c++ 进程注入代码

最新推荐文章于 2024-08-15 22:54:26 发布

az44yao

最新推荐文章于 2024-08-15 22:54:26 发布

阅读量2k

点赞数

本文链接：https://blog.csdn.net/az44yao/article/details/48088583

版权

unicoce c语言变量声明要放在前面

BOOL WINAPI InjectIt(LPCTSTR DllPath, const DWORD dwRemoteProcessld)//注入主函数
{
    HANDLE hrp = NULL;
	LPTSTR psLibFileRemote = NULL;
	 //计算LoadLibraryA的入口地址
	
    PTHREAD_START_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE)
        GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryW");

	  HANDLE hrt = NULL;

	  printf("%p\n",pfnStartAddr);
    if((hrp=OpenProcess(PROCESS_CREATE_THREAD|//允许远程创建线程
				PROCESS_VM_OPERATION|//允许远程VM操作
			   PROCESS_VM_WRITE,//允许远程VM写
				FALSE,dwRemoteProcessld)) == NULL)
    {
        // OpenProcess Error
		printf("打开目标进程失败");
        return FALSE;
    }

      printf("%0x\n",hrp);
    //使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名缓冲
    psLibFileRemote=(LPTSTR)VirtualAllocEx(hrp, NULL, (lstrlen(DllPath)+1)* sizeof(WCHAR),
								  MEM_COMMIT, PAGE_READWRITE);

    if(psLibFileRemote == NULL)
    {
        // VirtualAllocEx Error
		printf("VirtualAllocEx Error");
        return FALSE;
    }
	printf("%p\n",psLibFileRemote);
    //使用WriteProcessMemory函数将DLL的路径名复制到远程的内存空间
    if(WriteProcessMemory(hrp, psLibFileRemote, (void *)DllPath, (lstrlen(DllPath)+1)* sizeof(WCHAR), NULL) == 0)
    {
        // WriteProcessMemory Error
		printf("WriteProcessMemory Error");
        return FALSE;
    }

   

    if(pfnStartAddr == NULL)
    {
        // GetProcAddress Error!
        return FALSE;
    }

	 printf("%p\n",pfnStartAddr);
    //pfnStartAddr地址就是LoadLibraryA的入口地址


  

    if((hrt = CreateRemoteThread(hrp,
        NULL,
        0,
        pfnStartAddr,
        psLibFileRemote,
        0,
        NULL)) == NULL)
    {
        // CreateRemote Error
		printf("创建远程线程失败");
        return FALSE;
    }

	printf("创建远程线程成功");
    return TRUE;
}

使用多字节字符集 c++

BOOL WINAPI InjectIt(LPCTSTR DllPath, const DWORD dwRemoteProcessld)//注入主函数
{
    HANDLE hrp = NULL;

    if((hrp=OpenProcess(PROCESS_CREATE_THREAD|//允许远程创建线程
				PROCESS_VM_OPERATION|//允许远程VM操作
			   PROCESS_VM_WRITE,//允许远程VM写
				FALSE,dwRemoteProcessld)) == NULL)
    {
        // OpenProcess Error
        return FALSE;
    }

    LPTSTR psLibFileRemote = NULL;

    //使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名缓冲
    psLibFileRemote=(LPTSTR)VirtualAllocEx(hrp, NULL, lstrlen(DllPath)+1,
								  MEM_COMMIT, PAGE_READWRITE);

    if(psLibFileRemote == NULL)
    {
        // VirtualAllocEx Error
        return FALSE;
    }

    //使用WriteProcessMemory函数将DLL的路径名复制到远程的内存空间
    if(WriteProcessMemory(hrp, psLibFileRemote, (void *)DllPath, lstrlen(DllPath)+1, NULL) == 0)
    {
        // WriteProcessMemory Error
        return FALSE;
    }

    //计算LoadLibraryA的入口地址
    PTHREAD_START_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE)
        GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");

    if(pfnStartAddr == NULL)
    {
        // GetProcAddress Error!
        return FALSE;
    }
    //pfnStartAddr地址就是LoadLibraryA的入口地址


    HANDLE hrt = NULL;

    if((hrt = CreateRemoteThread(hrp,
        NULL,
        0,
        pfnStartAddr,
        psLibFileRemote,
        0,
        NULL)) == NULL)
    {
        // CreateRemote Error
        return FALSE;
    }
    return TRUE;
}