X86 X64远程线程注入

最新推荐文章于 2021-02-17 02:31:51 发布

老白_

最新推荐文章于 2021-02-17 02:31:51 发布

阅读量909

点赞数 1

分类专栏：系统

本文链接：https://blog.csdn.net/qq_35129925/article/details/90372457

版权

系统专栏收录该内容

12 篇文章 0 订阅

订阅专栏

#include <Windows.h>
#include <stdio.h>
#include <iostream>
using namespace std;

BOOL 远程注入(DWORD ProcessID, string DllRoad)
{
//打开进程句柄
HANDLE ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);

LONG64 RoadLength = (DllRoad.length() + 1) * 2;
//申请一段内存存放路径地址
PVOID 申请内存地址 = VirtualAllocEx(ProcessHandle, NULL, RoadLength, MEM_COMMIT, PAGE_READWRITE);
if (申请内存地址 == NULL)
{
    MessageBoxA(0, "申请内存地址失败", "申请内存地址失败",0);
    return false;
}


bool ret = WriteProcessMemory(ProcessHandle, (PCHAR)申请内存地址, DllRoad.c_str(), RoadLength, NULL);
if (ret == NULL)
{
    VirtualFreeEx(ProcessHandle, 申请内存地址, 0, MEM_RELEASE);
    CloseHandle(ProcessHandle);
    MessageBoxA(0, "写入路径内存失败", "写入路径内存失败", 0);
    return false;
}

//远程线程注入
HANDLE RemoteThreadHandle = CreateRemoteThread(ProcessHandle, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, 申请内存地址, 0, 0);
if (RemoteThreadHandle == NULL)
{
    VirtualFreeEx(ProcessHandle, 申请内存地址, 0, MEM_RELEASE);
    CloseHandle(ProcessHandle);
    MessageBoxA(0, "创建远程线程失败", "创建远程线程失败", 0);
    return false;
}
//dwMilliseconds[in]定时时间间隔，单位为milliseconds（毫秒）.如果指定一个非零值，函数处于等待状态直到hHandle标记的对象被触发，或者时间到了。如果dwMilliseconds为0，对象没有被触发信号，函数不会进入一个等待状态，它总是立即返回。如果dwMilliseconds为INFINITE，对象被触发信号后，函数才会返回。
WaitForSingleObject(RemoteThreadHandle, INFINITE);

Sleep(1000);
//释放申请内存   关闭句柄
VirtualFreeEx(ProcessHandle, 申请内存地址, 0, MEM_RELEASE);
CloseHandle(ProcessHandle);
CloseHandle(RemoteThreadHandle);

return true;

}