c++ 进程注入代码

BOOL WINAPI InjectIt(LPCTSTR DllPath, const DWORD dwRemoteProcessld)//注入主函数
{
HANDLE hrp = NULL;
LPTSTR psLibFileRemote = NULL;
//计算LoadLibraryA的入口地址

PTHREAD_START_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE)
GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryW");

HANDLE hrt = NULL;

printf("%p\n",pfnStartAddr);
if((hrp=OpenProcess(PROCESS_CREATE_THREAD|//允许远程创建线程
PROCESS_VM_OPERATION|//允许远程VM操作
PROCESS_VM_WRITE,//允许远程VM写
FALSE,dwRemoteProcessld)) == NULL)
{
// OpenProcess Error
printf("打开目标进程失败");
return FALSE;
}

printf("%0x\n",hrp);
//使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名缓冲
psLibFileRemote=(LPTSTR)VirtualAllocEx(hrp, NULL, (lstrlen(DllPath)+1)* sizeof(WCHAR),
MEM_COMMIT, PAGE_READWRITE);

if(psLibFileRemote == NULL)
{
// VirtualAllocEx Error
printf("VirtualAllocEx Error");
return FALSE;
}
printf("%p\n",psLibFileRemote);
//使用WriteProcessMemory函数将DLL的路径名复制到远程的内存空间
if(WriteProcessMemory(hrp, psLibFileRemote, (void *)DllPath, (lstrlen(DllPath)+1)* sizeof(WCHAR), NULL) == 0)
{
// WriteProcessMemory Error
printf("WriteProcessMemory Error");
return FALSE;
}

if(pfnStartAddr == NULL)
{
// GetProcAddress Error!
return FALSE;
}

printf("%p\n",pfnStartAddr);
//pfnStartAddr地址就是LoadLibraryA的入口地址

if((hrt = CreateRemoteThread(hrp,
NULL,
0,
pfnStartAddr,
psLibFileRemote,
0,
NULL)) == NULL)
{
// CreateRemote Error
printf("创建远程线程失败");
return FALSE;
}

printf("创建远程线程成功");
return TRUE;
}

BOOL WINAPI InjectIt(LPCTSTR DllPath, const DWORD dwRemoteProcessld)//注入主函数
{
HANDLE hrp = NULL;

if((hrp=OpenProcess(PROCESS_CREATE_THREAD|//允许远程创建线程
PROCESS_VM_OPERATION|//允许远程VM操作
PROCESS_VM_WRITE,//允许远程VM写
FALSE,dwRemoteProcessld)) == NULL)
{
// OpenProcess Error
return FALSE;
}

LPTSTR psLibFileRemote = NULL;

//使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名缓冲
psLibFileRemote=(LPTSTR)VirtualAllocEx(hrp, NULL, lstrlen(DllPath)+1,
MEM_COMMIT, PAGE_READWRITE);

if(psLibFileRemote == NULL)
{
// VirtualAllocEx Error
return FALSE;
}

//使用WriteProcessMemory函数将DLL的路径名复制到远程的内存空间
if(WriteProcessMemory(hrp, psLibFileRemote, (void *)DllPath, lstrlen(DllPath)+1, NULL) == 0)
{
// WriteProcessMemory Error
return FALSE;
}

//计算LoadLibraryA的入口地址
PTHREAD_START_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE)
GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");

if(pfnStartAddr == NULL)
{
// GetProcAddress Error!
return FALSE;
}
//pfnStartAddr地址就是LoadLibraryA的入口地址

HANDLE hrt = NULL;

if((hrt = CreateRemoteThread(hrp,
NULL,
0,
pfnStartAddr,
psLibFileRemote,
0,
NULL)) == NULL)
{
// CreateRemote Error
return FALSE;
}
return TRUE;
}