delphi 注入不用WriteProcessMemory 函数

To avoid using WriteProcessMemory, we need to find other ways to inject a certain string (e.g. "mypayload.dll") into a foreign process.

This idea is a more creative one, by simply modifying the registers of the foreign process and pushing them to load a string into the stack.
Then we can simply change the EIP to call a certain API (e.g. "LoadLibraryA"), then return to the OEP like nothing happened.

WARNING: This uses static memoryadresses for the used commands like push 0 etc. I already made an memscanner to find out the adresses dynamically, but I wont make it public (ripper detection).

unit prjBypass;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, tlhelp32;

type
TForm1 = class(TForm)
btn2: TButton;
lbl1: TLabel;
procedure btn2Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
function OpenThread(dwDesiredAccess: DWord;
bInheritHandle: Bool;
dwThreadId: DWord): DWord; stdcall; external 'kernel32.dll';
function DebugSetProcessKillOnExit(KillOnExit: boolean):boolean; stdcall;external 'kernel32.dll';
var
Form1: TForm1;

implementation

{$R *.dfm}

function HexToInt(HexNum: string): LongInt;
begin
Result:=StrToInt('$' + HexNum);
end;

function WaitForData(dDebug:TDebugEvent):Boolean;
begin
Result := True;
repeat
WaitForDebugEvent(dDebug,INFINITE);
if dDebug.dwDebugEventCode = EXCEPTION_DEBUG_EVENT then
if dDebug.Exception.ExceptionRecord.ExceptionCode = EXCEPTION_SINGLE_STEP then
break;
if dDebug.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT then begin
Result := False;
Exit;
end;
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);
until 1=3;
end;

procedure TForm1.btn2Click(Sender: TObject);
var
pi: TProcessInformation;
si: TStartupInfo;
context:_CONTEXT;
dDebug:TDebugEvent;
dwOEP, dwESP, dwEAX, dwECX, dwEBP, dwEDI, dwEBX, dwEDX:DWORD;
begin
FillMemory( @si, sizeof( si ), 0 );
si.cb := sizeof( si );
context.ContextFlags:=CONTEXT_FULL or CONTEXT_FLOATING_POINT or CONTEXT_DEBUG_REGISTERS;
If CreateProcess(Nil,PChar('notepad.exe'),Nil, Nil, False,DEBUG_PROCESS, Nil, Nil, si, pi ) then begin

repeat
WaitForDebugEvent(dDebug,INFINITE);
if dDebug.dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT then
break;
if dDebug.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT then
Exit;
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);
until 1=3;

//Set BP on OEP
GetThreadContext(pi.hThread,context);
dwOEP := context.EAX;
context.Dr0 := dwOEP;
context.Dr7 := 1;
SetThreadContext(pi.hThread,context);
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then
Exit;

//We are at OEP
//Save Registers, change EIP to push eax
GetThreadContext(pi.hThread,context);
if context.Eip = dwOEP then begin
context.Dr0 := 0;
context.Dr7 := 0;
//Save Registers
dwEBP := context.Ebp;
dwEAX := context.Eax;
dwEBX := context.Ebx;
dwECX := context.Ecx;
dwEDX := context.Edx;
dwESP := context.Esp;
dwEDI := context.Edi;
context.Eax := HexToInt('00796568');
context.Eip := HexToInt('01007505');
context.EFlags := Context.EFlags or $0100;
SetThreadContext(pi.hThread,context);
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);
end else
Exit;

if WaitForData(dDebug) = false then
Exit;

//Mov eax, esp
//Push 0
GetThreadContext(pi.hThread,context);
context.Eip := HexToInt('01002290');
context.Eax := context.Esp;
context.EFlags := Context.EFlags or $0100;
SetThreadContext(pi.hThread,context);
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then
Exit;

//push eax
GetThreadContext(pi.hThread,context);
context.Eip := HexToInt('01001B18');
context.EFlags := Context.EFlags or $0100;
SetThreadContext(pi.hThread,context);
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then
Exit;

//push eax
GetThreadContext(pi.hThread,context);
context.Eip := HexToInt('01001B18');
context.EFlags := Context.EFlags or $0100;
SetThreadContext(pi.hThread,context);
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);


if WaitForData(dDebug) = false then
Exit;

//Push 0
GetThreadContext(pi.hThread,context);
context.Eip := HexToInt('01002290');
context.EFlags := Context.EFlags or $0100;
SetThreadContext(pi.hThread,context);
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then
Exit;

//mov eax, messagebox
//call eax
GetThreadContext(pi.hThread,context);
context.Eax := DWORD(GEtProcAddress(LoadLibrary('user32.dll'),'MessageBoxA'));
context.Eip := HexToInt('01002969');
context.Dr0 := context.Eip + 2;
context.Dr7 := 1;
SetThreadContext(pi.hThread,context);
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

if WaitForData(dDebug) = false then
Exit;

GetThreadContext(pi.hThread,context);
//Save Registers
context.Eax := dwEAX;
context.Ebx := dwEBX;
context.Ecx := dwECX;
context.Edx := dwEDX;
context.Esp := dwESP;
context.Edi := dwEDI;
context.Eip := dwOEP;
context.Ebp := dwEBP;
context.Dr0 := 0;
context.Dr7 := 0;
SetThreadContext(pi.hThread,context);
ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE);

//Detach Process
DebugSetProcessKillOnExit(False);
end;
end;

end.