DLL注入利器Petools

shane007

最近在老外网站上又发现了一些好东西。

' G4 }$ j: l* k& e4 e; JDLL注入利器Petools是一套关于DLL注入的工具集。
将在以后的高难度汉化中派上用处。

原文
http://comrade.ownz.com/projects/petools.html
. {) {8 j' g& Z4 l4 Y
4 N9 I. L% r( m& _  Z使用方法
( a0 f. }- b  u( H/ H% d2 WInject Tool
Inject is a tool that injects a DLL into a running process. Its command-line usage is as follows:

Inject C:\hook.dll into pid 1234: inject.exe 1234 C:\hook.dll
8 O, r4 M: `6 V; R4 a$ F' k2 \Inject C:\hook.dll into process notepad.exe (if multiple notepads are running, then whichever one is picked is undefined): inject.exe -p *notepad.exe C:\hook.dll
. ~+ S% P7 l, `8 L3 f9 z  B$ F/ [Inject C:\hook.dll into running process C:\myprogram.exe: inject.exe -p C:\myprogram.exe C:\hook.dll
4 O! ~0 b' ?8 l4 N  w% J$ ]& ]& yInject C:\hook.dll into process with a window named "Untitled - Notepad": inject.exe -w "Untitled - Notepad" C:\hook.dll
Inject C:\hook.dll into process with a window class Notepad: inject.exe -c Notepad C:\hook.dll
( F* z6 {7 E$ ?+ b# uNote that in all uses, you should specify the full path to the injected DLL.

Loader Tool
+ i' G* v9 f( q" `5 |+ A4 QLoader is a tool that injects a DLL before launching a process. Its command-line usage is as follows:

. h/ i. n; D+ F* }7 t! r- z3 ]Load notepad.exe and inject C:\hook.dll into it: loader.exe notepad.exe C:\hook.dll
Note that you should specify the full path to the injected DLL.

& p% U. B5 H8 v9 PPatch Tool
/ J5 f% O" s6 @( X0 WPatch is a tool that adds a new section to the executable. The new section becomes the new entrypoint, and contains code to load a particular DLL, and then jump back to the original entrypoint. This can be used to create static patches that behave similar to the Loader tool.
The tool's command-line usage is as follows:

Patch original.exe to load C:\hook.dll before execution; save the patched executable to patched.exe: patch.exe original.exe patched.exe C:\hook.dll

1 H" l3 ?; v$ y4 S) \Reimport Tool
Reimport is a tool that redirects certain entries of an executable's import table to another DLL. For example, running reimport.exe game.exe newgame.exe nocd.dll kernel32.dll::GetDriveTypeA kernel32.dll::CreateFileA kernel32.dll::GetVolumeInformation will create a copy of game.exe into newgame.exe, with the above 3 API functions rerouted to nocd.dll, instead of kernel32.dll. That means newgame.exe would import GetDriveTypeA, CreateFileA, and GetVolumeInformation from nocd.dll instead of kernel32.dll.