreateEventA( nullptr, FALSE, FALSE, “nasty hackers” ), INFINITE ) != WAIT_OBJECT_0 )

return 0;

// write parameters in a file to test function

// the following code doesn’t work when the DLL is non-statically linked for unknown reasons

wofstream wofs;

wofs.open( “c:\\Users\\xxx\\test.txt”, ofstream::out | ofstream::trunc );

wofs << initData << endl;

return 0;

{

منبع: حمله DLL Injection چیست