Win32使用远程线程来插入DLL

Win32使用远程线程来插入DLL

摘录在windows core编程
函数原形：

HANDLE CreateRemoteThread(
HANDLE hProcess,
PSECURITY_ATTRIBUTES psa,
DWORD dwStackSize,
PTHREAD_STRART_ROUTINE pfnStartAddr,
PVOID pvParam,
DWORD fdwCreate,
PDWORD pdwThreadId);

范例：
插入

BOOL WINAPI InjectLib(DWORD dwProcessId, PCTSTR pszLibFile) {

   BOOL fOk = FALSE; // Assume that the function fails
   HANDLE hProcess = NULL, hThread = NULL;
   PTSTR pszLibFileRemote = NULL;

   __try {
      // Get a handle for the target process.
      hProcess = OpenProcess(
         PROCESS_QUERY_INFORMATION |   // Required by Alpha
         PROCESS_CREATE_THREAD     |   // For CreateRemoteThread
         PROCESS_VM_OPERATION      |   // For VirtualAllocEx/VirtualFreeEx
         PROCESS_VM_WRITE,             // For WriteProcessMemory
         FALSE, dwProcessId);
      if (hProcess == NULL) __leave;

      // Calculate the number of bytes needed for the DLL's pathname
      int cch = 1 + lstrlen(pszLibFile);
      int cb  = cch * sizeof(TCHAR);

      // Allocate space in the remote process for the pathname
      pszLibFileRemote = (PTSTR)
         VirtualAllocEx(hProcess, NULL, cb, MEM_COMMIT, PAGE_READWRITE);
      if (pszLibFileRemote == NULL) __leave;

      // Copy the DLL's pathname to the remote process's address space
      if (!WriteProcessMemory(hProcess, pszLibFileRemote,
         (PVOID) pszLibFile, cb, NULL)) __leave;

      // Get the real address of LoadLibraryW in Kernel32.dll
      PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)
         GetProcAddress(GetModuleHandle(TEXT("Kernel32")),
#ifdef UNICODE
         "LoadLibraryW");
#else
         "LoadLibraryA");
#endif
      if (pfnThreadRtn == NULL) __leave;

      // Create a remote thread that calls LoadLibraryW(DLLPathname)
      hThread = CreateRemoteThread(hProcess, NULL, 0,
         pfnThreadRtn, pszLibFileRemote, 0, NULL);
      if (hThread == NULL) __leave;

      // Wait for the remote thread to terminate
      WaitForSingleObject(hThread, INFINITE);

      fOk = TRUE; // Everything executed successfully
   }
   __finally { // Now, we can clean everthing up

      // Free the remote memory that contained the DLL's pathname
      if (pszLibFileRemote != NULL)
         VirtualFreeEx(hProcess, pszLibFileRemote, 0, MEM_RELEASE);

      if (hThread  != NULL)
         CloseHandle(hThread);

      if (hProcess != NULL)
         CloseHandle(hProcess);
   }

   return(fOk);
}

取消插入：

BOOL WINAPI EjectLib(DWORD dwProcessId, PCTSTR pszLibFile) {

   BOOL fOk  =  FALSE;  //  Assume that the function fails
   HANDLE hthSnapshot  =  NULL;
   HANDLE hProcess  =  NULL, hThread  =  NULL;

   __try {
       //  Grab a new snapshot of the process
      hthSnapshot  =  CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
       if  (hthSnapshot  ==  NULL) __leave;

       //  Get the HMODULE of the desired library
      MODULEENTRY32 me  =  { sizeof(me) };
      BOOL fFound  =  FALSE;
      BOOL fMoreMods  =  Module32First(hthSnapshot,  & me);
       for  (; fMoreMods; fMoreMods  =  Module32Next(hthSnapshot,  & me)) {
         fFound  =  (lstrcmpi(me.szModule,  pszLibFile)  ==   0 )  ||  
                  (lstrcmpi(me.szExePath, pszLibFile)  ==   0 );
          if  (fFound)  break ;
      }
       if  ( ! fFound) __leave;

       //  Get a handle for the target process.
      hProcess  =  OpenProcess(
         PROCESS_QUERY_INFORMATION  |     //  Required by Alpha
         PROCESS_CREATE_THREAD      |  
         PROCESS_VM_OPERATION,   //  For CreateRemoteThread
         FALSE, dwProcessId);
       if  (hProcess  ==  NULL) __leave;

       //  Get the real address of LoadLibraryW in Kernel32.dll
      PTHREAD_START_ROUTINE pfnThreadRtn  =  (PTHREAD_START_ROUTINE)
         GetProcAddress(GetModuleHandle(TEXT( " Kernel32 " )),  " FreeLibrary " );
       if  (pfnThreadRtn  ==  NULL) __leave;

       //  Create a remote thread that calls LoadLibraryW(DLLPathname)
      hThread  =  CreateRemoteThread(hProcess, NULL,  0 , 
         pfnThreadRtn, me.modBaseAddr,  0 , NULL);
       if  (hThread  ==  NULL) __leave;

       //  Wait for the remote thread to terminate
      WaitForSingleObject(hThread, INFINITE);

      fOk  =  TRUE;  //  Everything executed successfully
   }
   __finally {  //  Now we can clean everything up

       if  (hthSnapshot  !=  NULL) 
         CloseHandle(hthSnapshot);

       if  (hThread      !=  NULL) 
         CloseHandle(hThread);

       if  (hProcess     !=  NULL) 
         CloseHandle(hProcess);
   }

    return (fOk);
}