c语言vc辅助,Dll注入辅助工具 1.0 (附VC源码)

软件作者：寂寞宝贝

信息来源：邪恶八进制信息安全团队(www.eviloctal.com)

补充：忘记写用法了，点Open选择一个你要注入的DLL，Remote Name那写你要注入的进程名，列如 notepad.exe 不需要写进程的PID，

如果你选择了后面的那个Possession Process选择框，那么进程列表内所有的notepad.exe都会被插入这个DLL，相当于批量插入功能！呵呵！

最近研究Api呢，随手弄了个辅助的！有BUG的跟帖！随便写的，代码写得有点垃圾，能用就行！呵呵！

核心代码如下：

int EnableDebugPriv(const char * name)

{

try

{

HANDLE hToken;

LUID luid;

TOKEN_PRIVILEGES tp;

if(OpenProcessToken(GetCurrentProcess(),

TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))

{

if(LookupPrivilegeValue(NULL,name,&luid))

{

tp.PrivilegeCount=1;

tp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;

tp.Privileges[0].Luid=luid;

AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL);

}

}

return 1;

}

catch (...)

{

return 1;

}

}

DWORD GetProcessID(char *ProcName)

{

PROCESSENTRY32 pe32;

pe32.dwSize=sizeof(pe32);

HANDLE hProcessSnmp=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

if(hProcessSnmp!=INVALID_HANDLE_VALUE)

{

BOOL bProcess=Process32First(hProcessSnmp,&pe32);

int i=0;

while(bProcess)

{

if(strcmp(strupr(pe32.szExeFile),strupr(ProcName))==0)

{

if(CheckEditValue)

{

ProcessIDValue=pe32.th32ProcessID;

i++;

}

else

{

return pe32.th32ProcessID;

}

}

bProcess=Process32Next(hProcessSnmp,&pe32);

}

CloseHandle(hProcessSnmp);

return 0;

}

return 0;

}

BOOL DllInject(const char *DllFunPath,const DWORD dwRemoteProcessId)

{

HANDLE hRemoteProcess;

EnableDebugPriv(SE_DEBUG_NAME);

if((hRemoteProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwRemoteProcessId))!=NULL)

{

char *pszLibFileRemote;

pszLibFileRemote=(char *)VirtualAllocEx(hRemoteProcess,NULL,

lstrlen(DllFunPath)+1,MEM_COMMIT,PAGE_READWRITE);

if(pszLibFileRemote!=NULL)

{

if(WriteProcessMemory(hRemoteProcess,

pszLibFileRemote,(void*)DllFunPath,lstrlen(DllFunPath)+1,NULL)!=0)

{

PTHREAD_START_ROUTINE pfnstraddr=(PTHREAD_START_ROUTINE)

GetProcAddress(GetModuleHandle(TEXT("kernel32")),"LoadLibraryA");

if(pfnstraddr!=NULL)

{

HANDLE hRemoteThread;

if((hRemoteThread=CreateRemoteThread(hRemoteProcess,

NULL,0,pfnstraddr,pszLibFileRemote,0,NULL))!=NULL)

{

return true;

}

}

}

}

}

return FALSE;

}

void CInjectDllDlg::OnBtninject()

{

try

{

UpdateData(true);

if(m_ProcName.IsEmpty()||m_filePath.IsEmpty())

{

AfxMessageBox("Error! Dll Path Not empty! or Process Name Not empty!");

}

else

{

if(((CButton *)GetDlgItem(IDC_CHECKEDIT))->GetCheck())

{

CheckEditValue=TRUE;

}

char *ProcName=new char;

strcpy(ProcName,m_ProcName.GetBuffer(m_ProcName.GetLength()));

DWORD ProcID=GetProcessID(ProcName);

if(ProcID!=0&&CheckEditValue==false)

{

if(DllInject(m_filePath,ProcID))

{

AfxMessageBox("Inject Dll Success!");

}

else

{

AfxMessageBox("Inject Dll Error!");

}

}

else if(CheckEditValue)

{

int i=0;

while(true)

{

if(ProcessIDValue!=0)

{

DllInject(m_filePath,ProcessIDValue);

i++;

}

else

{

break;

}

}

AfxMessageBox("Inject Dll Success!");

}

else

{

AfxMessageBox("Process Name Error!");

}

}

memset(ProcessIDValue,0,sizeof(ProcessIDValue)+1);

CheckEditValue=false;

}

catch (...)

{

return;

}

}