创建远程线程

来源：互联网发布：阿里云ca证书安装编辑：程序博客网时间：2024/05/16 23:02

#include <windows.h>
#include <tlhelp32.h>

char* pszlibfilename = "D://dllT.dll";
DWORD GetProcessIdFromName(LPCTSTR name)
{
PROCESSENTRY32 pe;
DWORD id = 0;
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
pe.dwSize = sizeof(PROCESSENTRY32);
if( !Process32First(hSnapshot,&pe) )
  return 0;
do
{
  pe.dwSize = sizeof(PROCESSENTRY32);
  if( Process32Next(hSnapshot,&pe)==FALSE )
   break;
  if(strcmp(pe.szExeFile,name) == 0)
  {
   id = pe.th32ProcessID;
   break;
  }
} while(1);
CloseHandle(hSnapshot);
return id;
}

void main()
{
HINSTANCE hinstDLL=NULL;
DWORD dwremoteprocessid = GetProcessIdFromName("ipmsg.exe");
HANDLE h = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,
false, dwremoteprocessid );

if(h==NULL){

  return;
}
int   cb = (1 + strlen(pszlibfilename)) * sizeof(char);
char* pszlibfileremote = (char*)VirtualAllocEx( h, NULL, cb,MEM_COMMIT,PAGE_READWRITE);

BOOL b   =   WriteProcessMemory(h,(void *)pszlibfileremote,
     (PVOID)pszlibfilename, cb, NULL);
if(b==FALSE){
  return;
}

LPTHREAD_START_ROUTINE pfnstartaddr=(LPTHREAD_START_ROUTINE )
GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryA");

HANDLE thrH = CreateRemoteThread(h,NULL,0, pfnstartaddr,pszlibfileremote,0,NULL);
if(thrH ==NULL)
return;

FreeLibrary(hinstDLL);
CloseHandle(h);
CloseHandle(thrH);

}