Win8.1下的 Dll注入测试

来源：互联网发布：教育部网络培训中心编辑：程序博客网时间：2024/05/14 23:50

1，OpenProcess获得要注入进程的句柄2，VirtualAllocEx在远程进程中开辟出一段内存，3，WriteProcessMemory将Dll的名字写入第二步开辟出的内存中。4，CreateRemoteThread将LoadLibraryW作为线程函数，参数为Dll的名称，创建新线程5，CloseHandle关闭线程句柄

<pre name="code" class="cpp">效果如图所示：

效果如图所示：<img src="http://img.blog.csdn.net/20150608131602100?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />

<img src="http://img.blog.csdn.net/20150608131622245?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />

<img src="http://img.blog.csdn.net/20150608131647044?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />

void CMFCApplication5Dlg::OnBnClickedButton1(){CEdit* pBoxOne;CEdit* pBoxTwo;pBoxOne = (CEdit*)GetDlgItem(IDC_EDIT1);pBoxTwo = (CEdit*)GetDlgItem(IDC_EDIT2);CString szDllName;CString szPid;pBoxOne->GetWindowText(szDllName);pBoxTwo->GetWindowText(szPid);MessageBox(szDllName, _T("DllNmae"), MB_OK);MessageBox(szPid, _T("Pid"), MB_OK);DWORD dwPid = 0;dwPid = _ttoi(szPid);WCHAR *buffer = (WCHAR*)szDllName.GetBuffer(szDllName.GetLength());int bufsize = _tcslen(buffer)*sizeof(WCHAR)+sizeof(WCHAR);DWORD dwWriteNum = 0;HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);if (hProcess == NULL){AfxMessageBox(L"get Handle error!");}    PVOID Addr = VirtualAllocEx(hProcess, NULL, bufsize, MEM_COMMIT, PAGE_READWRITE);if (Addr == NULL){AfxMessageBox(L"get Addr error!");}else AfxMessageBox(TEXT("申请成功"));if (!WriteProcessMemory(hProcess, Addr, buffer, bufsize, &dwWriteNum)){AfxMessageBox(TEXT("写入失败"));}else AfxMessageBox(TEXT("写入成功"));if (!GetModuleHandle(L"Kernel32.dll")){AfxMessageBox(TEXT("获取失败"));}FARPROC pFunAddr = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryW");if (!pFunAddr){AfxMessageBox(TEXT("GetProcAddress获取失败"));}DWORD dwNewThreadId = NULL;HANDLE hThread = CreateRemoteThreadEx(hProcess, NULL, 0,(LPTHREAD_START_ROUTINE)pFunAddr, Addr, 0, NULL, &dwNewThreadId);if (dwNewThreadId == NULL){ AfxMessageBox(TEXT("注入失败")); }else AfxMessageBox(TEXT("成功注入"));CloseHandle(hThread);CloseHandle(hProcess);CDialogEx::OnOK();}

0 0