java远程线程注入_测试远程线程注入Dll

直接使用远程线程调用 LoadLibrary即可

#include "stdafx.h"

#include

BOOL DllInject(DWORD dwProcessID,LPCTSTR lpDllName)

{

HANDLE hProcess = 0;

//1 打开指定进程

hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessID);

if(hProcess == NULL){

OutputDebugString("OpenProcess Error!");

return FALSE;

}

//2 远程分配内存

DWORD dwAllocSize = lstrlen(lpDllName)+1;

LPVOID lpStrArr = VirtualAllocEx(hProcess,NULL,dwAllocSize,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

if(lpStrArr==NULL){

OutputDebugString("VirtualAllocEx Error!");

CloseHandle(hProcess);

return FALSE;

}

//3 远程内存写入

DWORD dwWriteRet = WriteProcessMemory(hProcess,lpStrArr,(LPVOID)lpDllName,dwAllocSize,NULL);

if(dwWriteRet == 0){

OutputDebugString("WriteProcessMemory Error!");

CloseHandle(hProcess);

return FALSE;

}

//4 本地获取LoadLibrary地址

HMODULE hModule = GetModuleHandle("kernel32.dll");

if(hModule==NULL){

OutputDebugString("GetModuleHandle Error!");

CloseHandle(hProcess);

return FALSE;

}

FARPROC dwProcAddr = GetProcAddress(hModule,"LoadLibraryA");

if(dwProcAddr == NULL)

{

OutputDebugString("GetProcAddress Error!");

CloseHandle(hProcess);

return FALSE;

}

//5 远程线程载入指定的dll

HANDLE hThread = CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)dwProcAddr,lpStrArr,0,NULL);

if(hThread==NULL)

{

OutputDebugString("CreateRemoteThread Error!");

CloseHandle(hProcess);

return FALSE;

}

//6 关闭句柄

CloseHandle(hProcess);

return TRUE;

}

int main(int argc, char* argv[])

{

//printf("Hello World!\n");

DllInject(3300,"C:\\Documents and Settings\\Administrator\\桌面\\TestDll.dll");

return 0;

}