[转贴]远程线程实例1

#include "stdafx.h"
#include <windows.h>
#include <stdio.h>
#include <Tlhelp32.h>

void usage(char *);

int main(int argc, char* argv[])
{
 //char *Dll = "C://DLL.dll";
 HANDLE hProcess = NULL,hRometeThread = NULL,hRometeThread2 = NULL;
 
 LPVOID pszRemoteMemory = NULL;
 HANDLE hSnapShot = NULL;
 int PID = atoi(argv[1]);
 char *Dll = argv[2];

 if(argc!=3)
 {
  usage(argv[0]);
  return 1;
 }

 __try
 {
  hProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE,PID);
   
  if(hProcess==NULL)
  {
   printf("failed to open process.");
   __leave;   
  }
  
  pszRemoteMemory = VirtualAllocEx(hProcess,NULL,30,MEM_COMMIT,PAGE_READWRITE);

  if(pszRemoteMemory==NULL)
  {
   printf("/n failed to malloc memory in the remote process.");
   __leave;
  }

  if(!WriteProcessMemory(hProcess,pszRemoteMemory,Dll,30,NULL))
  {
   printf("/n failed to write remote memory.");
   __leave;
  }

  PTHREAD_START_ROUTINE pAddrOfLoad = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32"),"LoadLibraryA");  
  if(pAddrOfLoad==NULL)
  {
   printf("/n failed to get loadlibrary proc addr.");
   __leave;
  }

  hRometeThread = CreateRemoteThread(hProcess,NULL,0,pAddrOfLoad,pszRemoteMemory,0,NULL);
  if(hRometeThread==NULL)
  {
   printf("/n failed to create remote thread");
   __leave;
  }

  WaitForSingleObject(hRometeThread,INFINITE);

  Sleep(5000);

  PTHREAD_START_ROUTINE pAddrOfFree = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32"),"FreeLibrary");
  if(pAddrOfFree==NULL)
  {
   printf("/n failed to get freelibrary proc addr.");
   __leave;
  }

  MODULEENTRY32 DllModules;   DllModules.dwSize = sizeof(DllModules);
       
  hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,PID);
  if(hSnapShot==NULL)
  {
   printf("/n failed to get modules.");
   __leave;
  }  

  Module32First(hSnapShot,&DllModules);
  while(DllModules.szModule!=Dll);
  {
   Module32Next(hSnapShot,&DllModules);
  }

  hRometeThread2 = CreateRemoteThread(hProcess,NULL,0,pAddrOfFree,DllModules.modBaseAddr,0,NULL);
  if(hRometeThread2==NULL)
  {
   printf("/n failed to free dll.");
   __leave;
  }

  WaitForSingleObject(hRometeThread2,INFINITE);

 }
 __finally
 {
  if(hProcess!=NULL)
   CloseHandle(hProcess);
  if(pszRemoteMemory!=NULL)
   VirtualFreeEx(hProcess,pszRemoteMemory,0,MEM_RELEASE);
  if(hRometeThread!=NULL)
   CloseHandle(hRometeThread);
  if(hSnapShot!=NULL)
   CloseHandle(hSnapShot);
  if(hRometeThread2!=NULL)
   CloseHandle(hRometeThread2);
 }

 return 0;
}

void usage(char *tool)
{
 printf(" /n using remote thread to inject dlls demoing ");
 printf("/n %s usage:%s PID DLL",tool,tool);
 printf("/n by Rhett 2005.05.13");
}