远程线程DLL注入
在其他進(jìn)程中,創(chuàng)建一個(gè)新的線程來(lái)LoadLibraryA我們的Dll。
?
/*作者:sysprogram
???編寫日期:2011年4月2日
???博客:http://hi.csdn.net/SysProgram
*/
?
#include <windows.h>
#include <stdio.h>
void main()
{
?//打開(kāi)進(jìn)程句柄
?HANDLE hProcess;
?hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,1956);
?if (hProcess == NULL)
?{??
??printf("Open Process error/n");
??return;
?}
?//給進(jìn)程分配內(nèi)存
?LPVOID BaseAddress;?
?char *strDllName = {"C://dlltest.dll"};
?int len = strlen(strDllName) + 1;
?BaseAddress = VirtualAllocEx(hProcess,NULL,len,MEM_COMMIT,PAGE_READWRITE);
?
?//寫進(jìn)程內(nèi)存
?if (WriteProcessMemory(hProcess,BaseAddress,strDllName,len,NULL) == false)
?{
??printf("Write Memory error/n");
??return;
?}
?//創(chuàng)建遠(yuǎn)程線程
?FARPROC ProcAddress;
?HMODULE hModule = GetModuleHandle("Kernel32.dll");
?ProcAddress = GetProcAddress(hModule,"LoadLibraryA");
?HANDLE hThread;
?hThread = CreateRemoteThread(hProcess,
????????NULL,
????????0,
????????(LPTHREAD_START_ROUTINE)ProcAddress,
????????BaseAddress,
????????0,
????????NULL);
?//等待線程完成
?WaitForSingleObject(hThread,INFINITE);
?
?//釋放內(nèi)存,關(guān)閉句柄
?VirtualFreeEx(hProcess,BaseAddress,0,MEM_RELEASE);?
?CloseHandle(hThread);
?CloseHandle(hProcess);
}
總結(jié)
- 上一篇: CFileFind 遍历目录与子目录
- 下一篇: 禁止Dockpanel拖动