随笔——简单的DLL远程线程注入

#include "Windows.h"
#include "stdio.h"
#include "string.h"
#include "stdafx.h"
typedef VOID (*PFUNMSG)(char *);

#pragma comment (lib,"Dll_test")

void InjectDll(DWORD dwPid, char *szDllName)
{
	if(dwPid == 0)
	{
		MessageBox(NULL, "Process name error!","Error",MB_OK);
		return; 
	}
	else if(strlen(szDllName) == 0)
	{
		MessageBox(NULL, "Dll name error!","Error",MB_OK);
		return; 
	}

	char *pFunName = "LoadLibraryA";

	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);
	if(hProcess == NULL)
	{
		return ;
	} 
	
	int nDllLen = strlen(szDllName) + sizeof(char);

	PVOID pDllAddr = VirtualAllocEx(hProcess,
						NULL,
						nDllLen,
						MEM_COMMIT,
						PAGE_READWRITE);

	if(pDllAddr == NULL)
	{
		CloseHandle(hProcess);
		return ;
	}

	DWORD dwWriteNum = 0;
	WriteProcessMemory(hProcess,pDllAddr,szDllName,nDllLen,&dwWriteNum);

	FARPROC pFunAddr = GetProcAddress(GetModuleHandle("Kernel32.dll"),pFunName);

	HANDLE hThread = CreateRemoteThread(hProcess,
						NULL,
						0,
						(LPTHREAD_START_ROUTINE)pFunAddr,
						pDllAddr,
						0,
						NULL);
	WaitForSingleObject(hThread,INFINITE);
	CloseHandle(hThread);
	CloseHandle(hProcess);

}

int main()
{
	InjectDll(3600,"C:\\Documents and Settings\\Administrator\\桌面\\dll_test\\Dll_test.dll");
	return 0;
}

DLL的目录不要包含空格，否则总会报错。

这里使用DLL的静态调用方式，使用语句：

#pragma comment (lib,"Dll_test")

所需要的.dll和.lib都需要复制到目标文件夹下。