幽灵屋DLL注入卸载工具【源码+程序】

啊冲 · 发表于 2014-6-3 10:37:21

;*************************************************
;CopyRight@GhostHand
;*************************************************
.386
.model flat,stdcall
option casemap:none
;*************************************************
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include advapi32.inc
includelib advapi32.lib
include comdlg32.inc
includelib comdlg32.lib
include shell32.inc
includelib shell32.lib
include into.inc
;*************************************************
.data?
hInstance dd ?
hWinMain dd ?
lpLoadLibrary dd ?
lpFreeLibrary dd ?
hProcess dd ?
lpDllName dd ?
szDllName db MAX_PATH dup (?)
.const
szText db '[幽灵屋论坛]:[url]www.ghostasm.com[/url]',0
szCaption db '[GhostHand]Message',0
szSetDebug db 'SeDebugPrivilege',0
szATPErr db '[AdjustTokenPrivileges]:Error!!',0
szLPVErr db '[LookupPrivilegeValue]:Error!',0
szOPTErr db '[OpenProcessToken]:Error!',0
szFilter db 'Dll Files(*.dll)',0,'*.dll',0,0
szOpenCaption db 'Select a dll',0
szOD db '[_OpenDll]:请选择Dll文件！',0
szDllKernel db 'Kernel32.dll',0
szLoadLibrary db 'LoadLibraryA',0
szFreeLibrary db 'FreeLibraryAndExitThread',0
szCRTErr db '[CreateRemoteThread]:Error!',0
szVAEErr db '[VirtualAllocEx]:Error!',0
szOPErr db '[OpenProcess]:Error!',0
szCRTOk db '[CreateRemoteThread]:Success!',0
szEmail db 'mailto:admin@ghostasm.com',0
szNtDll db 'ntdll.dll',0
szNtQueryInformationThread db 'NtQueryInformationThread',0
.code
_SetWinPos proc _hWnd
LOCAL x_screen:dword
LOCAL y_screen:dword
LOCAL rtWinMain:RECT
invoke GetSystemMetrics,SM_CXSCREEN
mov edx,0
mov cx,2
div cx ;商在ax中，余数在dx中
mov x_screen,eax
invoke GetSystemMetrics,SM_CYSCREEN
mov edx,0
mov cx,2
div cx
mov y_screen,eax
invoke GetWindowRect,_hWnd,addr rtWinMain
mov edx,0
mov eax,rtWinMain.right
mov cx,2
div cx
mov edx,x_screen
sub edx,eax
mov x_screen,edx
mov edx,0
mov eax,rtWinMain.bottom
mov cx,2
div cx
mov edx,y_screen
sub edx,eax
mov y_screen,edx
invoke SetWindowPos,_hWnd,NULL,x_screen,y_screen,NULL,NULL,SWP_NOSIZE
ret
_SetWinPos endp
_EnableDebug proc
LOCAL hToken:dword
LOCAL tkp:TOKEN_PRIVILEGES
LOCAL @luid:LUID
invoke GetCurrentProcess
lea ebx,hToken
invoke OpenProcessToken,eax,TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY,ebx
.if eax
invoke LookupPrivilegeValue,NULL,offset szSetDebug,addr tkp.Privileges.Luid
.if eax
mov tkp.PrivilegeCount,1
mov tkp.Privileges.Attributes,SE_PRIVILEGE_ENABLED
invoke AdjustTokenPrivileges,hToken, FALSE,addr tkp,sizeof tkp,NULL,NULL
.if !eax
invoke CloseHandle,hToken
invoke MessageBox,hWinMain,offset szATPErr,offset szCaption,MB_OK
.endif
.else
invoke CloseHandle,hToken
invoke MessageBox,hWinMain,offset szLPVErr,offset szCaption,MB_OK
.endif
.else
invoke MessageBox,hWinMain,offset szOPTErr,offset szCaption,MB_OK
.endif
ret
_EnableDebug endp
_OpenDll proc
LOCAL @stOF:OPENFILENAME
invoke RtlZeroMemory,addr @stOF,sizeof @stOF
mov @stOF.lStructSize,sizeof @stOF
push hWinMain
pop @stOF.hwndOwner
mov @stOF.lpstrFilter,offset szFilter
mov @stOF.lpstrFile,offset szDllName
mov @stOF.nMaxFile,MAX_PATH
mov @stOF.Flags,OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST
mov @stOF.lpstrTitle,offset szOpenCaption
invoke GetOpenFileName,addr @stOF
.if eax
invoke SetDlgItemText,hWinMain,IDC_DLLPATH,offset szDllName
.endif
ret
_OpenDll endp
_GetProcessList proc _hWnd
LOCAL @stProcess:PROCESSENTRY32
LOCAL @hSnapShot
invoke RtlZeroMemory,addr @stProcess,sizeof @stProcess
invoke SendDlgItemMessage,_hWnd,IDC_PROCESSLIST,LB_RESETCONTENT,0,0
mov @stProcess.dwSize,sizeof @stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0
mov @hSnapShot,eax
invoke Process32First,@hSnapShot,addr @stProcess
.while eax
invoke SendDlgItemMessage,_hWnd,IDC_PROCESSLIST,LB_ADDSTRING,0,addr @stProcess.szExeFile
invoke SendDlgItemMessage,_hWnd,IDC_PROCESSLIST,LB_SETITEMDATA,eax,@stProcess.th32ProcessID
invoke Process32Next,@hSnapShot,addr @stProcess
.endw
invoke CloseHandle,@hSnapShot
ret
_GetProcessList endp
_GetModelList proc _dwProcessId,_hWnd,_hModule
LOCAL @stModule:MODULEENTRY32
LOCAL @hSnapShot
LOCAL @ModuleSize
mov @ModuleSize,0
invoke RtlZeroMemory,addr @stModule,sizeof @stModule
invoke SendDlgItemMessage,_hWnd,IDC_MODELLIST,LB_RESETCONTENT,0,0
mov @stModule.dwSize,sizeof @stModule
invoke CreateToolhelp32Snapshot,TH32CS_SNAPMODULE,_dwProcessId ;枚举进程模块
mov @hSnapShot,eax
invoke Module32First,@hSnapShot,addr @stModule
.while eax
mov eax,_hModule
.if eax == @stModule.modBaseAddr
push @stModule.modBaseSize
pop @ModuleSize
.endif
invoke SendDlgItemMessage,_hWnd,IDC_MODELLIST,LB_ADDSTRING,0,addr @stModule.szModule
invoke SendDlgItemMessage,_hWnd,IDC_MODELLIST,LB_SETITEMDATA,eax,@stModule.modBaseAddr
invoke Module32Next,@hSnapShot,addr @stModule
.endw
invoke CloseHandle,@hSnapShot
mov eax,@ModuleSize
ret
_GetModelList endp
_KillThread proc _ProcessId,_lpModelBase,dwModelSize
LOCAL @stThread:THREADENTRY32
LOCAL @hSnapShot
LOCAL @hThread
LOCAL @NtQueryInformationThread
LOCAL @ThreadBase
invoke GetModuleHandle,offset szNtDll
invoke GetProcAddress,eax,offset szNtQueryInformationThread
mov @NtQueryInformationThread,eax
invoke RtlZeroMemory,addr @stThread,sizeof @stThread
mov @stThread.dwSize,sizeof @stThread
invoke CreateToolhelp32Snapshot,TH32CS_SNAPTHREAD,_ProcessId
mov @hSnapShot,eax
invoke Thread32First,@hSnapShot,addr @stThread
.while eax
invoke OpenThread,THREAD_ALL_ACCESS,FALSE,@stThread.th32ThreadID
mov @hThread,eax
lea edx,@ThreadBase
mov ecx,@NtQueryInformationThread
push NULL
push 4h
push edx
push 9
push @hThread
call ecx
mov eax,@ThreadBase
sub eax,_lpModelBase
.if (eax < dwModelSize) || (eax == dwModelSize)
invoke TerminateThread,@hThread,0
.endif
invoke CloseHandle,@hThread
invoke Thread32Next,@hSnapShot,addr @stThread
.endw
invoke CloseHandle,@hSnapShot
ret
_KillThread endp
_Into proc dwProcessId,_hWnd
LOCAL @hThread
invoke GetModuleHandle,offset szDllKernel
invoke GetProcAddress,eax,offset szLoadLibrary
mov lpLoadLibrary,eax
invoke SendDlgItemMessage,_hWnd,IDC_PROCESSLIST,LB_GETCURSEL,0,0
invoke SendDlgItemMessage,_hWnd,IDC_PROCESSLIST,LB_GETITEMDATA,eax,0
invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,eax
.if eax
mov hProcess,eax
invoke lstrlen,offset szDllName
inc eax
invoke VirtualAllocEx,hProcess,NULL,eax,MEM_COMMIT,PAGE_READWRITE
.if eax
mov lpDllName,eax
;将DLL路径写入目标进程
invoke lstrlen,offset szDllName
inc eax
invoke WriteProcessMemory,hProcess,lpDllName,offset szDllName,eax,NULL
invoke CreateRemoteThread,hProcess,NULL,0,lpLoadLibrary,lpDllName,0,NULL
.if eax
mov @hThread,eax
invoke WaitForSingleObject,eax,INFINITE;等待线程执行
invoke CloseHandle,@hThread
invoke SetDlgItemText,hWinMain,IDC_MSG,offset szCRTOk
.else
invoke SetDlgItemText,hWinMain,IDC_MSG,offset szCRTErr
.endif
invoke lstrlen,offset szDllName
inc eax
invoke VirtualFreeEx,hProcess,lpDllName,eax,MEM_DECOMMIT
.else
invoke SetDlgItemText,hWinMain,IDC_MSG,offset szVAEErr
.endif
invoke CloseHandle,hProcess
.else
invoke SetDlgItemText,hWinMain,IDC_MSG,offset szOPErr
.endif
ret
_Into endp
_Out proc _dwProcessId,_Model
LOCAL @dwHandle:dword
LOCAL @hThread:dword
invoke GetModuleHandle,offset szDllKernel
invoke GetProcAddress,eax,offset szFreeLibrary
mov lpFreeLibrary,eax
invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,_dwProcessId ;打开Services.exe的进程
.if eax
mov hProcess,eax
invoke _GetModelList,_dwProcessId,hWinMain,_Model
invoke _KillThread,_dwProcessId,_Model,eax
invoke CreateRemoteThread,hProcess,NULL,0,lpFreeLibrary,_Model,0,NULL
.if eax
mov @hThread,eax
invoke WaitForSingleObject,eax,INFINITE
invoke CloseHandle,@hThread
invoke SetDlgItemText,hWinMain,IDC_MSG,offset szCRTOk
.else
invoke SetDlgItemText,hWinMain,IDC_MSG,offset szCRTErr
.endif
invoke CloseHandle,hProcess
.else
invoke SetDlgItemText,hWinMain,IDC_MSG,offset szOPErr
.endif
ret
_Out endp
_MainThread proc uses edi esi hWnd,uMsg,wParam,lParam
LOCAL @dwProcessId
mov eax,uMsg
.if eax == WM_COMMAND
mov eax,wParam
.if ax == IDC_DLL
call _OpenDll
.elseif ax ==IDC_PROCESSLIST
shr eax,16
.if ax == LBN_SELCHANGE
invoke SendDlgItemMessage,hWnd,IDC_PROCESSLIST,LB_GETCURSEL,0,0
invoke SendDlgItemMessage,hWnd,IDC_PROCESSLIST,LB_GETITEMDATA,eax,0
invoke _GetModelList,eax,hWnd,0
invoke GetDlgItem,hWnd,IDC_OUT
invoke EnableWindow,eax,FALSE
invoke SendDlgItemMessage,hWnd,IDC_MODELLIST,LB_GETCOUNT,0,0
.if eax == 0
invoke GetDlgItem,hWnd,IDC_IN
invoke EnableWindow,eax,FALSE
.else
invoke GetDlgItem,hWnd,IDC_IN
invoke EnableWindow,eax,TRUE
.endif
.endif
.elseif ax ==IDC_MODELLIST
shr eax,16
.if ax == LBN_SELCHANGE
invoke GetDlgItem,hWnd,IDC_OUT
invoke EnableWindow,eax,TRUE
.endif
.elseif ax == IDC_IN
invoke lstrlen,offset szDllName
.if eax
invoke SendDlgItemMessage,hWnd,IDC_PROCESSLIST,LB_GETCURSEL,0,0
invoke SendDlgItemMessage,hWnd,IDC_PROCESSLIST,LB_GETITEMDATA,eax,0
mov @dwProcessId,eax
invoke _Into,eax,hWnd
invoke _GetModelList,@dwProcessId,hWnd,0
.else
invoke MessageBox,hWinMain,offset szOD,offset szCaption,MB_OK
.endif
.elseif ax == IDC_OUT
invoke SendDlgItemMessage,hWnd,IDC_PROCESSLIST,LB_GETCURSEL,0,0
invoke SendDlgItemMessage,hWnd,IDC_PROCESSLIST,LB_GETITEMDATA,eax,0
mov @dwProcessId,eax
invoke SendDlgItemMessage,hWnd,IDC_MODELLIST,LB_GETCURSEL,0,0
invoke SendDlgItemMessage,hWnd,IDC_MODELLIST,LB_GETITEMDATA,eax,0
invoke _Out,@dwProcessId,eax
invoke _GetModelList,@dwProcessId,hWnd,0
.elseif ax ==IDC_UPDATE
invoke _GetProcessList,hWnd
invoke SendDlgItemMessage,hWnd,IDC_MODELLIST,LB_RESETCONTENT,0,0
invoke GetDlgItem,hWnd,IDC_IN
invoke EnableWindow,eax,FALSE
invoke GetDlgItem,hWnd,IDC_OUT
invoke EnableWindow,eax,FALSE
.elseif ax == IDC_EMAIL
invoke ShellExecute,0,0,offset szEmail,0,0,SW_SHOW
.endif
.elseif eax == WM_INITDIALOG
push hWnd
pop hWinMain
invoke LoadIcon,hInstance,ICO_MAIN
invoke SendMessage,hWnd,WM_SETICON,ICON_BIG,eax
invoke _SetWinPos,hWnd
call _EnableDebug
invoke _GetProcessList,hWnd
invoke GetDlgItem,hWnd,IDC_IN
invoke EnableWindow,eax,FALSE
invoke GetDlgItem,hWnd,IDC_OUT
invoke EnableWindow,eax,FALSE
invoke SetDlgItemText,hWinMain,IDC_MSG,offset szText
.elseif eax == WM_CLOSE
invoke EndDialog,hWnd,-1
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
_MainThread endp
start:
invoke GetModuleHandle,NULL
mov hInstance,eax
invoke DialogBoxParam,eax,IDD_MAIN,NULL,offset _MainThread,-1
invoke ExitProcess,0
end start

复制代码

幽灵屋DLL注入卸载工具.zip (148.86 KB, 下载次数: 25)

联系我时，请说是在挂海论坛上看到的，谢谢！

Fovever · 发表于 2014-7-8 15:13:58

看看...~

Amoヽ晴天 · 发表于 2014-7-22 00:17:56

我老过来打酱油的。

xl58 · 发表于 2014-8-4 01:06:05

我来赚一个谢谢！

P礼菔 · 发表于 2014-8-15 08:50:13

哦不错谢谢啊

czvv · 发表于 2014-8-24 07:19:09

不知该说些什么。。。。。。

Cuzっ · 发表于 2014-9-2 08:00:19

帮你顶....

haifon · 发表于 2014-12-23 20:22:40

传说中的沙发？？？哇卡卡

czvv · 发表于 2014-12-24 06:45:29

真是被感动的痛哭流涕……

hjwgjd · 发表于 2015-2-20 00:27:59

珍爱生命，果断回帖。

		自动登录	找回密码
密码			立即注册

玩游戏来117游戏网(H5不下载也能玩手游传奇，吃鸡，竞技都有)	不懂社区·好资源不错过·各位资源站大佬欢迎来采集搬运	IOS签名/udid证书出售/送证书加群1040456405	██【我要租此广告位】██
.	.	.	.

[分享] 幽灵屋DLL注入卸载工具【源码+程序】

免责声明：

浏览过的版块