C++ 实现DLL注入（一）实现

直接上代码了

//FMethod.h
#pragma once
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>

int FMethod(char * c_str);

BOOL LoadDll(DWORD dwProcessId,LPTSTR lpszDllName);//FMethod.cpp
#include "FMethod.h"

int FMethod(char * c_str)
{
//打开 c_str 指定名字的进程，如calc.exe计算器
ShellExecute(NULL,"open",c_str,NULL,NULL,SW_NORMAL);
//指定要加载的DLL，之前要先写好
char lpDllName[MAX_PATH] = TEXT("helloword.dll");

// 枚举进程，得到指定进程ID
PROCESSENTRY32 ProcessEntry = { 0 };
HANDLE hProcessSnap;
ProcessEntry.dwSize = sizeof(PROCESSENTRY32);

hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
BOOL bRet = Process32First(hProcessSnap,&ProcessEntry);
while(bRet)
{ // 判断进程是否为 calc.exe
if(strcmp(c_str,ProcessEntry.szExeFile) == 0)
{
// 让指定的进程加载DLL
LoadDll(ProcessEntry.th32ProcessID,lpDllName);
break;
}
bRet = Process32Next(hProcessSnap,&ProcessEntry);
}
return 0;
}

// 让指定的进程加载DLL
BOOL LoadDll(DWORD dwProcessId,LPTSTR lpszDllName)
{
HANDLE hProcess = NULL;
HANDLE hThread = NULL;
PSTR pszDllFile = NULL;

// 打开进程
hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessId);
if(hProcess == NULL)
{
printf("打开进程 %d 失败!\n\n",dwProcessId);
return FALSE;
}
printf("打开进程 %d 成功!\n\n",dwProcessId);

// 分配远程空间
int cch = 1 + strlen(lpszDllName);
pszDllFile = (PSTR)VirtualAllocEx(hProcess,
NULL,
cch,
MEM_COMMIT,
PAGE_READWRITE);
if(pszDllFile == NULL)
return FALSE;
printf("分配远程空间成功!\n\n");

// 把DLL的名字变量地址写入到远程空间中
if((WriteProcessMemory(hProcess,
(PVOID)pszDllFile,
(PVOID)lpszDllName,
cch,
NULL)) == FALSE)
{
return FALSE;
}
printf("写远程内存成功!\n\n");

// 获取远程进程地址空间中LoadLibrary函数的地址
PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32"),"LoadLibraryA");
//因为在同一个系统中，这这LoadLibraryA地址是一样的，这下面这种都可行
//PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)LoadLibraryA;
if(pfnThreadRtn == NULL)
return FALSE;
printf("获取LoadLibrary函数地址成功!\n\n");

// 创建远程线程
hThread = CreateRemoteThread(hProcess,
NULL,
0,
pfnThreadRtn,
(PVOID)pszDllFile,
0,
NULL);
if(hThread == NULL)
return FALSE;
printf("创建远程线程成功!\n\n");
// 等待远程线程执行结束，并非必要
//system("pause");
WaitForSingleObject(hThread,INFINITE);

VirtualFreeEx(hProcess,(PVOID)pszDllFile,0,MEM_RELEASE);
CloseHandle(hThread);
CloseHandle(hProcess);

return TRUE;
}

//main.cpp
#include <stdio.h>
#include "FMethod.h"

int main()
{
// 要注入的进程
FMethod("calc.exe");
system("pause");
return 0;
}