远程线程DLL注入

在其他进程中，创建一个新的线程来LoadLibraryA我们的Dll。

/*作者：sysprogram
编写日期：2011年4月2日
博客：http://hi.csdn.net/SysProgram

*/

#include <windows.h>
#include <stdio.h>

void main()
{
//打开进程句柄
HANDLE hProcess;
hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,1956);
if (hProcess == NULL)
{
printf("Open Process error/n");
return;
}

//给进程分配内存
LPVOID BaseAddress;
char *strDllName = {"C://dlltest.dll"};
int len = strlen(strDllName) + 1;
BaseAddress = VirtualAllocEx(hProcess,NULL,len,MEM_COMMIT,PAGE_READWRITE);

//写进程内存
if (WriteProcessMemory(hProcess,BaseAddress,strDllName,len,NULL) == false)
{
printf("Write Memory error/n");
return;
}

//创建远程线程
FARPROC ProcAddress;
HMODULE hModule = GetModuleHandle("Kernel32.dll");
ProcAddress = GetProcAddress(hModule,"LoadLibraryA");

HANDLE hThread;
hThread = CreateRemoteThread(hProcess,
NULL,
0,
(LPTHREAD_START_ROUTINE)ProcAddress,
BaseAddress,
0,
NULL);

//等待线程完成
WaitForSingleObject(hThread,INFINITE);

//释放内存，关闭句柄
VirtualFreeEx(hProcess,BaseAddress,0,MEM_RELEASE);
CloseHandle(hThread);
CloseHandle(hProcess);

}