c++ 进程注入代码

来源：互联网发布：java中int的取值范围编辑：程序博客网时间：2024/06/06 02:13

unicoce c语言变量声明要放在前面

BOOL WINAPI InjectIt(LPCTSTR DllPath, const DWORD dwRemoteProcessld)//注入主函数{    HANDLE hrp = NULL;LPTSTR psLibFileRemote = NULL; //计算LoadLibraryA的入口地址    PTHREAD_START_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE)        GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryW");  HANDLE hrt = NULL;  printf("%p\n",pfnStartAddr);    if((hrp=OpenProcess(PROCESS_CREATE_THREAD|//允许远程创建线程PROCESS_VM_OPERATION|//允许远程VM操作   PROCESS_VM_WRITE,//允许远程VM写FALSE,dwRemoteProcessld)) == NULL)    {        // OpenProcess Errorprintf("打开目标进程失败");        return FALSE;    }      printf("%0x\n",hrp);    //使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名缓冲    psLibFileRemote=(LPTSTR)VirtualAllocEx(hrp, NULL, (lstrlen(DllPath)+1)* sizeof(WCHAR),  MEM_COMMIT, PAGE_READWRITE);    if(psLibFileRemote == NULL)    {        // VirtualAllocEx Errorprintf("VirtualAllocEx Error");        return FALSE;    }printf("%p\n",psLibFileRemote);    //使用WriteProcessMemory函数将DLL的路径名复制到远程的内存空间    if(WriteProcessMemory(hrp, psLibFileRemote, (void *)DllPath, (lstrlen(DllPath)+1)* sizeof(WCHAR), NULL) == 0)    {        // WriteProcessMemory Errorprintf("WriteProcessMemory Error");        return FALSE;    }       if(pfnStartAddr == NULL)    {        // GetProcAddress Error!        return FALSE;    } printf("%p\n",pfnStartAddr);    //pfnStartAddr地址就是LoadLibraryA的入口地址      if((hrt = CreateRemoteThread(hrp,        NULL,        0,        pfnStartAddr,        psLibFileRemote,        0,        NULL)) == NULL)    {        // CreateRemote Errorprintf("创建远程线程失败");        return FALSE;    }printf("创建远程线程成功");    return TRUE;}

使用多字节字符集 c++

BOOL WINAPI InjectIt(LPCTSTR DllPath, const DWORD dwRemoteProcessld)//注入主函数{    HANDLE hrp = NULL;    if((hrp=OpenProcess(PROCESS_CREATE_THREAD|//允许远程创建线程PROCESS_VM_OPERATION|//允许远程VM操作   PROCESS_VM_WRITE,//允许远程VM写FALSE,dwRemoteProcessld)) == NULL)    {        // OpenProcess Error        return FALSE;    }    LPTSTR psLibFileRemote = NULL;    //使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名缓冲    psLibFileRemote=(LPTSTR)VirtualAllocEx(hrp, NULL, lstrlen(DllPath)+1,  MEM_COMMIT, PAGE_READWRITE);    if(psLibFileRemote == NULL)    {        // VirtualAllocEx Error        return FALSE;    }    //使用WriteProcessMemory函数将DLL的路径名复制到远程的内存空间    if(WriteProcessMemory(hrp, psLibFileRemote, (void *)DllPath, lstrlen(DllPath)+1, NULL) == 0)    {        // WriteProcessMemory Error        return FALSE;    }    //计算LoadLibraryA的入口地址    PTHREAD_START_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE)        GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");    if(pfnStartAddr == NULL)    {        // GetProcAddress Error!        return FALSE;    }    //pfnStartAddr地址就是LoadLibraryA的入口地址    HANDLE hrt = NULL;    if((hrt = CreateRemoteThread(hrp,        NULL,        0,        pfnStartAddr,        psLibFileRemote,        0,        NULL)) == NULL)    {        // CreateRemote Error        return FALSE;    }    return TRUE;}

0 0