使用CreateRemoteThread把代码远程注入指定exe执行

　　HANDLE hThread;char szLibPath[_MAX_PATH] &＃61; "E:\\vs2010project\\InjectDll\\Release\\InjectDll.dll"; //指定注入之后目标进程要加载的DLL
DWORD hLibModule;HANDLE hProcess &＃61; NULL;hProcess &＃61; GetProcessByName("Calc.exe");DWORD ERRO &＃61; GetLastError();if(hProcess &＃61;&＃61; NULL)return 0;HMODULE modHandle &＃61; GetModuleHandle(_T("Kernel32")); //因为kernel32 每一个windows程序进程空间中都有 所以让他调用LOADLIBRARY不成问题void* pLibRemote &＃61; VirtualAllocEx(hProcess, NULL, sizeof(szLibPath), MEM_COMMIT, PAGE_EXECUTE_READWRITE);LPTHREAD_START_ROUTINE addr &＃61; (LPTHREAD_START_ROUTINE)GetProcAddress(modHandle, "LoadLibraryA");WriteProcessMemory( hProcess, pLibRemote, (void*)szLibPath, sizeof(szLibPath), NULL);hThread &＃61; CreateRemoteThread(hProcess, NULL, 0,addr,pLibRemote,0,NULL);WaitForSingleObject(hThread, INFINITE);CloseHandle(hThread);

HANDLE GetProcessByName(const char* name)
{EnableDebugPriv();DWORD pid &＃61; 0;HANDLE snapshot &＃61; CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);PROCESSENTRY32 process;ZeroMemory(&process, sizeof(process));process.dwSize &＃61; sizeof(process);if (Process32First(snapshot, &process)){do{if( stricmp(UnicodeToAnsi(process.szExeFile), name) &＃61;&＃61; 0){pid &＃61; process.th32ProcessID;break;}}while(Process32Next(snapshot, &process));}CloseHandle(snapshot);if(pid !&＃61; 0){HANDLE hProcess &＃61; OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); return hProcess;}return NULL;}

1 void EnableDebugPriv()
2 {
3 HANDLE hToken;
4 LUID luid;
5 TOKEN_PRIVILEGES tkp;
6
7 OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
8
9 LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);
10
11 tkp.PrivilegeCount &＃61; 1;
12 tkp.Privileges[0].Luid &＃61; luid;
13 tkp.Privileges[0].Attributes &＃61; SE_PRIVILEGE_ENABLED;
14
15 AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL);
16
17 CloseHandle(hToken);
18 }

//修改mySub入口处代码
void modify()
{ assert(hProcess !&＃61; NULL);DWORD dwTemp&＃61;0;DWORD dwOldProtect;VirtualProtectEx(hProcess, pfar_sub, 5, PAGE_READWRITE, &dwOldProtect); //将内存保护模式改为可读写,原保护模式保存入dwOldProtectWriteProcessMemory(hProcess, pfar_sub, NewCode, 5, 0);VirtualProtectEx(hProcess, pfar_sub, 5, dwOldProtect, &dwTemp); //恢复内存保护模式
}int new_sub(int x,int y)
{return 1;
}int inject()
{DWORD dwPid &＃61; ::GetCurrentProcessId();hProcess &＃61; OpenProcess(PROCESS_ALL_ACCESS, 0, dwPid); int addr_farpointer &＃61; 0;//获取My_sub()函数地址HMODULE hmod &＃61; ::LoadLibrary(_T("E:\\vs2010project\\My_Sub\\Debug\\My_Sub.dll"));mySub &＃61; (getsub)::GetProcAddress(hmod, "mySub");pfar_sub&＃61;(FARPROC)mySub;addr_farpointer &＃61; (int)pfar_sub;if (pfar_sub &＃61;&＃61; NULL){ MessageBox(NULL, TEXT("locate mySub failed!!"), TEXT("info"), MB_OK);return FALSE;}NewCode[0] &＃61; 0xe9;//0xe9 &＃61;&＃61; jmp
_asm { lea eax, new_submov ebx, pfar_sub sub eax, ebx sub eax, 5 mov dword ptr [NewCode &＃43; 1],eax } modify(); MessageBox(NULL, TEXT("Modified SUCCESSFULLY!!"), TEXT("info"), MB_OK);return TRUE;
}