另類登錄檔注入
阿新 • • 發佈:2019-02-14
留個檔,特點就是注入後只有ntdll載入了,其他系統模組都沒載入,所以需要自己搞點東西
void reg_inject_dll(LPCTSTR lpszExeName,LPCTSTR lpszDllName) { HKEY hKey; int dwFlag = 0x100; TCHAR szKey[MAX_PATH] = {}; StringCbPrintf(szKey,sizeof(szKey), _T("Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\%s"), lpszExeName); RegCreateKeyEx(HKEY_LOCAL_MACHINE, szKey, 0, NULL, 0, KEY_ALL_ACCESS, NULL, &hKey, NULL); RegSetValueEx(hKey, _T("VerifierDlls"), 0, REG_SZ, (BYTE *)lpszDllName, (lstrlen(lpszDllName) + 1) * sizeof(char)); RegSetValueEx(hKey, _T("GlobalFlag"), 0, REG_DWORD, (BYTE *)&dwFlag, sizeof(dwFlag)); RegCloseKey(hKey); }