根据进程名查找进程ID，向远程线程写数据

#include “stdafx.h”
#include “tlhelp32.h”
#define PROCESSNAME “NOTEPAD.EXE”
#define DLLPATH “D:\\dustbin.dll”

LPVOID pathAddress;

//根据进程名查找进程ID
DWORD FindProcess(LPCTSTR str)
{
DWORD id = 0;
PROCESSENTRY32 processEntry;
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

processEntry.dwSize = sizeof(PROCESSENTRY32);

BOOL bRet = Process32First(hProcessSnap, &processEntry);

while (bRet)
{
if ( !strcmp(processEntry.szExeFile, str) )
{
id = processEntry.th32ProcessID;
break;
}
bRet = Process32Next(hProcessSnap, &processEntry);
}

return id;
}
//向远程线程写数据
HANDLE WriteStringToProcess(LPCTSTR pathStr, DWORD id, DWORD size)
{
size = strlen(pathStr) + 1;

HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, id);
if (NULL == hProcess)
{
CloseHandle(hProcess);
return NULL;
}

pathAddress = VirtualAllocEx(hProcess, NULL, size, MEM_COMMIT, PAGE_READWRITE);
if (NULL == pathAddress)
{
CloseHandle(hProcess);
return NULL;
}

DWORD dwJudge = NULL;
BOOL iYON = WriteProcessMemory(hProcess, pathAddress, (LPVOID)pathStr, size, &dwJudge);
if (0 == iYON || 0 == dwJudge)
{
CloseHandle(hProcess);
return NULL;
}

return hProcess;
}

//主函数
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{

DWORD dwProcessID = FindProcess(PROCESSNAME);
if (!dwProcessID)
{
MessageBox(0, “error with find process!”, “fail”, MB_OK);
return 1;
}
DWORD dwSize = 0;
HANDLE hProcess = WriteStringToProcess(DLLPATH, dwProcessID, dwSize);
if (!hProcess)
{
MessageBox(0, “error with writing!”, “fail”, MB_OK);
return 1;
}

HANDLE tRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pathAddress, 0, 0);

WaitForSingleObject(tRemoteThread, INFINITE);

VirtualFreeEx(hProcess, pathAddress, dwSize, MEM_DECOMMIT);
CloseHandle(tRemoteThread);
CloseHandle(hProcess);
return 0;
}