Dll Injektion in C# funktioniert nicht

Question

Ich habe den folgenden Code.

using System; 
using System.Diagnostics; 
using System.Runtime.InteropServices; 
using System.Threading; 
using ClassLibrary1; 

namespace Injection 
{ 
    class Program 
    { 
     static void Main(string[] args) 
     { 
      //ClassLibrary1.Class1.Main(); 
      Program p = new Program(); 
      String strDLLName = "C:\\Users\\pente\\Documents\\Visual Studio 2015\\Projects\\Injection\\ClassLibrary1\\obj\\Debug\\ClassLibrary1.dll"; 
      String strProcessName = "notepad"; 

      Int32 ProcID = p.GetProcessId(strProcessName); 
      if (ProcID >= 0) 
      { 
       IntPtr hProcess = (IntPtr)OpenProcess(0x1F0FFF, 1, ProcID); 
       if (hProcess == null) 
       { 
        Console.WriteLine("OpenProcess() Failed!"); 
        return; 
       } 
       else 
        p.InjectDLL(hProcess, strDLLName); 
      } 
     } 

     public void InjectDLL(IntPtr hProcess, String strDLLName) 
     { 
      IntPtr bytesout; 

      // Length of string containing the DLL file name +1 byte padding 
      Int32 LenWrite = strDLLName.Length + 1; 
      // Allocate memory within the virtual address space of the target process 
      IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory 

      // Write DLL file name to allocated memory in target process 
      WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout); 
      // Function pointer "Injector" 
      UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"); 

      if (Injector == null) 
      { 
       Console.WriteLine(" Injector Error! \\n "); 
       // return failed 
       return; 
      } 

      // Create thread in target process, and store handle in hThread 
      IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout); 
      // Make sure thread handle is valid 
      if (hThread == null) 
      { 
       //incorrect thread handle ... return failed 
       Console.WriteLine(" hThread [ 1 ] Error! \\n "); 
       return; 
      } 
      // Time-out is 10 seconds... 
      int Result = WaitForSingleObject(hThread, 10 * 1000); 
      // Check whether thread timed out... 
      if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF) 
      { 
       /* Thread timed out... */ 
       Console.WriteLine(" hThread [ 2 ] Error! \\n "); 
       // Make sure thread handle is valid before closing... prevents crashes. 
       if (hThread != null) 
       { 
        //Close thread in target process 
        CloseHandle(hThread); 
       } 
       return; 
      } 
      // Sleep thread for 1 second 
      Thread.Sleep(1000); 
      // Clear up allocated space (Allocmem) 
      VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000); 
      // Make sure thread handle is valid before closing... prevents crashes. 
      if (hThread != null) 
      { 
       //Close thread in target process 
       CloseHandle(hThread); 
      } 
      // return succeeded 
      return; 
     } 
     [DllImport("kernel32")] 
     public static extern IntPtr CreateRemoteThread(
     IntPtr hProcess, 
     IntPtr lpThreadAttributes, 
     uint dwStackSize, 
     UIntPtr lpStartAddress, // raw Pointer into remote process 
     IntPtr lpParameter, 
     uint dwCreationFlags, 
     out IntPtr lpThreadId 
    ); 

     [DllImport("kernel32.dll")] 
     public static extern IntPtr OpenProcess(
      UInt32 dwDesiredAccess, 
      Int32 bInheritHandle, 
      Int32 dwProcessId 
      ); 

     [DllImport("kernel32.dll")] 
     public static extern Int32 CloseHandle(
     IntPtr hObject 
     ); 

     [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 
     static extern bool VirtualFreeEx(
      IntPtr hProcess, 
      IntPtr lpAddress, 
      UIntPtr dwSize, 
      uint dwFreeType 
      ); 

     [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)] 
     public static extern UIntPtr GetProcAddress(
      IntPtr hModule, 
      string procName 
      ); 

     [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 
     static extern IntPtr VirtualAllocEx(
      IntPtr hProcess, 
      IntPtr lpAddress, 
      uint dwSize, 
      uint flAllocationType, 
      uint flProtect 
      ); 

     [DllImport("kernel32.dll")] 
     static extern bool WriteProcessMemory(
      IntPtr hProcess, 
      IntPtr lpBaseAddress, 
      string lpBuffer, 
      UIntPtr nSize, 
      out IntPtr lpNumberOfBytesWritten 
     ); 

     [DllImport("kernel32.dll", CharSet = CharSet.Auto)] 
     public static extern IntPtr GetModuleHandle(
      string lpModuleName 
      ); 

     [DllImport("kernel32", SetLastError = true, ExactSpelling = true)] 
     internal static extern Int32 WaitForSingleObject(
      IntPtr handle, 
      Int32 milliseconds 
      ); 

     public Int32 GetProcessId(String proc) 
     { 
      Process[] ProcList; 
      ProcList = Process.GetProcessesByName(proc); 
      return ProcList[0].Id; 
     } 
    } 
} 

Der obige Code ist mein Hauptprogramm. Ich habe eine DLL, deren Code unten abgebildet ist, die ich in einen Notizblock zu injizieren versuche.

using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Text; 
using System.Threading.Tasks; 

namespace ClassLibrary1 
{ 
    public class Class1 
    { 
     public static void Main() 
     { 
      Console.WriteLine("Succeeded!!"); 
      Console.ReadLine(); 
     } 

    } 
} 

Ich habe den Bibliothekscode als DLL-Verweis auf den Hauptcode hinzugefügt.

Der Code läuft und tut im Grunde nichts. Was vermisse ich? Warum funktioniert es nicht?

Answer 1

Ihr Code versucht, eine native Bibliothek aufzurufen, aber Sie verknüpfen mit einer .NET-Bibliothek, so dass Ihre .NET-Bibliothek Main nie aufgerufen wird. Die beste Lösung besteht also darin, eine native Bibliothek (z. B. C++) zu erstellen und das .NET Framework in Ihr Host-Programm zu laden und dann die verwaltete Hauptmethode auszuführen.

tl; dr: Loadlibrary usw. nur Lasten native Bibliotheken