/**/ /******************************************************************** created: 2008/01/23 created: 23:1:2008 19:50 file base: app file ext: cpp author: deletex purpose: 半成品.未完成的部分有tooltip显示帮助信息,异常检测*********************************************************************/ #include < windows.h > #include < CommCtrl.h > #include < Tlhelp32.h > #include < tchar.h > #include " resource.h " #pragma comment(lib,"comctl32.lib") typedef LONG (WINAPI * GETWINDOWLONG)(HWND, int );typedef LONG (WINAPI * SETWINDOWLONG)(HWND, int ,LONG);typedef BOOL (WINAPI * SETLAYEREDWINDOWATTRIBUTES)(HWND ,COLORREF,BYTE,DWORD); /**/ // // 写到远程进度的结构体 typedef struct ... { HWND hwnd; LONG style; BYTE bAlpha; GETWINDOWLONG fn_get; SETWINDOWLONG fn_set; SETLAYEREDWINDOWATTRIBUTES fn;} INJDATA, * PINJDATA; /**/ // // 函数声明 void getProcessList(HWND hwnd); void StartInject(HWND hwnd); void Fn_Blt(HDC hdc,RECT rect);BOOL InjectCode(DWORD ProcessID,HANDLE hp);BOOL CALLBACK EnumWindowsProc(HWND hwnd,LPARAM lParam);BOOL CALLBACK DialogProc (HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam); /**/ // // 全局变量 HINSTANCE g_hInstance;RECT g_rect;HWND hnewfind,holdfind;INJDATA g_InjData; /**/ // // WinMain和DialogProc int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) ... { INITCOMMONCONTROLSEX icex; icex.dwSize = sizeof(icex); icex.dwICC = ICC_BAR_CLASSES; if(!InitCommonControlsEx(&icex)) return NULL; g_hInstance=hInstance; return (int) DialogBox (hInstance, MAKEINTRESOURCE(IDD_DIALOG1), NULL, DialogProc);} BOOL CALLBACK DialogProc (HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) ... { static HBITMAP bitmap1,bitmap2; static HWND hPicture; static BOOL bCapture; static HCURSOR hCurARROW,hCur; switch(message) ...{ case WM_INITDIALOG: ...{ //对结构体进行初始化 HMODULE huser=LoadLibrary(__T("user32.dll")); g_InjData.fn_get = (GETWINDOWLONG)GetProcAddress(huser,("GetWindowLongA")); g_InjData.fn_set = (SETWINDOWLONG)GetProcAddress(huser,("SetWindowLongA")); g_InjData.fn = (SETLAYEREDWINDOWATTRIBUTES)GetProcAddress(huser,("SetLayeredWindowAttributes")); FreeLibrary(huser); bitmap1 = LoadBitmap( g_hInstance,MAKEINTRESOURCE(IDB_BITMAP1) ); bitmap2 = LoadBitmap( g_hInstance,MAKEINTRESOURCE(IDB_BITMAP2) ); hCurARROW = LoadCursor (NULL, IDC_ARROW); hCur = LoadCursor (g_hInstance, MAKEINTRESOURCE(IDC_CURSOR1)); hPicture = GetDlgItem(hDlg,IDC_PICTURE); SendMessage(GetDlgItem(hDlg,IDC_SLIDER1),TBM_SETRANGE,0,MAKELONG (0,255)); SendMessage(GetDlgItem(hDlg,IDC_SLIDER1),TBM_SETPOS,TRUE,128); SendMessage(GetDlgItem(hDlg,IDC_SLIDER1),TBM_SETLINESIZE,0,1); SendMessage(GetDlgItem(hDlg,IDC_CHECK1),BM_SETCHECK,BST_CHECKED,0); //获取进程列表 getProcessList(hDlg); } return (TRUE); case WM_DESTROY: case WM_CLOSE: EndDialog(hDlg,0); return (TRUE); case WM_COMMAND: switch (LOWORD(wParam)) ...{ case IDCANCEL://我懒得不行了,,这个也懒得改了,, getProcessList(hDlg); return (TRUE); case IDOK: StartInject(hDlg); return (TRUE); } return (FALSE); case WM_LBUTTONDOWN: ...{ if (!bCapture) ...{ POINT pt; RECT rect; pt.x = MAKEPOINTS(lParam).x; pt.y = MAKEPOINTS(lParam).y; ClientToScreen (hDlg, &pt); GetWindowRect(hPicture,&rect); if(PtInRect(&rect,pt)) ...{ SendMessage (hPicture,STM_SETIMAGE,IMAGE_BITMAP,(long)bitmap1); SetCursor(hCur); SetCapture(hDlg); memset(&g_rect,0,sizeof(RECT)); hnewfind=0; holdfind=0; bCapture=TRUE; } } } return TRUE; case WM_LBUTTONUP: if (bCapture) ...{ SendMessage (hPicture,STM_SETIMAGE,IMAGE_BITMAP,(long)bitmap2); SetCursor(hCurARROW); ReleaseCapture(); Fn_Blt(GetDC(NULL),g_rect); bCapture=FALSE; } return TRUE; case WM_MOUSEMOVE: ...{ if (bCapture) ...{ POINT pt; RECT rect; pt.x = MAKEPOINTS(lParam).x; pt.y = MAKEPOINTS(lParam).y; ClientToScreen(hDlg,&pt); HWND deskwnd=GetDesktopWindow(); HDC hdc=GetWindowDC(deskwnd); HWND hchild=WindowFromPoint(pt); //是否找到最小窗口的BOOL变量 BOOL bFind=FALSE; //开始找最小窗口 RECT tempRect; HWND htemp=GetWindow(hchild,GW_CHILD); while (htemp) ...{ GetWindowRect(htemp,&tempRect); if(PtInRect(&tempRect,pt)) ...{ bFind=TRUE; break; } htemp=GetWindow(htemp,GW_HWNDNEXT); } if (bFind) ...{ bFind=FALSE; hnewfind=htemp; } else ...{ hnewfind=hchild; } //已经找到最小窗口 if (hnewfind!=holdfind) ...{ Fn_Blt(hdc,g_rect); ClientToScreen (hDlg, &pt); GetWindowRect(hnewfind,&g_rect); Fn_Blt(hdc,g_rect); } holdfind=hnewfind; ReleaseDC(deskwnd,hdc); }//end if (bCapture) } return TRUE; } return (FALSE);} /**/ // // 注入的代码 static DWORD WINAPI FunThreed(INJDATA * pData) ... { //The SetLayeredWindowAttributes function sets the opacity and transparency color key of a layered window. pData->style=pData->fn_get(pData->hwnd,GWL_EXSTYLE); pData->style^=0x80000;//0x80000即WS_EX_LAYERED pData->fn_set(pData->hwnd,GWL_EXSTYLE,pData->style); pData->fn(pData->hwnd,0,pData->bAlpha,2);//第4个参数即LWA_COLORKEY|LWA_ALPHA return 0;} /**/ // // 画边框 void Fn_Blt(HDC hdc,RECT rect) ... { PatBlt(hdc, rect.left, rect.top, rect.right - rect.left, 2, DSTINVERT); PatBlt(hdc, rect.left, rect.bottom - 2, 2, -(rect.bottom - rect.top - 2 * 2), DSTINVERT); PatBlt(hdc, rect.right - 2, rect.top + 2, 2, rect.bottom - rect.top - 2 * 2, DSTINVERT); PatBlt(hdc, rect.right, rect.bottom - 2, -(rect.right - rect.left), 2, DSTINVERT);} /**/ // // 进程列表 void getProcessList(HWND hwnd) ... { HWND HList = GetDlgItem(hwnd,IDC_LIST); HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); if (INVALID_HANDLE_VALUE==hProcessSnap) ...{ return ; } SendMessage(HList,LB_RESETCONTENT,0,0);//Removes all items from a list box. PROCESSENTRY32 pe; memset(&pe,0,sizeof(PROCESSENTRY32)); pe.dwSize=sizeof(pe); int i=0; if( Process32First(hProcessSnap,&pe) ) ...{ while(Process32Next(hProcessSnap,&pe)) ...{ SendMessage(HList,LB_INSERTSTRING,i,(LPARAM)pe.szExeFile); SendMessage(HList,LB_SETITEMDATA,i,(LPARAM)pe.th32ProcessID); i++; } } CloseHandle(hProcessSnap); } /**/ // // 在这里调用注入函数 void StartInject(HWND hwnd) ... { DWORD ProcessID; HANDLE hp; if( BST_CHECKED & SendMessage(GetDlgItem(hwnd,IDC_CHECK1),BM_GETSTATE,0,0) ) //选中IDC_CHECK1 ...{ g_InjData.bAlpha=SendMessage(GetDlgItem(hwnd,IDC_SLIDER1),TBM_GETPOS,0,0);//透明度 g_InjData.hwnd = holdfind;//透明的窗口的句柄 GetWindowThreadProcessId(holdfind,&ProcessID); hp=OpenProcess(PROCESS_ALL_ACCESS,TRUE,ProcessID); } else ...{ HWND HList=GetDlgItem(hwnd,IDC_LIST); DWORD index=SendMessage(HList,LB_GETCURSEL,0,0); ProcessID=SendMessage(HList,LB_GETITEMDATA,index,0); hp=OpenProcess(PROCESS_ALL_ACCESS,TRUE,ProcessID); EnumWindows(EnumWindowsProc,ProcessID); } if (g_InjData.hwnd) ...{ InjectCode(ProcessID,hp); }} /**/ // // 开始注入了 BOOL InjectCode(DWORD ProcessID,HANDLE hp) ... { const DWORD CodeSize=0xA8;//反汇编计算出要注入的代码的长度 //向要注入的进程写入结构体 PINJDATA lpaddress; lpaddress=(PINJDATA) VirtualAllocEx(hp,0,sizeof(INJDATA),MEM_COMMIT, PAGE_READWRITE); WriteProcessMemory(hp,lpaddress,&g_InjData,sizeof(INJDATA),NULL); //向要注入的进程写入代码 void *lpcode; lpcode=VirtualAllocEx(hp,0,CodeSize,MEM_COMMIT,PAGE_EXECUTE_READWRITE); WriteProcessMemory(hp,lpcode,&FunThreed,CodeSize,NULL); //执行注入的代码 HANDLE hthread=CreateRemoteThread(hp,NULL,0,(LPTHREAD_START_ROUTINE)lpcode,lpaddress,0,NULL); if (hthread) ...{ return FALSE; } WaitForSingleObject(hthread,INFINITE); if (lpaddress) ...{ VirtualFree(lpaddress,sizeof(INJDATA),MEM_RELEASE); } if (lpcode) ...{ VirtualFree(lpcode,CodeSize,MEM_RELEASE); } if (hthread) ...{ CloseHandle(hthread); } return TRUE;} BOOL CALLBACK EnumWindowsProc(HWND hwnd,LPARAM lParam) ... { HWND parentwnd; DWORD ProcessID; GetWindowThreadProcessId(hwnd,&ProcessID); if (ProcessID==lParam) ...{ while ( (parentwnd=GetParent(hwnd))!=NULL ) ...{ hwnd=parentwnd; } g_InjData.hwnd=hwnd; return FALSE; } return TRUE;}