远程DLL注入

DLL部分：

#include <windows.h> BOOL WINAPI DllMain(HINSTANCE hInstDll,DWORD dwReason,LPVOID lpReserved) { if(DLL_PROCESS_ATTACH == dwReason) MessageBox(NULL,"Entry","tip",MB_OK); else if(DLL_PROCESS_DETACH == dwReason) MessageBox(NULL,"Leave","tip",MB_OK); return TRUE; } extern "C" _declspec(dllexport) bool Inject(HWND hWnd = NULL) { if(hWnd) { ::SendMessage(hWnd,WM_SETTEXT,0,(LPARAM)"郭文艳"); return true; } return false; }

 

Main部分：

#include <windows.h> #include <iostream> using namespace std; bool Inject(HWND hWnd = NULL,char* pName = NULL) { HANDLE hProcess = NULL; HANDLE hThread = NULL; LPVOID lpMem = NULL; HINSTANCE hInstDll = NULL; bool bSucceed = false; __try { DWORD dwProcessID = -1; GetWindowThreadProcessId(hWnd,&dwProcessID); hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessID); if(NULL == hProcess) __leave; lpMem = VirtualAllocEx(hProcess,NULL,strlen(pName),MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE); if(NULL == lpMem) __leave; DWORD dwWrite; if(WriteProcessMemory(hProcess,lpMem,(LPVOID)pName,strlen(pName),&dwWrite)) { hInstDll = LoadLibrary("Dll1.dll"); if(NULL == hInstDll) __leave; typedef bool (*INJECT)(HWND); INJECT lpInject = (INJECT)GetProcAddress(hInstDll,"Inject"); if(NULL == lpInject) __leave; bSucceed == lpInject(hWnd); hThread = CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.dll"),"LoadLibraryA"),lpMem,0,NULL); if(NULL == hThread) __leave; } //bSucceed = true; } __finally { if(lpMem) VirtualFreeEx(hProcess,NULL,strlen(pName),MEM_RESERVE|MEM_COMMIT); if(hInstDll) FreeLibrary(hInstDll); if(hThread) CloseHandle(hThread); if(hProcess) CloseHandle(hProcess); } return bSucceed; } void main(int argc,TCHAR*argv[]) { HWND hWnd = FindWindow("NotePad",NULL); if(NULL == hWnd) { cout<<"Fail to find window."<<endl; return; } char chName[] = "F://Win32Dll.dll"; if(Inject(hWnd,chName)) cout<<"Inject Succeed"<<endl; else cout<<"Inject Failed"<<endl; }