往另一进程中注入DLL

#ifndef __CEREMOTE_H__ #define __CEREMOTE_H__ #define COREDLL TEXT("coredll.dll") class CRemoteCaller { HMODULE m_hCoreDll; public: CRemoteCaller() : m_hCoreDll(NULL) { GetCoreDllHandle(); } ~CRemoteCaller() { } BOOL GetCoreDllHandle() { m_hCoreDll = GetModuleHandle(COREDLL); return NULL != m_hCoreDll; } FARPROC GetProcAddrFromCoreDll(LPCTSTR lpProcName) { return GetProcAddress(m_hCoreDll, lpProcName); } /** * 函数名：DWORD RemoteCall(HANDLE hProc, FARPROC pfnLib, DWORD p0, DWORD p1, DWORD p2, DWORD p3) * 参数： HANDLE hProc 远程进程句柄 * FARPROC pfnLib 远程函数地址 * p0 p1 p2 p3 PerformCallBack4 的参数 * 返回值：PerformCallBack4 的返回值 * 说明： PerformCallBack4 是在远程进程中执行一段代码的关键 */ DWORD RemoteCall(HANDLE hProc, FARPROC pfnLib, DWORD p0, DWORD p1, DWORD p2, DWORD p3) { CALLBACKINFO cbi; cbi.hProc = hProc; LPVOID pfn = pfnLib; cbi.pfn = (FARPROC)MapPtrToProcess(pfn, cbi.hProc); cbi.pvArg0 = MapPtrToProcess((void*)p0, GetCurrentProcess()); return PerformCallBack4(&cbi, p1, p2, p3); } DWORD RemoteCall2(HANDLE hProc, FARPROC pfnLib, DWORD p0, DWORD p1, DWORD p2, DWORD p3) { CALLBACKINFO cbi; cbi.hProc = hProc; LPVOID pfn = pfnLib; cbi.pfn = (FARPROC)MapPtrToProcess(pfn, cbi.hProc); cbi.pvArg0 = (void*)p0; return PerformCallBack4(&cbi, p1, p2, p3); } }; class CRemoteDllLoader { protected: HMODULE m_hHookDll; BOOL m_bLoaded; HANDLE m_hSrvProc; CRemoteCaller m_rc; public: CRemoteDllLoader() : m_hHookDll(NULL), m_bLoaded(FALSE), m_hSrvProc(NULL) { } ~CRemoteDllLoader() { Unload(); } BOOL Load(HANDLE hProc, LPTSTR pszDllName) { if(m_bLoaded) Unload(); m_hSrvProc = hProc; // load hook DLL locally m_hHookDll = LoadLibrary(pszDllName); if(NULL == m_hHookDll) return FALSE; if(!m_rc.GetCoreDllHandle()) return FALSE; // load hook DLL remotely if(!RemoteLoadLib(hProc, pszDllName)) return FALSE; m_bLoaded = TRUE; return TRUE; } BOOL Unload() { if(!m_bLoaded) return FALSE; RemoteFreeLib(m_hSrvProc); if(m_hHookDll) { FreeLibrary(m_hHookDll); m_hHookDll = NULL; } m_bLoaded = FALSE; return TRUE; } protected: // hProc: remote process handle BOOL RemoteLoadLib(HANDLE hProc, LPTSTR pszDllName) { FARPROC pfnLoadLib = m_rc.GetProcAddrFromCoreDll(TEXT("LoadLibraryW")); if(!pfnLoadLib) return FALSE; DWORD dwRet = m_rc.RemoteCall(hProc, pfnLoadLib, (DWORD)pszDllName, 0, 0, 0); return (HMODULE)dwRet != NULL; } BOOL RemoteFreeLib(HANDLE hProc) { FARPROC pfnLoadLib = m_rc.GetProcAddrFromCoreDll(TEXT("FreeLibrary")); if(!pfnLoadLib) return FALSE; DWORD dwRet = m_rc.RemoteCall(hProc, pfnLoadLib, (DWORD)m_hHookDll, 0, 0, 0); return (HMODULE)dwRet != NULL; } DWORD RemoteCall(HANDLE hProc, LPTSTR pszFnName, DWORD p0, DWORD p1, DWORD p2, DWORD p3) { FARPROC pfn = GetProcAddress(m_hHookDll, pszFnName); return m_rc.RemoteCall2(hProc, pfn, p0, p1, p2, p3); } DWORD RemoteCall(LPTSTR pszFnName, DWORD p0, DWORD p1, DWORD p2, DWORD p3) { return RemoteCall(m_hSrvProc, pszFnName, p0, p1, p2, p3); } }; #define GetCoreDllProcAddress GetProcAddrFromCoreDll #define IsLoaded() m_bLoaded #endif // __CEREMOTE_H__