注入dll到微信

0x0 首先要打开微信进程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
wchar_t wxPath[] = L"C:\\Program Files (x86)\\Tencent\\WeChat\\WeChat.exe";
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
ZeroMemory(&si, sizeof(si));
si.cb = sizeof(si);
ZeroMemory(&pi, sizeof(pi));
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = SW_SHOW;

// 打开进程
BOOL bCp = CreateProcess(NULL, wxPath, NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);
if (bCp == 0)
{
  MessageBox(NULL, L"启动微信失败", L"错误", 0);
  return;
}

0x1 获取自己编写的dll写入到微信

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
// 获取进程ID
DWORD processID = pi.dwProcessId;
// 打开进程
HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);

// 获取自己的dll路径
string dllPath = GetDllPath();
// 申请内存
LPVOID dllBuffer = VirtualAllocEx(process, NULL, MAX_PATH, MEM_COMMIT, PAGE_READWRITE);
// 写入dll路径
BOOL bWp = WriteProcessMemory(process, dllBuffer, dllPath.c_str(), MAX_PATH, NULL);
if (bWp == 0)
{
  MessageBox(NULL, L"写入dll路径失败", L"错误", 0);
  return;
}

0x2 加载dll，创建远程线程

1
2
3
4
5
6
7
8
9
10
11
12
// 获取LoadLibrary()函数
FARPROC proc = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");

// 创建远程线程
HANDLE hThread = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)proc, dllBuffer, 0, NULL);
if (hThread == NULL) {
  MessageBox(NULL, L"创建线程失败", L"错误", MB_OK);
  return;
}
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
CloseHandle(process);

0x3 写入dll完成后，自己的dll就可以操作微信任意内存了

获取个人信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
DWORD GetWeChatWinAddr()
{
	if (weChatWinDllAddr == 0)
	{
		weChatWinDllAddr = (DWORD) LoadLibrary(L"WeChatWin.dll");
	}
	return weChatWinDllAddr;
}

// 2.7.1.88
DWORD base = GetWeChatWinAddr();
char* wxid = (char*) (base + 0x1397440); // 微信号
char* nickname = (char*) (base + 0x13972DC); // 昵称
char* head = (char*) (*(DWORD*)(base + 0x13975A4)); // 头像

0x4 成品展示

成品展示