DLL注入利器Petools

shane007

最近在老外网站上又发现了一些好东西。
4 e2 w* Q7 V" B# u0 A7 m5 ^* e
* s( O  {; ^( B6 m) s/ IDLL注入利器Petools是一套关于DLL注入的工具集。
将在以后的高难度汉化中派上用处。
' \, w5 j7 P5 B$ g% @1 w: T# S4 b! d
原文
http://comrade.ownz.com/projects/petools.html
8 J0 n4 r1 s4 E# l: y4 D
使用方法
8 i( }- O) a; t) AInject Tool
Inject is a tool that injects a DLL into a running process. Its command-line usage is as follows:
9 ~) m. ?! X# {2 v: @5 b
2 s( k6 @, C% D# eInject C:\hook.dll into pid 1234: inject.exe 1234 C:\hook.dll
Inject C:\hook.dll into process notepad.exe (if multiple notepads are running, then whichever one is picked is undefined): inject.exe -p *notepad.exe C:\hook.dll
( E# D6 G( P) h, `0 s$ q+ jInject C:\hook.dll into running process C:\myprogram.exe: inject.exe -p C:\myprogram.exe C:\hook.dll
, T: Q, t( I/ dInject C:\hook.dll into process with a window named "Untitled - Notepad": inject.exe -w "Untitled - Notepad" C:\hook.dll
6 Y+ w/ Q+ B. W( q6 U2 ^2 WInject C:\hook.dll into process with a window class Notepad: inject.exe -c Notepad C:\hook.dll
Note that in all uses, you should specify the full path to the injected DLL.

. L5 ?, H3 d( S; E! ILoader Tool
- D: y; J" B& k# d1 h$ r: qLoader is a tool that injects a DLL before launching a process. Its command-line usage is as follows:
" r7 A6 j% X# H* T6 P; a: \
Load notepad.exe and inject C:\hook.dll into it: loader.exe notepad.exe C:\hook.dll
9 l& Q' ?2 j" c/ R- G1 `/ B& v6 kNote that you should specify the full path to the injected DLL.
) N$ r5 [  r9 c( I, i7 g
Patch Tool
* u# |9 m7 q/ v: `  ]Patch is a tool that adds a new section to the executable. The new section becomes the new entrypoint, and contains code to load a particular DLL, and then jump back to the original entrypoint. This can be used to create static patches that behave similar to the Loader tool.
The tool's command-line usage is as follows:
' Z! {2 L) @, s/ o+ a0 a; X9 V/ L
Patch original.exe to load C:\hook.dll before execution; save the patched executable to patched.exe: patch.exe original.exe patched.exe C:\hook.dll

  N  ?0 r" A+ c! X. J6 }/ rReimport Tool
/ u$ ^9 R) ^, M) s  Z5 T  I2 B! vReimport is a tool that redirects certain entries of an executable's import table to another DLL. For example, running reimport.exe game.exe newgame.exe nocd.dll kernel32.dll::GetDriveTypeA kernel32.dll::CreateFileA kernel32.dll::GetVolumeInformation will create a copy of game.exe into newgame.exe, with the above 3 API functions rerouted to nocd.dll, instead of kernel32.dll. That means newgame.exe would import GetDriveTypeA, CreateFileA, and GetVolumeInformation from nocd.dll instead of kernel32.dll.