核心函数:
HANDLE
WINAPI
CreateFileMappingW(
_In_ HANDLE hFile,
_In_opt_ LPSECURITY_ATTRIBUTES lpFileMappingAttributes,
_In_ DWORD flProtect,
_In_ DWORD dwMaximumSizeHigh,
_In_ DWORD dwMaximumSizeLow,
_In_opt_ LPCWSTR lpName
);
HANDLE
WINAPI
OpenFileMappingW(
_In_ DWORD dwDesiredAccess,
_In_ BOOL bInheritHandle,
_In_ LPCWSTR lpName
);
LPVOID
WINAPI
MapViewOfFile(
_In_ HANDLE hFileMappingObject,
_In_ DWORD dwDesiredAccess,
_In_ DWORD dwFileOffsetHigh,
_In_ DWORD dwFileOffsetLow,
_In_ SIZE_T dwNumberOfBytesToMap
);
在处理两个进程之间的通讯问题上,我采用了数据包区分的情况。两个进程中都开启接受线程,每隔一段时间查看共享内存中的值,当符合A的时候A拿走,符合B的时候B拿走。
A进程核心代码:
#include "stdafx.h"
#include "FileMapping.h"
FileMapping::FileMapping(void)
{
//使用文件映射技术
m_hMapFile = CreateFileMapping(
INVALID_HANDLE_VALUE,
NULL,PAGE_READWRITE,0,16,
L"ROOTkit");
if(NULL == m_hMapFile || INVALID_HANDLE_VALUE == m_hMapFile)
MessageBox(NULL,L"文件映射创建失败",L"提示",NULL);
//映射文件试图到调用进程的地址空间
m_pBuf = MapViewOfFile(m_hMapFile,FILE_MAP_ALL_ACCESS,
0,0,5); //创建5个字节的空间,1个字节位标志,剩下四个为传输信息。
//进行交流
if(NULL == m_pBuf) //创建失败
MessageBox(NULL,L"空间申请失败",L"提示",NULL);
//创建接受线程
CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)ThreadProc,this,0,NULL);
}
FileMapping::~FileMapping(void)
{
CloseHandle(m_hMapFile);
}
bool FileMapping::SendInfo(int seInfo)
{
//第一个字节为1
//对信息进行封装
((byte*)m_pBuf)[0] = 1;
//向缓冲区中写入信息
*(int*)&(((byte*)m_pBuf)[1]) = seInfo;
return TRUE;
}
DWORD WINAPI FileMapping::RecvInfo()
{
while (true)
{
int sign = ((byte*)m_pBuf)[0];
int PhysicsAddress = 0;
if( 2 == sign )
{
int PhysicsAddress = *(int*)&(((byte*)m_pBuf)[1]);
ZeroMemory(m_pBuf,5);
printf("实际的物理地址:%x\n",PhysicsAddress);
MessageBox(NULL,L"FileMapping",NULL,NULL);
}
Sleep(1000);
}
}
DWORD WINAPI FileMapping::ThreadProc(LPVOID lpThreadParameter)
{
((FileMapping*)lpThreadParameter)->RecvInfo();
return true;
}
进程B核心代码:
// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "stdafx.h"
#include<windows.h>
PVOID g_pBuf;
BOOL SendInfo(int seInfo)
{
//第一个字节为2
//对信息进行封装
((BYTE*)g_pBuf)[0] = 2;
//向缓冲区中写入信息
*(int*)&(((BYTE*)g_pBuf)[1]) = seInfo;
return true;
}
bool RecvInfo(DWORD lp)
{
while (true)
{
int sign = ((BYTE*)g_pBuf)[0];
int PhysicsAddress = 0;
if( 1 == sign )
{
int PhysicsAddress = *(int*)&(((BYTE*)g_pBuf)[1]); //将接受到的虚拟地址转换成物理地址
MessageBox(NULL,L"DLL",NULL,NULL);
ZeroMemory(g_pBuf,5);
SendInfo(0x12345678);
}
Sleep(1000);
}
return true;
}
BOOL Chat()
{
//打开一个现成的文件映射对象
HANDLE hMapFile = OpenFileMapping(
FILE_MAP_ALL_ACCESS,
FALSE,
L"ROOTkit");
if(NULL == hMapFile || INVALID_HANDLE_VALUE == hMapFile)
MessageBox(NULL,L"文件映射创建失败",L"提示",NULL);
g_pBuf = MapViewOfFile(hMapFile,FILE_MAP_ALL_ACCESS,0,0,5);
if(NULL == g_pBuf)
MessageBox(NULL,L"空间申请失败",L"提示",NULL);
//创建一个接受线程
CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)RecvInfo,NULL,0,NULL);
return TRUE;
}