////第一种方式，我们使用函数的形式。即我们将自己程序中的一个函数植入到远程进程中。//步骤1：首先在你的进程中创建函数MyFunc，我们将把它放在另一个进程中运行，这里以windows//计算器为目标进程。static DWORD WINAPI MyFunc (LPVOID pData){//do something//...//pData输入项可以是任何类型值//这里我们会传入一个DWORD的值做示例，并且简单返回return *(DWORD*)pData;}static void AfterMyFunc (void) {}//这里有个小技巧，定义了一个static void AfterMyFunc (void)；为了下面确定我们的代码大小//步骤2：定位目标进程，这里是一个计算器//HWND hStart = ::FindWindow (TEXT("SciCalc"),NULL); //步骤3：获得目标进程句柄，这里用到两个不太常用的函数//（当然如果经常做线程/进程等方面的 项目的话，就很面熟了），但及有用/*DWORD PID, TID;TID = ::GetWindowThreadProcessId (hStart, &PID);HANDLE hProcess;hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,PID); *///步骤4：在目标进程中配变量地址空间，这里我们分配10个字节，并且设定为可以读//写PAGE_READWRITE，当然也可设为只读等其它标志，这里就不一一说明了。/*char szBuffer[10];*(DWORD*)szBuffer=1000;//for testvoid *pDataRemote =(char*) VirtualAllocEx( hProcess, 0, sizeof(szBuffer), MEM_COMMIT,PAGE_READWRITE );*///步骤5：写内容到目标进程中分配的变量空间//::WriteProcessMemory( hProcess, pDataRemote, szBuffer,(sizeof(szBuffer),NULL);//步骤6：在目标进程中分配代码地址空间//计算代码大小/*DWORD cbCodeSize=((LPBYTE) AfterMyFunc - (LPBYTE) MyFunc);//分配代码地址空间PDWORD pCodeRemote = (PDWORD) VirtualAllocEx( hProcess, 0, cbCodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE );*///步骤7：写内容到目标进程中分配的代码地址空间//WriteProcessMemory( hProcess, pCodeRemote, &MyFunc, cbCodeSize, NULL);//步骤8：在目标进程中执行代码/*HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE) pCodeRemote,pDataRemote, 0 , NULL);DWORD h;if (hThread){::WaitForSingleObject( hThread, INFINITE );::GetExitCodeThread( hThread, &h );TRACE("run and return %d/n",h);::CloseHandle( hThread );}*//*这里有几个值得说明的地方:使用WaitForSingleObject等待线程结束;使用GetExitCodeThread获得返回值；最后关闭句柄CloseHandle。*///步骤9：清理现场/*//释放空间::VirtualFreeEx( hProcess, pCodeRemote, cbCodeSize,MEM_RELEASE );::VirtualFreeEx( hProcess, pDataRemote, cbParamSize,MEM_RELEASE );//关闭进程句柄::CloseHandle( hProcess );*/void CRemoThread1Dlg::OnButton1() {//计算器HWND hStart = ::FindWindow (NULL,"SciCalc"); DWORD PID, TID;TID = ::GetWindowThreadProcessId (hStart, &PID);HANDLE hProcess;hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,PID); char szBuffer[10];*(DWORD*)szBuffer=1000;//for testDWORD cbParamSize=sizeof(szBuffer);void *pDataRemote =(char*) VirtualAllocEx( hProcess, 0, sizeof(szBuffer), MEM_COMMIT,PAGE_READWRITE );//5::WriteProcessMemory( hProcess, pDataRemote, szBuffer,sizeof(szBuffer),NULL);//6DWORD cbCodeSize=((LPBYTE) AfterMyFunc - (LPBYTE) MyFunc);//分配代码地址空间PDWORD pCodeRemote = (PDWORD) VirtualAllocEx( hProcess, 0, cbCodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE );//7WriteProcessMemory( hProcess, pCodeRemote, &MyFunc, cbCodeSize, NULL);//8HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE) pCodeRemote,pDataRemote, 0 , NULL);DWORD h;if (hThread){::WaitForSingleObject( hThread, INFINITE );::GetExitCodeThread( hThread, &h );TRACE("run and return %d/n",h);char buff[256];sprintf(buff,"run and return %d",h);MessageBox(buff);::CloseHandle( hThread );}//9//释放空间::VirtualFreeEx( hProcess, pCodeRemote, cbCodeSize,MEM_RELEASE );::VirtualFreeEx( hProcess, pDataRemote, cbParamSize,MEM_RELEASE );//关闭进程句柄::CloseHandle( hProcess );}
