#include <windows.h>
#include <winsvc.h>
#include <tlhelp32.h>
// DLL注入函數
bool LoadLib(DWORD dwProcessId, LPWSTR lpszLibName)
{
HANDLE hProcess = Null;
HANDLE hThread = Null;
LPWSTR lpszRemoteFile = Null;
// 打開遠端進程
hProcess = OpenProcess(PROCESS_CREATE_THREAD
| PROCESS_VM_OPERATION
| PROCESS_VM_WRITE,
FALSE,
dwProcessId);
if (hProcess == Null)
{
MessageBox(Null, "OpenProcess failed with error " , "Error",
MB_ICONINFORMATION + MB_OK);
return FALSE;
}
// 在遠端進程中分配存貯DLL檔案名的空間
lpszRemoteFile = (LPWSTR)VirtualAllocEx(hProcess, Null,
sizeof(WCHAR) * lstrlenW(lpszLibName) + 1,
MEM_COMMIT, PAGE_READWRITE);
if (lpszRemoteFile == Null)
{
MessageBox(Null, "VirtualAllocEx failed with error " , "Error",
MB_ICONINFORMATION + MB_OK);
return FALSE;
}
// 複製DLL檔案名到遠端剛分配的進程空間
if (!WriteProcessMemory(hProcess, lpszRemoteFile,
(PVOID)lpszLibName, sizeof(WCHAR) * lstrlenW(lpszLibName) + 1,
Null))
{
MessageBox(Null, "WriteProcessMemory failed with error " , "Error",
MB_ICONINFORMATION + MB_OK);
return FALSE;
}
// 取得LoadLibrary函數在Kennel32.dll中的位址
PTHREAD_START_ROUTINE pfnThreadRtn =
(PTHREAD_START_ROUTINE)GetProcAddress(
GetModuleHandle("Kernel32.dll"),"LoadLibraryW");
if (pfnThreadRtn == Null)
{
MessageBox(Null, "GetProcAddress failed with error " , "Error",
MB_ICONINFORMATION + MB_OK);
return FALSE;
}
// 創建遠端執行緒
hThread = CreateRemoteThread(hProcess,Null,0,
pfnThreadRtn, // LoadLibrary位址
lpszRemoteFile, // 要載入的DLL名
0,
Null);
if (hThread == Null)
{
MessageBox(Null, "CreateRemoteThread failed with error " , "Error",
MB_ICONINFORMATION + MB_OK);
return FALSE;
}
// 等待中的執行緒返回
WaitForSingleObject(hThread, INFINITE);
// 釋放進程空間中的記憶體
VirtualFreeEx(hProcess, lpszRemoteFile, 0, MEM_RELEASE);
// 關閉控制碼
CloseHandle(hThread);
CloseHandle(hProcess);
return TRUE;
}
void main()
{
LPWSTR m_szDllFile = L"D://FileHook//APIHook_Dll//Debug//APIHook_Dll.dll";
DWORD m_dwProcessId = 0;
PROCESSENTRY32 pe;
// 創建快照控制碼
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
// 先搜索系統中第一個進程的資訊
Process32First(hSnapshot, &pe);
// 下面對系統中的所有進程進行枚舉，並保存其資訊
do{
if(strcmp(pe.szExeFile,"explorer.exe") == 0)
{
m_dwProcessId =pe.th32ProcessID;
break;
}
}
while(Process32Next(hSnapshot, &pe));
// 關閉快照控制碼
CloseHandle(hSnapshot);
LoadLib(m_dwProcessId, m_szDllFile);
}
全站熱搜
留言列表
