Dll注入分析

我要实现向指定进程加载一个DLL，以下是我的做法，单步调试整个过程没有失败，但结果并没有注入成功，请帮我改改，或者按我的需求给个新的函数也行。 [quote] bool LoadMod(DWORD dwPID, const TCHAR* pszModuleFile) { HANDLEhProcess= NULL; HANDLEhThread= NULL; DWORDdwSize= 0; DWORDdwWritten= 0; LPVOIDlpBuf= NULL; LPVOIDlpThreadFun= NULL; hProcess = ::OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwPID); if (!hProcess) { return false; } dwSize = (DWORD)_tcslen(pszModuleFile); lpBuf = ::VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE); if (!lpBuf) { ::CloseHandle(hProcess); return false; } if (!::WriteProcessMemory(hProcess, lpBuf, (LPVOID)pszModuleFile, dwSize, &dwWritten)) { ::VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hProcess); return false; } if (dwSize != dwWritten) { ::VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hProcess); return false; } #ifdef _UNICODE lpThreadFun = ::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryW"); #else lpThreadFun = ::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryA"); #endif hThread = ::CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpThreadFun, lpBuf, 0, &dwPID); ::WaitForSingleObject(hThread, INFINITE); ::VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hThread); ::CloseHandle(hProcess); return true; } [/quote]

代码贴在下边 #include <windows.h> #include <stdio.h> #include <stdlib.h> bool LoadMod(DWORD dwPID, const TCHAR* pszModuleFile) { HANDLEhProcess= NULL; HANDLEhThread= NULL; DWORDdwSize= 0; DWORDdwWritten= 0; LPVOIDlpBuf= NULL; LPVOIDlpThreadFun= NULL; hProcess = ::OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwPID); if (!hProcess) { return false; } dwSize = (DWORD)strlen(pszModuleFile);//_tcslen lpBuf = ::VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE); if (!lpBuf) { ::CloseHandle(hProcess); return false; } if (!::WriteProcessMemory(hProcess, lpBuf, (LPVOID)pszModuleFile, dwSize, &dwWritten)) { ::VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hProcess); return false; } if (dwSize != dwWritten) { ::VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hProcess); return false; } #ifdef _UNICODE lpThreadFun = ::GetProcAddress(::GetModuleHandle(("Kernel32")), "LoadLibraryW");//_T #else lpThreadFun = ::GetProcAddress(::GetModuleHandle(("Kernel32")), "LoadLibraryA"); #endif hThread = ::CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpThreadFun, lpBuf, 0, &dwPID); ::WaitForSingleObject(hThread, INFINITE); ::VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hThread); ::CloseHandle(hProcess); return true; } void main() { int a=93396;// 进程id char b[56]="c://321.dll"; // LoadMod(a,b); } 【liqiang123abc】: 只修改了　４个地方 具体你自己看吧