#include
// 这是一个示例字节数组，代表你的 DLL 文件的内容。// 在实际应用中，这个字节数组应该包含 DLL 文件的实际字节流。// 可以通过工具（比如 xxd 或 Python）将 DLL 转换为字节数组。const unsigned char reflectiveDll[] = {0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xB8, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,// 这里省略了大量字节，实际上你会有一个完整的 DLL 文件字节流0x00, 0x00 // DLL 结束标志（仅为示例）};
// 手动解析 PE 文件并获取函数地址void* GetProcAddressManual(HMODULE hModule, const char* functionName) {PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)hModule;PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((BYTE*)hModule + dosHeader->e_lfanew);// 获取导出表PIMAGE_EXPORT_DIRECTORY exportDirectory = (PIMAGE_EXPORT_DIRECTORY)((BYTE*)hModule + ntHeaders->OptionalHeader.DataDirectory[0].VirtualAddress);DWORD* addressOfFunctions = (DWORD*)((BYTE*)hModule + exportDirectory->AddressOfFunctions);DWORD* addressOfNames = (DWORD*)((BYTE*)hModule + exportDirectory->AddressOfNames);WORD* addressOfOrdinals = (WORD*)((BYTE*)hModule + exportDirectory->AddressOfNameOrdinals);
for (DWORD i = 0; i < exportDirectory->NumberOfNames; ++i) {const char* funcName = (const char*)((BYTE*)hModule + addressOfNames[i]);if (strcmp(funcName, functionName) == 0) {WORD ordinal = addressOfOrdinals[i];DWORD functionRVA = addressOfFunctions[ordinal];return (void*)((BYTE*)hModule + functionRVA);}}return nullptr;}
// 加载 DLL 到内存LPVOID LoadDllInMemory(const unsigned char* dllData, size_t dllSize) {// 分配内存空间LPVOID pDllBase = VirtualAlloc(NULL, dllSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);if (!pDllBase) {std::cerr << "无法分配内存" << std::endl;return nullptr;}
// 将 DLL 数据写入到内存memcpy(pDllBase, dllData, dllSize);
// 获取该 DLL 的入口地址PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)pDllBase;PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((BYTE*)pDllBase + dosHeader->e_lfanew);
// 获取 DLL 的入口点地址typedef BOOL (APIENTRY* DllMain_t)(HMODULE, DWORD, LPVOID);DllMain_t DllMainFunc = (DllMain_t)((BYTE*)pDllBase + ntHeaders->OptionalHeader.AddressOfEntryPoint);
// 执行 DLL 的入口DllMainFunc((HMODULE)pDllBase, DLL_PROCESS_ATTACH, NULL);
return pDllBase;}
int main() {// 获取 DLL 数据的大小size_t dllSize = sizeof(reflectiveDll);
// 加载 DLL 到内存LPVOID dllBase = LoadDllInMemory(reflectiveDll, dllSize);if (!dllBase) {std::cerr << "加载 DLL 到内存失败" << std::endl;return -1;}
std::cout << "反射 DLL 成功加载并执行!" << std::endl;return 0;}