标签微软下的文章 - 白帽Wiki

[2021]微软的dll搜索源码

from windows XP
```cpp
BOOL IsSvcInjected(DWORD dwPid)
{
    HANDLE hProcess;
    HMODULE hMods[1024];
    BOOL res = FALSE;

hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, dwPid);
    if (hProcess != NULL)
    {
        DWORD dwSize;
        // search through all loaded modules and see if we are injected 
        if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &dwSize))
        {
            DWORD n;
            for (n = 0; n < (dwSize / sizeof(HMODULE)); n++)
            {
                WCHAR   wszModName[MAX_PATH];
                if (GetModuleBaseNameW(hProcess, hMods[n], wszModName, sizeof(wszModName) / sizeof(WCHAR)))
                {
                    if (_wcsicmp(wszModName, SBIEDLL L".dll") == 0)
                    {
                        res = TRUE;
                        break;
                    }
                }
            }
        } // if (EnumProcessModules())

CloseHandle(hProcess);
    } // if (OpenProcess())

return res;
}
```

阅读全文

2021-12-09 huoji 0 条评论

系统安全二进制安全 C/C++汇编一线开发