根据进程名查找进程ID，向远程线程写数据

#include “stdafx.h”

#include “tlhelp32.h”

#define PROCESSNAME “NOTEPAD.EXE”

#define DLLPATH “D:\\dustbin.dll”

LPVOID pathAddress;

//根据进程名查找进程ID

DWORD FindProcess(LPCTSTR str)

{

DWORD id = 0;

PROCESSENTRY32 processEntry;

HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

processEntry.dwSize = sizeof(PROCESSENTRY32);

BOOL bRet = Process32First(hProcessSnap, &processEntry);

while (bRet)

{

  if ( !strcmp(processEntry.szExeFile, str) )

  {

   id = processEntry.th32ProcessID;

   break;

  }

  bRet = Process32Next(hProcessSnap, &processEntry);

}

return id;

}

//向远程线程写数据

HANDLE WriteStringToProcess(LPCTSTR pathStr, DWORD id, DWORD size)

{

size = strlen(pathStr) + 1;

HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, id);

if (NULL == hProcess)

{

  CloseHandle(hProcess);

  return NULL;

}

pathAddress = VirtualAllocEx(hProcess, NULL, size, MEM_COMMIT, PAGE_READWRITE);

if (NULL == pathAddress)

{

  CloseHandle(hProcess);

  return NULL;

}

DWORD dwJudge = NULL;

BOOL iYON = WriteProcessMemory(hProcess, pathAddress, (LPVOID)pathStr, size, &dwJudge);

if (0 == iYON || 0 == dwJudge)

{

  CloseHandle(hProcess);

  return NULL;

}

return hProcess;

}

//主函数

int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)

{

  DWORD dwProcessID = FindProcess(PROCESSNAME);

if (!dwProcessID)

{

  MessageBox(0, “error with find process!”, “fail”, MB_OK);

  return 1;

}

DWORD dwSize = 0;

HANDLE hProcess = WriteStringToProcess(DLLPATH, dwProcessID, dwSize);

if (!hProcess)

{

  MessageBox(0, “error with writing!”, “fail”, MB_OK);

  return 1;

}

HANDLE tRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pathAddress, 0, 0);

WaitForSingleObject(tRemoteThread, INFINITE);

VirtualFreeEx(hProcess, pathAddress, dwSize, MEM_DECOMMIT);

CloseHandle(tRemoteThread);

CloseHandle(hProcess);

return 0;

}