[C++] Anti dll inject

tarafından **EMO** Cuma Nis. 13, 2012 2:14 pm

[QUOTE=Marwan1;6952754]Hi all

Kod:: #include <windows.h> #include "stdafx.h" void main() { void ZPerformHooks(); } DWORD g_dwLoadLibraryAJMP; /* HOOK FUNCTION */ DWORD WINAPI jumphook( DWORD AddressToPerformJump, DWORD AddressOfMyFunction, DWORD LenghOfTheAreaToPerformTheJump ) { if( LenghOfTheAreaToPerformTheJump < 5 ) return 0; DWORD RelativeJump, NextInstructionAddress, Flag; if ( ! VirtualProtect((LPVOID)AddressToPerformJump, LenghOfTheAreaToPerformTheJump, PAGE_EXECUTE_READWRITE, &Flag) ) return 0; NextInstructionAddress = AddressToPerformJump + LenghOfTheAreaToPerformTheJump; *(BYTE*)AddressToPerformJump = 0xE9; for( DWORD i = 5; i < LenghOfTheAreaToPerformTheJump; i++) *(BYTE*)(AddressToPerformJump+i) = 0x90; RelativeJump = AddressOfMyFunction - AddressToPerformJump - 0x5; *(DWORD*)(AddressToPerformJump + 0x1) = RelativeJump; VirtualProtect((LPVOID)AddressToPerformJump, LenghOfTheAreaToPerformTheJump, Flag, &Flag); return NextInstructionAddress; } /* END HOOK FUNCTION */ HMODULE WINAPI hLoadLibraryA( LPCSTR lpLibFileName ) { __asm { mov eax, dword ptr ss:[esp + 0x18] cmp dword ptr ds:[eax-0x12], 0x8B55FF8B je erro } if( lpLibFileName ) { if( !strcmp( lpLibFileName, "twain_32.dll" ) ) __asm jmp g_dwLoadLibraryAJMP } return LoadLibraryExA( lpLibFileName, 0, 0 ); erro: /* dll injetada */ ExitProcess( 0 ); return 0; } void ZPerformHooks() { g_dwLoadLibraryAJMP = (DWORD)GetModuleHandleA( "kernel32" ) + 0x6E2A1; jumphook( (DWORD)LoadLibraryA, (DWORD)&hLoadLibraryA, 57 ); }

is this code right?

Kod:: #include <windows.h> #include "stdafx.h" BOOLEAN BlockAPI( HANDLE, CHAR*, CHAR* ); void main() { void AntiInject () ; MessageBoxA(0, "Join us at Inferno Dev!", "DLL Message", MB_OK | MB_ICONINFORMATION); } void AntiInject () { HANDLE hProc = GetCurrentProcess(); while (TRUE) { BlockAPI(hProc, "NTDLL.DLL", "LdrLoadDll"); Sleep (100); } } BOOLEAN BlockAPI (HANDLE hProcess, CHAR *libName, CHAR *apiName) { CHAR pRet[]={0xC3}; HINSTANCE hLib = NULL; VOID *pAddr = NULL; BOOL bRet = FALSE; DWORD dwRet = 0; hLib = LoadLibraryA (libName); if (hLib) { pAddr = (VOID*)GetProcAddress (hLib, apiName); if (pAddr) { if (WriteProcessMemory (hProcess, (LPVOID)pAddr, (LPVOID)pRet, sizeof (pRet), &dwRet )) { if (dwRet) { bRet = TRUE; } } } FreeLibrary (hLib); } return bRet; }

and this???

and i want ask 1 more question
how to add exception dll to the code?
cuz this code block all dlls so i want add exception dlls[/QUOTE]