初学C++ 远程线程注入DLL与卸载

//提升权限
void DebugPrivilege()
{
 HANDLE hToken = NULL;
 //打开当前进程的访问令牌
 int hRet = OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken);
 if( hRet)
 {
  TOKEN_PRIVILEGES tp;
  tp.PrivilegeCount = 1;
  //取得描述权限的LUID
  LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid);
  tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
  //调整访问令牌的权限
  AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);
  CloseHandle(hToken);
 }
}
void InpouringDll()//注入
{
WCHAR *DllName = _T("C:\\Users\\yjip\\Documents\\Visual Studio 2008\\Projects\\tetst\\Debug\\TestDLL.dll");
DWORD ProcessID = GetProcessIdByName(L"notepad.exe");//得到进程ID//explorer
DebugPrivilege();
HANDLE ht = OpenProcess(PROCESS_ALL_ACCESS,FALSE,ProcessID);//得到进程句柄//PROCESS_VM_OPERATION|PROCESS_VM_WRITE
    DWORD DNLeng = wcslen(DllName)*2+sizeof(WCHAR);//DLL名子的长度以\0结尾
//参数意思1申请内存所在进程句柄2保留页面的内存地址一般NULL3内存大小字节 
//4 MEM_COMMIT为特定的页面区域分配内存中或磁盘的页面文件 中的物理存储
//5 PAGE_READWRITE 可被应用程序读写
PVOID pDLLAdd = VirtualAllocEx(ht,NULL,DNLeng,MEM_COMMIT,PAGE_READWRITE);//在目标进程中分配内存
if (pDLLAdd == NULL)
{
CloseHandle(ht);
return;
}
DWORD dwWriteNum = 0;//实际写入的字节数
//参数 1进程句柄 2要写入的内存首地址 3 DLL名子 4 名子长度 5实际要写的大小 
BOOL br = WriteProcessMemory(ht,pDLLAdd,DllName,DNLeng,&dwWriteNum);//写入某一进程的内存区域kernel32.dll
char *FunName = "LoadLibraryW";
FARPROC pFunAddr = /*(PTHREAD_START_ROUTINE)*/GetProcAddress(GetModuleHandle(_T("kernel32.dll")),FunName);
DWORD DWID = 0;
HANDLE hThread = CreateRemoteThread(ht,NULL,0,(LPTHREAD_START_ROUTINE)pFunAddr,pDLLAdd,0,&DWID);
    WaitForSingleObject(hThread,INFINITE);
CloseHandle(hThread);
CloseHandle(ht);
}
void UninstallDll()
{
WCHAR *DllName = _T("C:\\Users\\yjip\\Documents\\Visual Studio 2008\\Projects\\tetst\\Debug\\TestDLL.dll");
DWORD ProcessID = GetProcessIdByName(L"notepad.exe");//得到进程ID//explorer
DebugPrivilege();
HANDLE hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,ProcessID);
MODULEENTRY32 me32 = {0};
me32.dwSize = sizeof(MODULEENTRY32);
BOOL bRet = Module32First(hsnap,&me32);
while(bRet)
{
if (wcscmp(me32.szExePath,DllName) == 0)
{
break;
}
bRet = Module32Next(hsnap,&me32);
}
CloseHandle(hsnap);
char *FunName = "FreeLibrary";
DebugPrivilege();
HANDLE ht = OpenProcess(PROCESS_ALL_ACCESS,FALSE,ProcessID);//得到进程句柄//PROCESS_VM_OPERATION|PROCESS_VM_WRITE
    FARPROC pFunAddr = GetProcAddress(GetModuleHandle(_T("kernel32.dll")),FunName);
DWORD DWID = 0;
DWID = GetLastError();
HANDLE hThread = CreateRemoteThread(ht,NULL,0,(LPTHREAD_START_ROUTINE)pFunAddr,me32.hModule,0,&DWID);
WaitForSingleObject(hThread,INFINITE);
CloseHandle(hThread);
CloseHandle(ht);
}