远程注入代码示例

MyPluginDemo.cpp

#include "stdafx.h"#include <iostream>#include <Windows.h>#include <TlHelp32.h>using namespace std;DWORD GetProcessId(LPCSTR lpszProcessName) {    // 创建进程快照句柄      HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);      DWORD dwPid = NULL;      PROCESSENTRY32 ProcessEntry;      // 查找第一个进程      ProcessEntry.dwSize = sizeof(PROCESSENTRY32);      Process32First(hProcessSnap, &ProcessEntry);      // 遍历进程获取 PID      do     {         if(!stricmp(ProcessEntry.szExeFile, lpszProcessName))         {              dwPid = ProcessEntry.th32ProcessID;              break;          }      }     while(Process32Next(hProcessSnap, &ProcessEntry));      // 清理现场      if(!dwPid)     {             return false;      }     CloseHandle(hProcessSnap);      return dwPid;  }int main(int argc, char ** argv){    // 线程栈大小      const DWORD dwThreadSize = 1024;    // 获取指定映像的 PID      DWORD dwProcessId = false;      dwProcessId = GetProcessId("VisionMaster.exe");      if (!dwProcessId){          return 0;    }      // 定义远程进程句柄并打开该进程      HANDLE hRemoteProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);      if (!hRemoteProcess)    {        return 0;    }    LPVOID pFunc = LoadLibrary;    LPVOID pRemoteParam = VirtualAllocEx(hRemoteProcess, NULL, strlen("MyPlugin.dll") + 1, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);      if (!pRemoteParam)     {        return 0;    }    BOOL bWrite = WriteProcessMemory(hRemoteProcess, (LPVOID)pRemoteParam, "MyPlugin.dll", strlen("MyPlugin.dll") + 1, 0);    if (!bWrite)    {        return 0;    }    HANDLE hRemoteThread = CreateRemoteThread(hRemoteProcess, NULL, 0, (LPTHREAD_START_ROUTINE)(pFunc), pRemoteParam, 0, NULL);      if (!hRemoteThread)     {        return 0;    }    getchar();    return 0;}

MyPlugin.cpp

// dllmain.cpp : Defines the entry point for the DLL application.#include "stdafx.h"#include <Windows.h>HMODULE g_hModule                       = NULL;void *(* zmq_ctx_new) (void)            = NULL;void (__stdcall * IMVS_SetMaxSeverity)(const unsigned int nMaxSeverity) = NULL;BOOL APIENTRY DllMain( HMODULE hModule,                       DWORD  ul_reason_for_call,                       LPVOID lpReserved){    switch (ul_reason_for_call)    {    case DLL_PROCESS_ATTACH:        {            OutputDebugString("成功加载MyPlugin.dll");            g_hModule = LoadLibraryEx("./PublicFile/x86/iMVS-6000SDK4Server.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH);            if (NULL == g_hModule)            {                return FALSE;            }            IMVS_SetMaxSeverity = (void (__stdcall *)(const unsigned int))GetProcAddress(g_hModule,"IMVS_SetMaxSeverity");            if (NULL == IMVS_SetMaxSeverity)            {                return FALSE;            }            OutputDebugString("成功加载iMVS-6000SDK4Server.dll");            IMVS_SetMaxSeverity(0);            OutputDebugString("成功设置日志打印级别");        }        break;    case DLL_THREAD_ATTACH:        {        }        break;    case DLL_THREAD_DETACH:        {        }        break;    case DLL_PROCESS_DETACH:        {        }        break;    }    return TRUE;}