CreateRemoteThread远程注入 使用例子

// CreateRemoteThread 使用 关闭远程进程句柄 processID远程进程的进程ID  handle远程进程的进程句柄
CloseRemoteHandle( DWORD processID, HANDLE handle )
... {
    HANDLE ht = 0;
    DWORD rc = 0;

    // open the process
    HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE|PROCESS_VM_READ,    FALSE, processID );

    if ( hProcess == NULL )
    ...{
        rc = GetLastError();
        MessageBox( _T("OpenProcess() failed ") );
        return rc;
    }

    // load kernel32.dll
    HMODULE hKernel32 = LoadLibrary( _T("kernel32.dll") );

    // CreateRemoteThread()
    ht = CreateRemoteThread(
        hProcess,
        0,
        0,
     (DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"CloseHandle"),
        handle,
        0,
        &rc );

    if ( ht == NULL )
    ...{
        //Something is wrong with the privileges, or the process doesn't like us
        rc = GetLastError();
        MessageBox( _T("CreateRemoteThread() failed ") );

        //Free up the kernel32.dll
        FreeLibrary( hKernel32 );
        CloseHandle( hProcess );
    }

    switch ( WaitForSingleObject( ht, 2000 ) )
    ...{
    case WAIT_OBJECT_0:
        //Well done
        rc = 0;
        MessageBox( _T("Ok "));
        break;

    default:
        //Oooops, shouldn't be here
        rc = GetLastError();
        MessageBox( _T("WaitForSingleObject() failed ") );
        break;
    }

    //Closes the remote thread handle
    CloseHandle( ht );

    //Free up the kernel32.dll
    if ( hKernel32 != NULL)
        FreeLibrary( hKernel32 );

    //Close the process handle
    CloseHandle( hProcess );

    return rc;
}


// CreateRemoteThread 使用 释放远程dll句柄  processID占用dll的远程进程的进程ID  lpDllPath dll路径
CloseRemoteDll( DWORD processID, LPCTSTR lpDllPath )
... {
    HANDLE ht = 0;
    DWORD rc = 0;
    DWORD dwHandle;   

    HANDLE hProcess;
    hProcess= OpenProcess(PROCESS_CREATE_THREAD | //允许远程创建线程  
                  PROCESS_VM_OPERATION | //允许远程VM操作 
                  PROCESS_VM_WRITE,     //允许远程VM写
                  FALSE, processID );

    if ( hProcess == NULL )
    ...{
        rc = GetLastError();
    //MessageBox( _T("OpenProcess() failed ") );
        return rc;
    }

    HMODULE hKernel32 = LoadLibrary("kernel32.dll");

    //向目标进程地址空间写入DLL名称   
    DWORD   dwSize,   dwWritten;   
    CString str;
    str=lpDllPath;
    dwSize=str.GetLength()+1;

    LPVOID lpBuf = VirtualAllocEx(hProcess,NULL,dwSize, MEM_COMMIT, PAGE_READWRITE );   

    if(!WriteProcessMemory(hProcess,lpBuf,(LPVOID)lpDllPath, dwSize,&dwWritten))   
    ...{   
        rc=GetLastError();
        VirtualFreeEx(hProcess,lpBuf,dwSize,MEM_DECOMMIT);   
        CloseHandle(hProcess);   
        return rc;   
    }   

    HANDLE  hThread = CreateRemoteThread(hProcess, NULL, 0,
         (DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"GetModuleHandleA"),
             lpBuf ,0, NULL);  

    if(hThread  == NULL)   
    ...{   
        rc=GetLastError();
        CloseHandle(hProcess);   
        return rc ;   
    }   

    //等待GetModuleHandle运行完毕   
    WaitForSingleObject(hThread, INFINITE);   
    //获得GetModuleHandle的返回值   
    GetExitCodeThread(hThread,&dwHandle);   

    //释放目标进程中申请的空间   
    VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT);   
    CloseHandle(hThread);   

    // CreateRemoteThread()
    ht = CreateRemoteThread(
        hProcess,
        0,
        0,
        (DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"FreeLibrary"),
        (LPVOID)dwHandle,
        0,
        &rc );

    if ( ht == NULL )
    ...{
        rc = GetLastError();
      MessageBox( _T("CreateRemoteThread() failed ") );
        FreeLibrary( hKernel32 );
        CloseHandle( hProcess );
        return rc;
    }

    switch ( WaitForSingleObject( ht, 2000 ) )
    ...{
    case WAIT_OBJECT_0:
        rc = 0;
         MessageBox( _T("Ok "));
        break;

    default:
        rc = GetLastError();
      MessageBox( _T("WaitForSingleObject() failed ") );
        break;
    }

    //Closes the remote thread handle
    CloseHandle(ht );

    //Free up the kernel32.dll
    if ( hKernel32 != NULL)
        FreeLibrary( hKernel32 );

    //Close the process handle
    CloseHandle( hProcess );

    return rc;

}