创建远程线程

最新推荐文章于 2024-09-03 14:52:53 发布

hjd2357

最新推荐文章于 2024-09-03 14:52:53 发布

阅读量369

点赞数

文章标签： null include thread

本文链接：https://blog.csdn.net/hjd2357/article/details/5284827

版权

#include <windows.h>
#include <tlhelp32.h>

char* pszlibfilename = "D://dllT.dll";
DWORD GetProcessIdFromName(LPCTSTR name)
{
PROCESSENTRY32 pe;
DWORD id = 0;
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
pe.dwSize = sizeof(PROCESSENTRY32);
if( !Process32First(hSnapshot,&pe) )
  return 0;
do
{
  pe.dwSize = sizeof(PROCESSENTRY32);
  if( Process32Next(hSnapshot,&pe)==FALSE )
   break;
  if(strcmp(pe.szExeFile,name) == 0)
  {
   id = pe.th32ProcessID;
   break;
  }
} while(1);
CloseHandle(hSnapshot);
return id;
}

void main()
{
HINSTANCE hinstDLL=NULL;
DWORD dwremoteprocessid = GetProcessIdFromName("ipmsg.exe");
HANDLE h = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,
false, dwremoteprocessid );

if(h==NULL){

  return;
}
int   cb = (1 + strlen(pszlibfilename)) * sizeof(char);
char* pszlibfileremote = (char*)VirtualAllocEx( h, NULL, cb,MEM_COMMIT,PAGE_READWRITE);

BOOL b   =   WriteProcessMemory(h,(void *)pszlibfileremote,
     (PVOID)pszlibfilename, cb, NULL);
if(b==FALSE){
  return;
}

LPTHREAD_START_ROUTINE pfnstartaddr=(LPTHREAD_START_ROUTINE )
GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryA");

HANDLE thrH = CreateRemoteThread(h,NULL,0, pfnstartaddr,pszlibfileremote,0,NULL);
if(thrH ==NULL)
return;

FreeLibrary(hinstDLL);
CloseHandle(h);
CloseHandle(thrH);

}