进程枚举、线程注入,注册表等示例

最新推荐文章于 2022-10-22 09:51:42 发布

stackoverlow

最新推荐文章于 2022-10-22 09:51:42 发布

阅读量865

点赞数

分类专栏：程序编年史

本文链接：https://blog.csdn.net/xiaokint3/article/details/8132171

版权

这篇博客介绍了如何进行进程枚举和线程注入，通过DLL实现这一技术。同时，提供了设置注册表以实现程序开机自动启动的示例，并详细讲解了注册表操作的封装。此外，还讨论了如何锁定桌面以及如何提取并保存16进制数据。

摘要由CSDN通过智能技术生成

resource.h

//{
  {NO_DEPENDENCIES}}
// Microsoft Visual C++ generated include file.
// Used by sd.rc
//
#define IDD_DIALOG                      101
#define IDI_ICON1                       102
#define IDI_ICON                        102
#define IDC_LIST                        1001
#define IDC_BUTTON1                     1003
#define IDC_BUTTON                      1003

// Next default values for new objects
// 
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_NEXT_RESOURCE_VALUE        103
#define _APS_NEXT_COMMAND_VALUE         40001
#define _APS_NEXT_CONTROL_VALUE         1004
#define _APS_NEXT_SYMED_VALUE           101
#endif
#endif

#include <windows.h>
#include <iostream>
#include <Tlhelp32.h>
#include "resource.h"

using namespace std;

BOOL CALLBACK DialogProc (HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);
BOOL CALLBACK GetProcessList (HWND hwnd);
typedef HMODULE (WINAPI *LOADLIB) (LPCTSTR);
void RemoteThread(HWND hwnd);//远程线程注入
HWND	hList;

int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)
{
	DialogBoxParam (hInstance, MAKEINTRESOURCE(IDD_DIALOG), NULL, DialogProc, 0);
	return 1;
}

BOOL CALLBACK DialogProc (HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
{
	HICON	hIcon;
	static HINSTANCE	hInstance	= GetModuleHandle (NULL);
	static int ID,index;
	
	switch (message)
	{
		case WM_INITDIALOG:
			hIcon	= LoadIcon (hInstance, MAKEINTRESOURCE(IDI_ICON) );
			SendMessage(hwnd,WM_SETICON,ICON_BIG, (LPARAM)hIcon);
			hList	= GetDlgItem (hwnd, IDC_LIST) ;
			GetProcessList (hwnd);
			return true;

		case WM_COMMAND:
			switch (LOWORD (wParam))
			{
				case IDC_LIST:
					if (HIWORD(wParam) == LBN_SELCHANGE)
						EnableWindow (GetDlgItem (hwnd, IDCANCEL) ,TRUE);
					break;

				case IDOK:
					GetProcessList(hwnd);
					break;

				case IDCANCEL:
					HANDLE	h;
					index	= SendMessage (hList, LB_GETCURSEL,0, 0);
					ID		= SendMessage (hList, LB_GETITEMDATA, index, 0);
					if (