远程线程DLL注入

在其他进程中，创建一个新的线程来LoadLibraryA我们的Dll。

 

/*作者：sysprogram
   编写日期：2011年4月2日
   博客：http://hi.youkuaiyun.com/SysProgram

*/

 

#include <windows.h>
#include <stdio.h>

void main()
{
 //打开进程句柄
 HANDLE hProcess;
 hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,1956);
 if (hProcess == NULL)
 {  
  printf("Open Process error/n");
  return;
 }

 //给进程分配内存
 LPVOID BaseAddress; 
 char *strDllName = {"C://dlltest.dll"};
 int len = strlen(strDllName) + 1;
 BaseAddress = VirtualAllocEx(hProcess,NULL,len,MEM_COMMIT,PAGE_READWRITE);
 
 //写进程内存
 if (WriteProcessMemory(hProcess,BaseAddress,strDllName,len,NULL) == false)
 {
  printf("Write Memory error/n");
  return;
 }

 //创建远程线程
 FARPROC ProcAddress;
 HMODULE hModule = GetModuleHandle("Kernel32.dll");
 ProcAddress = GetProcAddress(hModule,"LoadLibraryA");

 HANDLE hThread;
 hThread = CreateRemoteThread(hProcess,
        NULL,
        0,
        (LPTHREAD_START_ROUTINE)ProcAddress,
        BaseAddress,
        0,
        NULL);

 //等待线程完成
 WaitForSingleObject(hThread,INFINITE);
 
 //释放内存，关闭句柄
 VirtualFreeEx(hProcess,BaseAddress,0,MEM_RELEASE); 
 CloseHandle(hThread);
 CloseHandle(hProcess);

}