无DLL远线程插入代码

 

BOOL CConcreteWGProduct::CreateRemoteThread(DWORD dwPID,LPTHREAD_START_ROUTINE pThreadFun,LPVOID pThreadParam,DWORD dwParamSize)
{
	HANDLE hPro=NULL;
	if (NULL==m_hRemoteThread)
	{
		//打开目标进程
		hPro=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPID);
		if (NULL==hPro)
			return FALSE;
		//在目标进程内分配存放线程函数起始地址的内存
		#ifdef _DEBUG
			BYTE* pF=(BYTE*)pThreadFun;		//DEBUG模式下编译器会有一个函数跳转表
			if (*pF==0xe9)	//jmp的机器码为0xE9
			{
				pF++;	
				int x=*(int*)pF;	//计算jmp后面的跳转地址
				pF+=x;				//当前地址+偏移地址
				pF+=4;				//此处内容为CC CC CC CC再加真实函数机器码,所以要跳过这4个0xCC,
			}
			pThreadFun=(LPTHREAD_START_ROUTINE)pF;
		#endif
		//写入函数机器码
		DWORD dwFuncSize=GetFuncByteSize(pThreadFun);
		LPVOID pThreadFunAdd=VirtualAllocEx(hPro,NULL,dwFuncSize,MEM_COMMIT,PAGE_READWRITE);
		if (NULL!=pThreadFunAdd)
		{
			if (!WriteProcessMemory(hPro,pThreadFunAdd,(LPCVOID)pThreadFun,dwFuncSize,NULL))
			{
				AfxMessageBox(_T("注入线程失败"));
				return FALSE;
			}
		}
		//在目标进程内分配线程参数地址
		LPVOID pThreadParamAdd=VirtualAllocEx(hPro,NULL,dwParamSize,MEM_COMMIT,PAGE_READWRITE);
		//写入参数机器码
		if (NULL!=pThreadParamAdd)
		{
			if (!WriteProcessMemory(hPro,pThreadParamAdd,(LPCVOID)pThreadParam,dwParamSize,NULL))
			{
				AfxMessageBox(_T("注入线程失败"));
				return FALSE;
			}
		}
		m_hRemoteThread=::CreateRemoteThread(hPro,NULL,0,(LPTHREAD_START_ROUTINE)pThreadFunAdd,pThreadParam,CREATE_SUSPENDED,NULL);
		StartRemoteThread();
		if (NULL!=pThreadParamAdd)
			VirtualFreeEx(hPro,pThreadParamAdd,sizeof(DWORD),MEM_RELEASE);
		if (NULL!=pThreadFunAdd)
			VirtualFreeEx(hPro,pThreadFunAdd,sizeof(DWORD),MEM_RELEASE);
		if (NULL!=hPro)
			CloseHandle(hPro);
		return TRUE;
	}
	else
		return FALSE;
}