DLL注入代码

 
  
#include < iostream >
#include
< windows.h >

using namespace ::std;

int Inject(HWND hwnd, char * name);

int main()
{
char dll[] = " F:\\Win32Dll.dll " ; // change the name to your dll
HWND hw = 0 ;

hw
= FindWindow( " DebugTest " , NULL); // change the "Notepad" to your window name
if ( ! hw)
{
cout
<< " Unable find window " << endl;
return 0 ;
}
if (Inject(hw,dll))
{
cout
<< " DLL has injected into the process successfully " << endl;
}
else
{
cout
<< " Couldn't inject DLL into process " << endl;
}
return 0 ;
}


int Inject(HWND hwnd, char * name)
{
DWORD Pid;
HANDLE hProcess,hThread;
DWORD BytesWritten;
LPVOID mem;

GetWindowThreadProcessId(hwnd,
& Pid);
hProcess
= OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);
if ( ! hProcess)
return 0 ;
mem
= VirtualAllocEx(hProcess, NULL, strlen(name), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if (mem == NULL)
{
CloseHandle(hProcess);
return 0 ;
}
if (WriteProcessMemory(hProcess, mem, (LPVOID)name, strlen(name), & BytesWritten))
{
hThread
= CreateRemoteThread(hProcess, NULL, 0 , (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle( " KERNEL32.DLL " ), " LoadLibraryA " ), mem, 0 , NULL);
if ( ! hThread)
{
VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE
| MEM_COMMIT);
CloseHandle(hProcess);
return 0 ;
}
VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE
| MEM_COMMIT);
CloseHandle(hThread);
CloseHandle(hProcess);
return 1 ;
}
VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE
| MEM_COMMIT);
CloseHandle(hProcess);

return 0 ;
}

转载于:https://www.cnblogs.com/pen-ink/archive/2011/02/02/1948810.html

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
以下是C语言代码实现DLL注入: ```c #include <Windows.h> #include <TlHelp32.h> #include <iostream> using namespace std; DWORD GetProcessID(LPCTSTR processName) { PROCESSENTRY32 pe32; HANDLE hProcessSnap; DWORD dwProcessId = 0; hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE) { cout << "CreateToolhelp32Snapshot failed.\n"; return 0; } pe32.dwSize = sizeof(PROCESSENTRY32); if (!Process32First(hProcessSnap, &pe32)) { cout << "Process32First failed.\n"; CloseHandle(hProcessSnap); return 0; } do { if (_tcscmp(pe32.szExeFile, processName) == 0) { dwProcessId = pe32.th32ProcessID; break; } } while (Process32Next(hProcessSnap, &pe32)); CloseHandle(hProcessSnap); if (dwProcessId == 0) { cout << "Cannot find the process: " << processName << endl; } return dwProcessId; } int main(int argc, char* argv[]) { TCHAR dllPath[MAX_PATH] = TEXT("DLL_PATH"); // DLL文件路径 LPCTSTR processName = TEXT("PROCESS_NAME"); // 目标进程名称 DWORD dwProcessId = GetProcessID(processName); if (dwProcessId != 0) { HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId); if (hProcess == NULL) { cout << "OpenProcess failed.\n"; return 1; } LPVOID pRemoteBuf = VirtualAllocEx(hProcess, NULL, MAX_PATH, MEM_COMMIT, PAGE_READWRITE); if (pRemoteBuf == NULL) { cout << "VirtualAllocEx failed.\n"; CloseHandle(hProcess); return 1; } if (!WriteProcessMemory(hProcess, pRemoteBuf, (LPVOID)dllPath, MAX_PATH, NULL)) { cout << "WriteProcessMemory failed.\n"; VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE); CloseHandle(hProcess); return 1; } LPTHREAD_START_ROUTINE pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryW"); HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, pRemoteBuf, 0, NULL); if (hThread == NULL) { cout << "CreateRemoteThread failed.\n"; VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE); CloseHandle(hProcess); return 1; } WaitForSingleObject(hThread, INFINITE); VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE); CloseHandle(hThread); CloseHandle(hProcess); } return 0; } ``` 代码中需要填写DLL文件路径和目标进程名称,然后通过调用GetProcessID函数获取指定进程的进程ID,最后将DLL路径写入目标进程并在其中注入代码。需要注意的是,在64位系统下编译和运行时需要开启x64平台支持。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值