05简单DLL劫持

通过 C语言 编写一个游戏要加载的系统DLL文件(lpk.dll)，其中假DLL包含劫持功能和作弊功能且拥有相同的导出函数，将该假DLL放入游戏相同目录下，游戏打开时会自动加载该假DLL，使游戏直接包含作弊功能

##设计思路分析 1、构造一个与系统目录下LPK.DLL一样的导出表

2、加载系统目录下的LPK.DLL

3、将导出函数转发到系统目录下的LPK.DLL上

4、在初始化函数中加入我们要执行的代码

对象分析

本次游戏对象为Super Mario XP

没有更新所以可用任意版本

试玩发现人物血量最大为10，心最大为99，命最大为99

要用的函数介绍

__asm{ }

执行括号内的汇编代码

JMP EAX

将EIP跳转到EAX执行，劫持DLL后要获取真正的原函数地址，使用时要进行跳转 

编写测试效果

将生成的mylpk和作弊模块放入游戏目录，并改mylpk名为lpk

打开游戏
直接打开游戏即可,发现此时游戏已具备作弊效果(锁定血量)

工具查看加载模块
发现cheatDLL模块已加载入游戏，说明lpk劫持成功

WIN7下劫持
在WIN7下要劫持只需稍修改注册表即可

//
//  05简单DLL劫持(作弊模块DLL部分)
//  C/C++
//
//  Created by luguanxing.
//  Copyright @2016 LGX. All rights reserved.
//
#include <windows.h>
#define Dllfunciton extern "C" __declspec(dllexport)    //以C方式导出

Dllfunciton void lockdata();
Dllfunciton DWORD WINAPI inject(LPVOID);

void lockdata() {
    while (true) {
        DWORD hp = 10;
        DWORD heart = 99;
        DWORD life = 99;

        DWORD addr = 0x00428282;
        DWORD addr2 = 0x00428292;
        DWORD addr3 = 0x004282a2;

        DWORD res = WriteProcessMemory(INVALID_HANDLE_VALUE, (LPVOID)addr, &hp, 4, 0);  //写入自身修改游戏数据
        DWORD res2 = WriteProcessMemory(INVALID_HANDLE_VALUE, (LPVOID)addr2, &heart, 4, 0);
        DWORD res3 = WriteProcessMemory(INVALID_HANDLE_VALUE, (LPVOID)addr3, &life, 4, 0);

        Sleep(1000);
    }
}

DWORD WINAPI inject(LPVOID) {
    lockdata();
    return true;
}

BOOL APIENTRY DllMain(HMODULE hModule,  DWORD  ul_reason_for_call, LPVOID lpReserved) {
    switch(ul_reason_for_call) {
        case DLL_PROCESS_ATTACH: {
            ::DisableThreadLibraryCalls(hModule);   //创建线程包含死循环，为防卡死必须设置
            CreateThread(NULL, 0, inject, NULL, 0, NULL);
        }
        break;
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
            break;
        default:;
    }
    return true;
}

//
//  05简单DLL劫持(假LPK模块部分)
//  C/C++
//
//  Created by luguanxing.
//  Copyright @2016 LGX. All rights reserved.
//

#include <windows.h>
#include <stdlib.h>
#define Dllfunciton extern "C" __declspec(dllexport)    //以C方式导出

#pragma comment(linker, "/EXPORT:LpkInitialize=_gamehacker_LpkInitialize,@1")	//设置导出表
#pragma comment(linker, "/EXPORT:LpkTabbedTextOut=_gamehacker_LpkTabbedTextOut,@2")
#pragma comment(linker, "/EXPORT:LpkDllInitialize=_gamehacker_LpkDllInitialize,@3")
#pragma comment(linker, "/EXPORT:LpkDrawTextEx=_gamehacker_LpkDrawTextEx,@4")
#pragma comment(linker, "/EXPORT:LpkExtTextOut=_gamehacker_LpkExtTextOut,@6")
#pragma comment(linker, "/EXPORT:LpkGetCharacterPlacement=_gamehacker_LpkGetCharacterPlacement,@7")
#pragma comment(linker, "/EXPORT:LpkGetTextExtentExPoint=_gamehacker_LpkGetTextExtentExPoint,@8")
#pragma comment(linker, "/EXPORT:LpkPSMTextOut=_gamehacker_LpkPSMTextOut,@9")
#pragma comment(linker, "/EXPORT:LpkUseGDIWidthCache=_gamehacker_LpkUseGDIWidthCache,@10")
#pragma comment(linker, "/EXPORT:ftsWordBreak=_gamehacker_ftsWordBreak,@11")

char syslpk[250] = {0};
HMODULE hmodule;
FARPROC funcaddr = NULL;

FARPROC WINAPI GetAddress(PCSTR pszProcName) {	//从真正lpk.dll中找需要调用的真正函数地址
	funcaddr = GetProcAddress(hmodule, pszProcName);  
	return funcaddr;
}

Dllfunciton gamehacker_LpkInitialize() {	//找真正函数地址后跳转
	GetAddress("LpkInitialize");
	__asm JMP EAX;
}

Dllfunciton gamehacker_LpkTabbedTextOut() {
	GetAddress("LpkTabbedTextOut");
	__asm JMP EAX;
}

Dllfunciton gamehacker_LpkDllInitialize() {
	GetAddress("LpkDllInitialize");
	__asm JMP EAX;
}

Dllfunciton gamehacker_LpkDrawTextEx() {
	GetAddress("LpkDrawTextEx");
	__asm JMP EAX;
}

Dllfunciton gamehacker_LpkEditControl() {
	GetAddress("LpkEditControl");
	__asm jmp DWORD ptr [EAX];
}

Dllfunciton gamehacker_LpkExtTextOut() {
	GetAddress("LpkExtTextOut");
	__asm JMP EAX;
}

Dllfunciton gamehacker_LpkGetCharacterPlacement() {
	GetAddress("LpkGetCharacterPlacement");
	__asm JMP EAX;
}

Dllfunciton gamehacker_LpkGetTextExtentExPoint() {
	GetAddress("LpkGetTextExtentExPoint");
	__asm JMP EAX;
}

Dllfunciton gamehacker_LpkPSMTextOut() {
	GetAddress("LpkPSMTextOut");
	__asm JMP EAX;
}

Dllfunciton gamehacker_LpkUseGDIWidthCache() {
	GetAddress("LpkUseGDIWidthCache");
	__asm JMP EAX;
}

Dllfunciton gamehacker_ftsWordBreak() {
	GetAddress("ftsWordBreak");
	__asm JMP EAX;
}


BOOL APIENTRY DllMain(HMODULE hModule,  DWORD  ul_reason_for_call, LPVOID lpReserved) {
    switch(ul_reason_for_call) {
        case DLL_PROCESS_ATTACH: {
			GetSystemDirectory(syslpk, 250);
			strcat(syslpk, "\\lpk");
			hmodule = LoadLibrary(syslpk);	//加载真正系统lpk.dll
			::LoadLibrary("cheatDLL");	//加载作弊模块lpk.dll
        } break;
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
            break;
        default:;
    }
    return true;
}

总体评价

DLL劫持可以在不用手动加载外挂,在运行游戏时自动加载作弊功能

本文链接地址: https://www.dbgpro.com/archives/4826.html

——版权声明——