远程执行代码写入

#include
#include
#include
#include
#define ID_BUTTON1 1
#define buff MAX_PATH
#pragma comment(lib,"Psapi.lib")
typedef int (WINAPI* addsA)(HWND,LPSTR, LPSTR, UINT);
//#pragma comment(lib,"Psapi.lib")
struct jiegou
{
	int x;
	int y;
}JG;
struct messageadds
{	
	int (WINAPI* adds)(HWND,LPSTR, LPSTR, UINT);
	LPSTR str1;
	LPSTR str2;
	UINT message;
};

DWORD FindPecoeess(LPSTR lp,LPDWORD pid);
BOOL CreteRemotehandle(LPSTR lp);
DWORD _stdcall RemoteProc(LPVOID lp);
LPVOID GetdllFunBase(LPSTR lp,LPSTR lp2);
LRESULT CALLBACK WinProc(HWND ,UINT ,WPARAM ,LPARAM);
int APIENTRY WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
{	
	HDC hdc;
	MSG msg;
	HWND hwnd;
	WNDCLASSEX wc;
	wc.style=CS_HREDRAW|CS_VREDRAW;
	wc.cbSize=sizeof(wc);
	wc.lpfnWndProc=WinProc;
	wc.hInstance=hInstance;
	wc.cbClsExtra=0;
	wc.cbWndExtra=0;
	wc.hIcon=NULL;
	wc.hIconSm=NULL; 
	wc.hCursor=LoadCursor(NULL,IDC_ARROW);
	wc.hbrBackground=(HBRUSH)GetStockObject(2);
	wc.lpszClassName="window";
	wc.lpszMenuName=NULL;
	if(!RegisterClassEx(&wc))
	{
		MessageBox(NULL,"注册窗口失败","ERROR",MB_OK);
	}
	hdc=CreateDC("DISPLAY",NULL,NULL,NULL);
	JG.x=GetDeviceCaps(hdc,8);
	JG.y=GetDeviceCaps(hdc,10);
    hwnd=CreateWindow("window","window",WS_OVERLAPPEDWINDOW,JG.x/2-200,JG.y/2-200,400,400,NULL,NULL,hInstance,NULL) ;
	ShowWindow(hwnd,nCmdShow);
	UpdateWindow(hwnd);
	while(GetMessage(&msg,NULL,0,0))
	{
		TranslateMessage(&msg);
		DispatchMessage(&msg);
	}
	return msg.wParam;
}
LRESULT CALLBACK WinProc(HWND hwnd,UINT message ,WPARAM wparam,LPARAM lparam)
{

HDC hdc;
PAINTSTRUCT ps;
RECT rect;
int x,y;
HWND hbutton1;
switch(message)
{
case WM_CREATE:
	GetClientRect(hwnd,&rect);
	x=rect.right;
	y=rect.bottom;
hbutton1=CreateWindow("button","按钮",WS_CHILD|WS_VISIBLE|BS_PUSHBUTTON,x/2-20,y-20,40,20,hwnd,(HMENU)ID_BUTTON1,((LPCREATESTRUCT)lparam)->hInstance,NULL);break;
case WM_PAINT:
hdc=BeginPaint(hwnd,&ps);
/*															code位置										*/
/*																↓											*/



/*																↑											*/
/*															code数位置										*/
EndPaint(hwnd,&ps);
break;
case WM_COMMAND:
switch(LOWORD(wparam))
{
case ID_BUTTON1:
/*															code位置										*/
/*																↓											*/
CreteRemotehandle("模板.exe");
/*																↑											*/
/*															code数位置										*/
InvalidateRect(hwnd,NULL,TRUE);
break;
};
break;
case 0x2:
	 PostQuitMessage(0); break;
}
return DefWindowProc(hwnd,message,wparam,lparam);
}
DWORD FindPecoeess(LPSTR lp,LPDWORD pid)//查找进程ID
{
HANDLE hproc;
PROCESSENTRY32 hinfo={0};
hproc=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(hproc==NULL)
{
	return GetLastError();
}
hinfo.dwSize=sizeof(PROCESSENTRY32);
if(!Process32First(hproc,&hinfo))
{
	return GetLastError();
}
do{
	if(lstrcmpi(hinfo.szExeFile,lp)==0)
	{
		*pid=hinfo.th32ProcessID;
	}
}while(Process32Next(hproc,&hinfo));
if(pid)
{
	return GetLastError();
}
return FALSE;
}
BOOL CreteRemotehandle(LPSTR lp)
{
	DWORD pid=0,Threadid;
	HANDLE hprocess,hRemoteThread;
	LPVOID lpVirtual,lpVirtualParameter;
	DWORD size;
	struct messageadds adds;
	char ch[]={"远程代码注入成功"};
	char ch2[]="TRUE";

	FindPecoeess(lp,&pid);//得到进程ID

	hprocess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid);

	size=(DWORD)GetdllFunBase-(DWORD)RemoteProc;            // ? 这里什么意思

	lpVirtual=VirtualAllocEx(hprocess,NULL,size,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

	if(!WriteProcessMemory(hprocess,lpVirtual,&RemoteProc,size,0))
	{
		return FALSE;
	}

	lpVirtualParameter=VirtualAllocEx(hprocess,NULL,sizeof(struct messageadds),MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);

	adds.adds=(addsA)(GetdllFunBase("User32.dll","MessageBoxA"));
	adds.str1=ch;
	adds.str2=ch2;
	adds.message=MB_OK;

	if(!WriteProcessMemory(hprocess,lpVirtualParameter,&adds,sizeof(struct messageadds),0)) // 这里有问题，messagadds里面str1和str2是字符指针，你这样拷贝的话，在另外个进程访问这个地址一定会崩溃
	{
		return FALSE;
	}
	hRemoteThread=CreateRemoteThread(hprocess,NULL,0,(DWORD (WINAPI *) (LPVOID))lpVirtual,lpVirtualParameter,0,&Threadid);
	if(!hRemoteThread)
	{
		return FALSE;
	}
	WaitForSingleObject(hRemoteThread,INFINITE);
	VirtualFreeEx(hRemoteThread,lpVirtual,0,MEM_RELEASE);
	VirtualFreeEx(hRemoteThread,lpVirtualParameter,0,MEM_RELEASE);
//	CloseHandle(hprocess);
	return 1;
}
DWORD _stdcall RemoteProc(LPVOID lp)
{
	typedef int (WINAPI* MESSAGEBOXA)(HWND,LPSTR,LPSTR,UINT);
	MESSAGEBOXA MessageBoxA;
	MessageBoxA=((struct messageadds *)lp)->adds;
	MessageBoxA(NULL,((struct messageadds *)lp)->str1,((struct messageadds *)lp)->str2,MB_OK);
	CloseHandle(GetCurrentProcess());
	return 0;
}
LPVOID GetdllFunBase(LPSTR lp,LPSTR lp2)
{
	return (LPVOID)GetProcAddress(LoadLibrary(lp),lp2);
}