#include <windows.h>
#include <iostream.h>
bool EnableDebugPriv()
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if (!OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
return false;
}
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue)) {
CloseHandle(hToken);
return false;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL)) {
CloseHandle(hToken);
return false;
}
return true;
}
BOOL InitDll(const char *DllFullPath, const DWORD dwRemoteProcessId)
{
EnableDebugPriv();
HANDLE hRemoteProcess;
//打开远程线程
hRemoteProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, dwRemoteProcessId );
char *pszLibFileRemote;
//使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名空间
pszLibFileRemote = (char *) VirtualAllocEx( hRemoteProcess, NULL, lstrlen(DllFullPath)+1,
MEM_COMMIT, PAGE_READWRITE);
//使用WriteProcessMemory函数将DLL的路径名写入到远程进程的内存空间
WriteProcessMemory(hRemoteProcess, pszLibFileRemote, (void *) DllFullPath,
lstrlen(DllFullPath)+1, NULL);
DWORD dwID;
LPVOID pFunc = LoadLibraryA;
HANDLE hRemoteThread = CreateRemoteThread(hRemoteProcess, NULL, 0,
(LPTHREAD_START_ROUTINE)pFunc, pszLibFileRemote, 0, &dwID );
if(hRemoteThread == NULL)
{
cout<<”注入线程失败!”<<endl;
return 0;
}
CloseHandle(hRemoteProcess);
CloseHandle(hRemoteThread);
return TRUE;
}
int main()
{
InitDll(“C:\\hook.dll”, 数字) ;//这个dll你所要注入的dll文件,这个”数字”是你想注入的进程的PID号
return 0;
}
转载于:https://my.oschina.net/briviowang/blog/97032