win7 32位下实现远程线程注入

dllmain.cpp 生成注入的dll

// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "stdafx.h"
#include <Windows.h>
#define	PROCESS_NAME	"notepad.exe"

HINSTANCE	hMod;
HHOOK	hHook;
HWND	hWnd;
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
		hMod = hModule;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
LRESULT	CALLBACK	KeyBoardProc(int nCode,WPARAM wParam,LPARAM lParam)
{
	char	szPath[256] = { 0, };
	char	*p=NULL;
	if (nCode == 0)
	{
		if (!(lParam & 0x80000000))
		{
			GetModuleFileNameA(NULL, szPath, 256);
			p = strrchr(szPath, '\\');
			if (_stricmp(p + 1, PROCESS_NAME)==0)
			{
				return 1;
			}
		}
	}
	CallNextHookEx(hHook, nCode, wParam, lParam);
	return 0;
}
#ifdef __cplusplus
extern "C" {
#endif // __cplusplus
	__declspec(dllexport) void HookStart()
	{
		hHook = SetWindowsHookEx(WH_KEYBOARD, KeyBoardProc, hMod, 0);
		
	}
	__declspec(dllexport) HHOOK getHook()
	{
		return hHook;
	}
	__declspec(dllexport) void HookEnd()
	{
		if (hHook) {
			UnhookWindowsHookEx(hHook);
			hHook = NULL;
		}
	}
#ifdef __cplusplus
}
#endif // __cplusplus

MessageHook.cpp 生成MessageHook.exe加载刚刚生成的KeyHook.dll

// MessageHook.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include <stdio.h>
#include <conio.h>
#include <Windows.h>

#define	DLL_NAME	"KeyHook.dll"
#define HOOKSTART	"HookStart"
#define HOOKEND		"HookEnd"
#define GETHOOK		"getHook"
typedef	void(*pHookStart)();
typedef void(*pHookEnd)();
int main()
{
	HMODULE	hDll = NULL;
	pHookStart	HookStart = NULL;
	pHookEnd	HookEnd = NULL;
	char	ch = 0;
	hDll = LoadLibraryA(DLL_NAME);
	if (!hDll) {
		printf("Dll load failed");
		printf("press 'q' to quit\n");
		while (_getch() != 'q');
	}
	HookEnd = (pHookEnd)GetProcAddress(hDll, HOOKEND);
	HookStart = (pHookStart)GetProcAddress(hDll, HOOKSTART);
	HookStart();
	if (!HookEnd || !HookStart)
	{
		printf("getprocaddress failed\n");
		printf("%x,%x\n", HookStart, HookEnd);
		printf("press 'q' to quit\n");
		while (_getch() != 'q');
	}
	
	printf("press 'q' to quit\n");
	while (_getch() != 'q');
	HookEnd();
	FreeLibrary(hDll);
}

注入成功后记事本会输入不了数据，且notepad进程里面会有KeyHook.dll