DLL注入(CreateRemoteThread方式)

CreateRemoteThread即在当前已有进程中创建新的线程。

从32位进程注入dll到32位进程的步骤如下：

1.OpenProcess 打开已有进程

2.VirtualAllocEx分配空间给它

3.获取LoadLibraryW的地址

4.WriteProcessMemory 写进内存空间

5.CreateRemoteThread实现注入

 

代码如下：

//32位程序注入到32位程序
//@param:dwPid:需要注入程序的进程pid
//@param:dllpath:注入的dll的路径
//return:True:注入成功,False:注入失败
bool injectDll32To32(DWORD dwPid,LPCTSTR dllpath)
{
	//Step 1: oepn destination process
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,dwPid);
	
	//get dllpath length
	DWORD dwBufSize = (DWORD)(_tcslen(dllpath)+1)*sizeof(TCHAR);

	//Step2:VirtualAlloc space for the process
	LPVOID targetAddress = VirtualAllocEx(hProcess,0,dwBufSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

	//Step3:Get LoadLibraryW Address
	LPTHREAD_START_ROUTINE pfnThreadRtn = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(_T("Kernel32")), "LoadLibraryW");

	//Step4:ChangePageProtection
	DWORD oldProtect	= 0;	
	VirtualProtectEx(hProcess,targetAddress,dwBufSize,PAGE_EXECUTE_READWRITE,&oldProtect);

	//Step5:WriteProcessMemory
	DWORD bytesRet= 0;
	if (!WriteProcessMemory(hProcess,targetAddress,(LPVOID)dllpath,dwBufSize,&bytesRet))
	{
		return false;
	}

	//Restore Oral 
	VirtualProtectEx(hProcess,targetAddress,dwBufSize,oldProtect,&oldProtect);

	//Step6:CreateRemoteThread
	HANDLE hThread = CreateRemoteThread(hProcess,NULL,0,pfnThreadRtn,targetAddress,0,NULL );
	if (!hThread)
	{
		return false;
	}

	WaitForSingleObject(hThread,INFINITE);
	return true;
}

 

64位注入32位 32注入64位 64注入64 等后面有时间再写

源码在这：https://github.com/huifeng-kooboo/InjectDll