CreateRemoteThread 成功，但某些目标应用的 LoadLibrary 失败

Question

我正在使用 CreateRemoteThread() + LoadLibrary() 方法注入代码。 当我在我的 Windows7 64 位操作系统笔记本电脑上运行我的注入器时一切正常，并且对于某些目标应用程序，它仍然可以在 Windows Server 2012 R2 64 位中工作。

但是，在这个 Windows Server 2012 环境中，对于一些目标应用程序，它是旧的 MFC 应用程序，CreateRemoteThread 成功但 DllMain 没有被调用，我发现 LoadLibrary() 似乎失败了，通过使用 GetExitCodeThread()创建远程线程。

为了写入目标进程的内存，我计算了终止的0字节。

另外，我已经知道 kernel32.dll 地址对于 Windows 7 和 Windows Server 2012 是相同的，使用下面 URL 回答部分介绍的方法。

CreateRemoteThread fails,maybe the lpBaseAddress in the target process is invalid,but it is allocated by the system?

下面的 GetExitCodeThread() 的退出代码为零。

    HANDLE hThread = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)addr, arg, NULL, NULL);
    if(hThread == NULL) {
        OutputDebugString(_T("Error: the remote thread could not be created.\n"));
        writeLog("Error: the remote thread could not be created.");
    }
    else {
        DWORD dResult = WAIT_OBJECT_0;
        dResult = WaitForSingleObject(hThread, 1000*3);// the thread may already exited, so do not wait INFINITE
        DWORD dwExitCode = 0;
        GetExitCodeThread(hThread, &dwExitCode);
        if(dwExitCode == 0)
        {
            writeLog("Error: LoadLibraryA failed.");
        }
        else
        {
            OutputDebugString(_T("Success: the remote thread was successfully created.\n"));
            writeLog("Success: the remote thread was successfully created.");
        }
    }

你知道我接下来应该怀疑什么吗？

总而言之，在下图中，您可以看到唯一的失败是我在 Windows Server 2012 上运行注入器以注入一些旧的 MFC 应用程序。

在下图中，有关于 MFC 应用程序有多旧的信息：

我正在努力提供足够的信息，如果您需要更多信息，请告诉我。

下面是注入我的 dll 的完整代码：

void inject(int procID, char* pszHookDll)
{
    g_nTargetProcId = procID;
    HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID);
    g_hTargetProc = process;

    BOOL bInit = SymInitialize(g_hTargetProc, g_sPdbFolder, TRUE);// for analysing the information spy.dll send out

    if(process == NULL) {
        writeLog("Error: the specified process couldn't be found.");
    }
    /*
    * Get address of the LoadLibrary function.
    */
    LPVOID addr = (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    if(addr == NULL) {
        writeLog("Error: the LoadLibraryA function was not found inside kernel32.dll library.");
    }
    //addr = getProcAddrInTargetProcess(procID, process);

    /*
    * Allocate new memory region inside the process's address space.
    */
    int nBufSize = strlen(pszHookDll)+1;
    LPVOID arg = (LPVOID)VirtualAllocEx(process, NULL, nBufSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    if(arg == NULL) {
        writeLog("Error: the memory could not be allocated inside the chosen process.");
    }

    /*
    * Write the argument to LoadLibraryA to the process's newly allocated memory region.
    */
    int n = WriteProcessMemory(process, arg, pszHookDll, nBufSize, NULL);
    if(n == 0) {
        writeLog("Error: there was no bytes written to the process's address space.");
    }

    /*
    * Inject our DLL into the process's address space.
    */
    HANDLE hThread = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)addr, arg, NULL, NULL);
    if(hThread == NULL) {
        writeLog("Error: the remote thread could not be created.");
    }
    else {
        DWORD dResult = WAIT_OBJECT_0;
        dResult = WaitForSingleObject(hThread, 1000*3);
        DWORD dwExitCode = 0;
        GetExitCodeThread(hThread, &dwExitCode);
        if(dwExitCode == 0)
        {
            writeLog("Error: LoadLibraryA failed.");
        }
        else
        {
            OutputDebugString(_T("Success: the remote thread was successfully created.\n"));
            writeLog("Success: the remote thread was successfully created.");
        }
    }

    /*
    * Close the handle to the process, becuase we've already injected the DLL.
    */
    //CloseHandle(process);close after symcleanup
}

Answer 1

我明白了：这是一个依赖问题。

这里是spy.dll的依赖：

spy.dll 依赖于msvcr100d.dll，在我的 windows Server 2012 环境中默认不可用。

我提到的新 MFC 应用与msvcr100d.dll 一起部署在 Windows Server 2012 上，所以没有问题。

谢谢巴菲和雷米！！