隐藏DLL模块( HideDll)

最新推荐文章于 2023-11-08 18:05:53 发布

weixin_33859665

最新推荐文章于 2023-11-08 18:05:53 发布

阅读量3.6k

点赞数

CC 4.0 BY-SA版权

文章标签： c/c++ 大数据

原文链接：http://www.cnblogs.com/rogee/archive/2011/04/30/2033404.html

本文详细介绍了在C/C++中如何实现DLL模块的隐藏加载与使用，旨在提高程序的安全性和隐蔽性，适用于对软件保护有较高要求的开发者。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

void HideDll()
{
    HMODULE hMod = ::GetModuleHandle("MyHook.dll"); 
    PLIST_ENTRY Head,Cur;
    PPEB_LDR_DATA ldr;
    PLDR_MODULE ldm;
    __asm
    {
        mov eax , fs:[0x30]
        mov ecx , [eax + 0x0c] //Ldr
        mov ldr , ecx
    }
    Head = &(ldr->InLoadOrderModuleList);
    Cur = Head->Flink;
    do
    {
        ldm = CONTAINING_RECORD( Cur, LDR_MODULE, InLoadOrderModuleList);
        //printf("EntryPoint [0x%X]\n",ldm->BaseAddress);
        if( hMod == ldm->BaseAddress)
         {
            ldm->InLoadOrderModuleList.Blink->Flink =
                ldm->InLoadOrderModuleList.Flink;
            ldm->InLoadOrderModuleList.Flink->Blink =
                ldm->InLoadOrderModuleList.Blink; 
            ldm->InInitializationOrderModuleList.Blink->Flink =
                ldm->InInitializationOrderModuleList.Flink;
            ldm->InInitializationOrderModuleList.Flink->Blink =
                ldm->InInitializationOrderModuleList.Blink;  
            ldm->InMemoryOrderModuleList.Blink->Flink =
                ldm->InMemoryOrderModuleList.Flink;
            ldm->InMemoryOrderModuleList.Flink->Blink =
                ldm->InMemoryOrderModuleList.Blink;  
            break;
         }
        Cur= Cur->Flink; 
     }while(Head != Cur);
}

转载于:https://www.cnblogs.com/rogee/archive/2011/04/30/2033404.html