利用DLL劫持内存补丁技术注入

当一个可执行文件运行时，Windows加载器将可执行模块映射到进程的地址空间中，加载器分析可执行模块的输入表，并设法找出任何需要的DLL，并将它们映射到进程的地址空间中。由于输入表中只包含DLL名而没有它的路径名，因此加载程序必须在磁盘上搜索DLL文件。首先会尝试从当前程序所在的目录加载DLL，如果没找到，则在Windows系统目录查找，最后是在环境变量中列出的各个目录下查找。利用这个特点，先伪造一个系统同名的DLL，提供同样的输出表，每个输出函数转向真正的系统DLL。程序调用系统DLL时会先调用当前目录下伪造的DLL，完成相关功能后，再跳到系统DLL同名函数里执行。这个过程用个形象的词来描述就是系统DLL被劫持
（hijack）了。
示例DELPHI源码：

Library USP10; 

uses

Windows, 

SysUtils, 

Classes; 

{$R *.res}

ModHandle: Cardinal; 

POldLpkPresent: Pointer; 

POldScriptApplyDigitSubstitution: Pointer; 

POldScriptApplyLogicalWidth: Pointer; 

POldScriptBreak: Pointer; 

POldScriptCPtoX: Pointer; 

POldScriptCacheGetHeight: Pointer; 

POldScriptFreeCache: Pointer; 

POldScriptGetCMap: Pointer; 

POldScriptGetFontProperties: Pointer; 

POldScriptGetGlyphABCWidth: Pointer; 

POldScriptGetLogicalWidths: Pointer; 

POldScriptGetProperties: Pointer; 

POldScriptIsComplex: Pointer; 

POldScriptItemize: Pointer; 

POldScriptJustify: Pointer; 

POldScriptLayout: Pointer; 

POldScriptPlace: Pointer; 

POldScriptRecordDigitSubstitution: Pointer; 

POldScriptShape: Pointer; 

POldScriptStringAnalyse: Pointer; 

POldScriptStringCPtoX: Pointer; 

POldScriptStringFree: Pointer; 

POldScriptStringGetLogicalWidths: Pointer; 

POldScriptStringGetOrder: Pointer; 

POldScriptStringOut: Pointer; 

POldScriptStringValidate: Pointer; 

POldScriptStringXtoCP: Pointer; 

POldScriptString_pLogAttr: Pointer; 

POldScriptString_pSize: Pointer; 

POldScriptString_pcOutChars: Pointer; 

POldScriptTextOut: Pointer; 

POldScriptXtoCP: Pointer; 

POldUspAllocCache: Pointer; 

POldUspAllocTemp: Pointer; 

POldUspFreeMem: Pointer; 

procedure LpkPresent; asm jmp POldLpkPresent end; 

procedure ScriptApplyDigitSubstitution; asm jmp POldScriptApplyDigitSubstitution end; 

procedure ScriptApplyLogicalWidth; asm jmp POldScriptApplyLogicalWidth end; 

procedure ScriptBreak; asm jmp POldScriptBreak end; 

procedure ScriptCPtoX; asm jmp POldScriptCPtoX end; 

procedure ScriptCacheGetHeight; asm jmp POldScriptCacheGetHeight end; 

procedure ScriptFreeCache; asm jmp POldScriptFreeCache end; 

procedure ScriptGetCMap; asm jmp POldScriptGetCMap end; 

procedure ScriptGetFontProperties; asm jmp POldScriptGetFontProperties end; 

procedure ScriptGetGlyphABCWidth; asm jmp POldScriptGetGlyphABCWidth end; 

procedure ScriptGetLogicalWidths; asm jmp POldScriptGetLogicalWidths end; 

procedure ScriptGetProperties; asm jmp POldScriptGetProperties end; 

procedure ScriptIsComplex; asm jmp POldScriptIsComplex end; 

procedure ScriptItemize; asm jmp POldScriptItemize end; 

procedure ScriptJustify; asm jmp POldScriptJustify end; 

procedure ScriptLayout; asm jmp POldScriptLayout end; 

procedure ScriptPlace; asm jmp POldScriptPlace end; 

procedure ScriptRecordDigitSubstitution; asm jmp POldScriptRecordDigitSubstitution end; 

procedure ScriptShape; asm jmp POldScriptShape end; 

procedure ScriptStringAnalyse; asm jmp POldScriptStringAnalyse end; 

procedure ScriptStringCPtoX; asm jmp POldScriptStringCPtoX end; 

procedure ScriptStringFree; asm jmp POldScriptStringFree end; 

procedure ScriptStringGetLogicalWidths; asm jmp POldScriptStringGetLogicalWidths end; 

procedure ScriptStringGetOrder; asm jmp POldScriptStringGetOrder end; 

procedure ScriptStringOut; asm jmp POldScriptStringOut end; 

procedure ScriptStringValidate; asm jmp POldScriptStringValidate end; 

procedure ScriptStringXtoCP; asm jmp POldScriptStringXtoCP end; 

procedure ScriptString_pLogAttr; asm jmp POldScriptString_pLogAttr end; 

procedure ScriptString_pSize; asm jmp POldScriptString_pSize end; 

procedure ScriptString_pcOutChars; asm jmp POldScriptString_pcOutChars end; 

procedure ScriptTextOut; asm jmp POldScriptTextOut end; 

procedure ScriptXtoCP; asm jmp POldScriptXtoCP end; 

procedure UspAllocCache; asm jmp POldUspAllocCache end; 

procedure UspAllocTemp; asm jmp POldUspAllocTemp end; 

procedure UspFreeMem; asm jmp POldUspFreeMem end; 

exports

LpkPresent, 

ScriptApplyDigitSubstitution, 

ScriptApplyLogicalWidth, 

ScriptBreak, 

ScriptCPtoX, 

ScriptCacheGetHeight, 

ScriptFreeCache, 

ScriptGetCMap, 

ScriptGetFontProperties, 

ScriptGetGlyphABCWidth, 

ScriptGetLogicalWidths, 

ScriptGetProperties, 

ScriptIsComplex, 

ScriptItemize, 

ScriptJustify, 

ScriptLayout, 

ScriptPlace, 

ScriptRecordDigitSubstitution, 

ScriptShape, 

ScriptStringAnalyse, 

ScriptStringCPtoX, 

ScriptStringFree, 

ScriptStringGetLogicalWidths, 

ScriptStringGetOrder, 

ScriptStringOut, 

ScriptStringValidate, 

ScriptStringXtoCP, 

ScriptString_pLogAttr, 

ScriptString_pSize, 

ScriptString_pcOutChars, 

ScriptTextOut, 

ScriptXtoCP, 

UspAllocCache, 

UspAllocTemp, 

UspFreeMem; 

begin

ModHandle:= LoadLibrary(‘C:\WINDOWS\system32\usp10.dll‘); 

if ModHandle > 0 then

begin

   POldLpkPresent:= GetProcAddress(ModHandle, ‘LpkPresent‘); 

   POldScriptApplyDigitSubstitution:= GetProcAddress(ModHandle,‘ScriptApplyDigitSubstitution‘); 

   POldScriptApplyLogicalWidth:= GetProcAddress(ModHandle,‘ScriptApplyLogicalWidth‘); 

   POldScriptBreak:= GetProcAddress(ModHandle, ‘ScriptBreak‘); 

   POldScriptCPtoX:= GetProcAddress(ModHandle, ‘ScriptCPtoX‘); 

   POldScriptCacheGetHeight:= GetProcAddress(ModHandle, ‘ScriptCacheGetHeight‘); 

   POldScriptFreeCache:= GetProcAddress(ModHandle, ‘ScriptFreeCache‘); 

   POldScriptGetCMap:= GetProcAddress(ModHandle, ‘ScriptGetCMap‘); 

   POldScriptGetFontProperties:= GetProcAddress(ModHandle,‘ScriptGetFontProperties‘); 

   POldScriptGetGlyphABCWidth:= GetProcAddress(ModHandle, ‘ScriptGetGlyphABCWidth‘); 

   POldScriptGetLogicalWidths:= GetProcAddress(ModHandle, ‘ScriptGetLogicalWidths‘); 

   POldScriptGetProperties:= GetProcAddress(ModHandle, ‘ScriptGetProperties‘); 

   POldScriptIsComplex:= GetProcAddress(ModHandle, ‘ScriptIsComplex‘); 

   POldScriptItemize:= GetProcAddress(ModHandle, ‘ScriptItemize‘); 

   POldScriptJustify:= GetProcAddress(ModHandle, ‘ScriptJustify‘); 

   POldScriptLayout:= GetProcAddress(ModHandle, ‘ScriptLayout‘); 

   POldScriptPlace:= GetProcAddress(ModHandle, ‘ScriptPlace‘); 

   POldScriptRecordDigitSubstitution:= GetProcAddress(ModHandle,‘ScriptRecordDigitSubstitution‘); 

   POldScriptShape:= GetProcAddress(ModHandle, ‘ScriptShape‘); 

   POldScriptStringAnalyse:= GetProcAddress(ModHandle, ‘ScriptStringAnalyse‘); 

   POldScriptStringCPtoX:= GetProcAddress(ModHandle, ‘ScriptStringCPtoX‘); 

   POldScriptStringFree:= GetProcAddress(ModHandle, ‘ScriptStringFree‘); 

   POldScriptStringGetLogicalWidths:= GetProcAddress(ModHandle,‘ScriptStringGetLogicalWidths‘); 

   POldScriptStringGetOrder:= GetProcAddress(ModHandle, ‘ScriptStringGetOrder‘); 

   POldScriptStringOut:= GetProcAddress(ModHandle, ‘ScriptStringOut‘); 

   POldScriptStringValidate:= GetProcAddress(ModHandle, ‘ScriptStringValidate‘); 

   POldScriptStringXtoCP:= GetProcAddress(ModHandle, ‘ScriptStringXtoCP‘); 

   POldScriptString_pLogAttr:= GetProcAddress(ModHandle, ‘ScriptString_pLogAttr‘); 

   POldScriptString_pSize:= GetProcAddress(ModHandle, ‘ScriptString_pSize‘); 

   POldScriptString_pcOutChars:= GetProcAddress(ModHandle,‘ScriptString_pcOutChars‘); 

   POldScriptTextOut:= GetProcAddress(ModHandle, ‘ScriptTextOut‘); 

   POldScriptXtoCP:= GetProcAddress(ModHandle, ‘ScriptXtoCP‘); 

   POldUspAllocCache:= GetProcAddress(ModHandle, ‘UspAllocCache‘); 

   POldUspAllocTemp:= GetProcAddress(ModHandle, ‘UspAllocTemp‘); 

   POldUspFreeMem:= GetProcAddress(ModHandle, ‘UspFreeMem‘); 

end; 

begin

//添加自己的补丁内容！

end; 

end.

原文地址：https://www.cnblogs.com/plug/p/8665616.html