一个标准的远线程注入dll函数

最近在整理学习  觉得这个很高深，弄懂了觉得也就那样。

下面的代码就是远线程dll注入线程代码

//===========================================================================

// 一个标准的远线程dll注入函数

//===========================================================================

#include <Windows.h>

// dwPid:要注入进程的pid pwszProxyFile：要注入dll的文件路径

BOOL WINAPI InjectProxyW(DWORD dwPid, PCWSTR pwszProxyFile)

{

BOOL bRet = FALSE;

HANDLE hProcess = NULL;

HANDLE hThread = NULL;

FARPROC pfnThreadBtn = NULL; // windef.h : typedef int (FAR WINAPI *FARPROC)();

PWSTR pwszPara = NULL; // loadlibry的参数

hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);

pfnThreadBtn = GetProcAddress(GetModuleHandle(L"Kernel32"), "LoadLibraryW");

size_t iPorxyFileLen = wcslen(pwszProxyFile)*sizeof(WCHAR);

pwszPara = (PWSTR)VirtualAllocEx(hProcess, NULL, iPorxyFileLen, MEM_COMMIT, PAGE_READWRITE);

if (pwszPara == NULL)

{

CloseHandle(hProcess);

return FALSE;

}

WriteProcessMemory(hProcess, pwszPara, (PVOID)pwszProxyFile, iPorxyFileLen, NULL);

// CreateRemoteThread 最后一个参数返回的是创建这个远线程的id

hThread = CreateRemoteThread(hProcess, NULL, 1024, (LPTHREAD_START_ROUTINE)pfnThreadBtn,

pwszPara, 0, NULL);

WaitForSingleObject(hThread, INFINITE);

CloseHandle(hThread);

VirtualFreeEx(hProcess, pwszPara, 0, MEM_RELEASE);

CloseHandle(hProcess);

return TRUE;

}