Windows 遠程 DLL 注入技術原理與核心程式碼解析

遠程 DLL 注入流程

遠程 DLL 注入透過 OpenProcess、VirtualAllocEx、WriteProcessMemory、CreateRemoteThread 等 API，將指定 DLL 路徑寫入目標進程記憶體，並建立遠端執行緒呼叫 LoadLibrary 載入 DLL。

核心注入程式碼片段

// 取得 DLL 路徑長度並轉換為多位元組字串
int iBufSize = WideCharToMultiByte(CP_ACP, 0, m_strPathName.GetBuffer(), -1, NULL, 0, NULL, NULL);
char *pszBuffer = (char *)malloc(iBufSize);
WideCharToMultiByte(CP_ACP, 0, m_strPathName.GetBuffer(), -1, pszBuffer, iBufSize, NULL, NULL);

// 開啟目標進程
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
if (!hProcess) return FALSE;

// 配置遠端記憶體寫入 DLL 路徑
int iDllLen = strlen(pszBuffer) + 1;
PVOID pDllAddr = VirtualAllocEx(hProcess, NULL, iDllLen, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess, pDllAddr, pszBuffer, iDllLen, &dwWriteNum);

// 取得 LoadLibraryA 位址並建立遠端執行緒
FARPROC pFunAddr = GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunAddr, pDllAddr, 0, NULL);

// 釋放資源
WaitForSingleObject(hThread, INFINITE);
VirtualFreeEx(hProcess, pDllAddr, 0, MEM_RELEASE);
CloseHandle(hThread);
CloseHandle(hProcess);

卸載 DLL（反注入）

遍歷目標進程模組列表，找到目標 DLL 基址，建立遠端執行緒呼叫 FreeLibrary 卸載。

下載地址：完整專案原始碼