一个远程注入的例子(让本机的所有程序弹出一个sylar对话框)

1#include"stdafx.h"
2#include"windows.h"
3#include"stdio.h"
4#include<Tlhelp32.h.>
5 /*熊健
62009.12.23 武汉
[e-mail]
8/////////////////////////////////////////////*/
9 // ========== 定义一个代码结构,本例为一个对话框============
10struct MyData
11{
12char sz[64];// 对话框显示内容
13DWORD dwMessageBox;// 对话框的地址
14};
15
16// ========== 远程线程的函数 ==============================
17DWORD __stdcall RMTFunc(MyData *pData)
18{
19typedefint(__stdcall*MMessageBox)(HWND,LPCTSTR,LPCTSTR,UINT);
20MMessageBox MsgBox= (MMessageBox)pData->dwMessageBox;
21MsgBox(NULL, pData->sz, NULL, MB_OK);
22return0;
23}
24
25int inject(DWORD dwProcessId)
26{
27HANDLE hProcess= OpenProcess(
28PROCESS_ALL_ACCESS,
29FALSE,
30dwProcessId);
31
32// ========= 代码结构 ================================================
33MyData data;
34ZeroMemory(&data,sizeof (MyData));
35strcat(data.sz,"sylar");
36HINSTANCE hUser= LoadLibrary("user32.dll");
37if (! hUser)
38{
39printf("Can not load library.\n");
40return0;
41}
42data.dwMessageBox= (DWORD)GetProcAddress(hUser,"MessageBoxA");
43FreeLibrary(hUser);
44if (! data.dwMessageBox)
45return0;
46
47// ======= 分配空间 ===================================================
48void*pRemoteThread
49= VirtualAllocEx(hProcess, 0,
501024*4, MEM_COMMIT|MEM_RESERVE,
51PAGE_EXECUTE_READWRITE);
52if (! pRemoteThread)
53return0;
54if (! WriteProcessMemory(hProcess, pRemoteThread, &RMTFunc,1024*4,0))
55return0;
56
57MyData*pData
58= (MyData*)VirtualAllocEx(hProcess,0,
59sizeof (MyData), MEM_COMMIT,
60PAGE_READWRITE);
61if (!pData)
62return0;
63
64if (! WriteProcessMemory(hProcess, pData, &data,sizeof (MyData),0))
65return0;
66
67// =========== 创建远程线程 ===========================================
68HANDLE hThread
69= CreateRemoteThread(hProcess, 0,
700, (LPTHREAD_START_ROUTINE)pRemoteThread,
71pData,0,0);
72if (! hThread)
73{
74printf("远程线程创建失败");
75return0;
76}
77CloseHandle(hThread);
78VirtualFreeEx(hProcess, pRemoteThread,1024*3, MEM_RELEASE);
79VirtualFreeEx(hProcess, pData,sizeof (MyData), MEM_RELEASE);
80CloseHandle(hProcess);
81printf("Hello World!\n");
82return1;
83}
84
85int main(int argc,char* argv[])
86{
87// ===== 获得需要创建REMOTETHREAD的进程句柄 ===============================
88//or
89HANDLE hSnapshot= NULL;
90hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
91PROCESSENTRY32 pe;
92pe.dwSize=sizeof(PROCESSENTRY32);
93Process32First(hSnapshot,&pe);
94do
95{
96//if(stricmp(pe.szExeFile,"NOTEPAD.EXE")==0)
97// {
98inject(pe.th32ProcessID);
99// break;
100// }
101}
102while(Process32Next(hSnapshot,&pe)==TRUE);
103CloseHandle (hSnapshot);
104/*
105HWND hWnd = FindWindow("notepad", NULL); // 以NOTEPAD为例
106DWORD dwProcessId;
107::GetWindowThreadProcessId(hWnd, &dwProcessId);
108inject(dwProcessId);
109*/
110return0;
111}
112
113