c语言多线程调用dll,教大家写一个远程线程的DLL注入，其实还是蛮简单的……………………...

该楼层疑似违规已被系统折叠 隐藏此楼查看此楼

然后新建一个win32 application 的工程 新建c++ source file 写入：

#include

#include

int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)

{

char DllName[MAX_PATH]="C:\\Program Files\\Microsoft Visual Studio\\MyProjects\\dll注入dll\\Debug\\dll注入dll.dll";//就是刚才写的dll的地址+文件名

HANDLE hProcessSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

PROCESSENTRY32 pe32={sizeof(pe32)};

if(Process32First(hProcessSnap,&pe32))

{

do

{

if(strcmp(pe32.szExeFile,"EXPLORER.EXE")==0) //我注入的是explorer

{

break;

}

}

while(Process32Next(hProcessSnap,&pe32));

}

DWORD TargetProcessId=pe32.th32ProcessID;

CloseHandle(hProcessSnap);

HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,TargetProcessId);

int cbSize=lstrlen(DllName)+1;

LPVOID lpRemoteDllName=VirtualAllocEx(hProcess,NULL,(DWORD)cbSize,MEM_COMMIT,PAGE_READWRITE);

WriteProcessMemory(hProcess,lpRemoteDllName,DllName,(DWORD)cbSize,NULL);

HMODULE hModule=GetModuleHandle("kernel32.dll");

LPTHREAD_START_ROUTINE pfnStartRoutine=(LPTHREAD_START_ROUTINE)GetProcAddress(hModule,"LoadLibraryA");

HANDLE hRemoteThread=CreateRemoteThread(hProcess,NULL,0,pfnStartRoutine,lpRemoteDllName,0,NULL);

WaitForSingleObject(hRemoteThread,INFINITE);

CloseHandle(hRemoteThread);

CloseHandle(hProcess);

return 0;

}

compile build之后执行，你就看到了一个messagebox，而在资源管理器中则没有这个进程。

当然，杀毒软件会报毒，说有木马，别管就是了。有些低端的木马是用了这个技术。