先来推广一下QQ群&＃xff1a;61618925。欢迎各位爱好编程的加入。
在外挂或者病毒中&＃xff0c;经常需要隐藏掉自己注入的DLL&＃xff0c;以免被发现。下面就是一个隐藏DLL的通用模块&＃xff0c;用的时候只需要加入到相关模块中即可。
详细代码如下&＃xff1a;
#include
{DWORD *PEB &＃61; NULL;DWORD *Ldr &＃61; NULL;DWORD *Flink &＃61; NULL;DWORD *p &＃61; NULL;DWORD *BaseAddress &＃61; NULL;DWORD *FullDllName &＃61; NULL;//定位PEB
__asm{//fs位置保存着teb//fs:[0x30]位置保存着pebmov eax,fs:[0x30]mov PEB,eax}HMODULE hMod &＃61; GetModuleHandleA(szModule);//得到LDRLdr &＃61; *((DWORD **)((unsigned char *)PEB &＃43; 0x0c));//第二条链表Flink &＃61; *((DWORD **)((unsigned char *)Ldr &＃43; 0x0c));p &＃61; Flink;do {BaseAddress &＃61; *((DWORD **)((unsigned char *)p &＃43; 0x18));FullDllName &＃61; *((DWORD **)((unsigned char *)p &＃43; 0x28));if ((DWORD*)hMod &＃61;&＃61; BaseAddress){**((DWORD **)(p &＃43; 1)) &＃61; (DWORD)*((DWORD **)p);*(*((DWORD **)p) &＃43; 1) &＃61; (DWORD)*((DWORD **)(p &＃43; 1));break;}p &＃61; *((DWORD **)p);} while (Flink !&＃61; p);Flink &＃61; *((DWORD **)((unsigned char *)Ldr &＃43; 0x14));p &＃61; Flink;do {BaseAddress &＃61; *((DWORD **)((unsigned char *)p &＃43; 0x10));FullDllName &＃61; *((DWORD **)((unsigned char *)p &＃43; 0x20));if (BaseAddress &＃61;&＃61; (DWORD *)hMod){**((DWORD **)(p &＃43; 1)) &＃61; (DWORD)*((DWORD **)p);*(*((DWORD **)p) &＃43; 1) &＃61; (DWORD)*((DWORD **)(p &＃43; 1));break;}p &＃61; *((DWORD **)p);} while (Flink !&＃61; p);Flink &＃61; *((DWORD **)((unsigned char *)Ldr &＃43; 0x1c));p &＃61; Flink;do {BaseAddress &＃61; *((DWORD **)((unsigned char *)p &＃43; 0x8));FullDllName &＃61; *((DWORD **)((unsigned char *)p &＃43; 0x18));if (BaseAddress &＃61;&＃61; (DWORD *)hMod){**((DWORD **)(p &＃43; 1)) &＃61; (DWORD)*((DWORD **)p);*(*((DWORD **)p) &＃43; 1) &＃61; (DWORD)*((DWORD **)(p &＃43; 1));break;}p &＃61; *((DWORD **)p);} while (Flink !&＃61; p);
}int main(int argc, char **argv)
{HideModule("kernel32.dll");HideModule("ntdll.dll");HideModule("MSVCR90.dll");HideModule("KERNELBASE.dll");getchar();return 0;
}
用我之前博客中的进程管理器查看本进程的DLL&＃xff0c;可以发现找不到相应的DLL。
![[c++基础]STL](https://img.php1.cn/3c972/1edc8/c5a/a04ecc977fd8ed28.jpeg)
京公网安备 11010802041100号