1,OpenProcess获得要注入进程的句柄
2,VirtualAllocEx在远程进程中开辟出一段内存,
3,WriteProcessMemory将Dll的名字写入第二步开辟出的内存中。
4,CreateRemoteThread将LoadLibraryW作为线程函数,参数为Dll的名称,创建新线程
5,CloseHandle关闭线程句柄
<pre name="code" class="cpp">效果如图所示:
效果如图所示:<img src="https://img-blog.youkuaiyun.com/20150608131602100?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />
<img src="https://img-blog.youkuaiyun.com/20150608131622245?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />
<img src="https://img-blog.youkuaiyun.com/20150608131647044?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvbmliaXJ1X2hvbG1lcw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />
void CMFCApplication5Dlg::OnBnClickedButton1()
{
CEdit* pBoxOne;
CEdit* pBoxTwo;
pBoxOne = (CEdit*)GetDlgItem(IDC_EDIT1);
pBoxTwo = (CEdit*)GetDlgItem(IDC_EDIT2);
CString szDllName;
CString szPid;
pBoxOne->GetWindowText(szDllName);
pBoxTwo->GetWindowText(szPid);
MessageBox(szDllName, _T("DllNmae"), MB_OK);
MessageBox(szPid, _T("Pid"), MB_OK);
DWORD dwPid = 0;
dwPid = _ttoi(szPid);
WCHAR *buffer = (WCHAR*)szDllName.GetBuffer(szDllName.GetLength());
int bufsize = _tcslen(buffer)*sizeof(WCHAR)+sizeof(WCHAR);
DWORD dwWriteNum = 0;
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
if (hProcess == NULL){
AfxMessageBox(L"get Handle error!");
}
PVOID Addr = VirtualAllocEx(hProcess, NULL, bufsize, MEM_COMMIT, PAGE_READWRITE);
if (Addr == NULL){
AfxMessageBox(L"get Addr error!");
}
else AfxMessageBox(TEXT("申请成功"));
if (!WriteProcessMemory(hProcess, Addr, buffer, bufsize, &dwWriteNum)){
AfxMessageBox(TEXT("写入失败"));
}
else AfxMessageBox(TEXT("写入成功"));
if (!GetModuleHandle(L"Kernel32.dll")){
AfxMessageBox(TEXT("获取失败"));
}
FARPROC pFunAddr = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryW");
if (!pFunAddr){
AfxMessageBox(TEXT("GetProcAddress获取失败"));
}
DWORD dwNewThreadId = NULL;
HANDLE hThread = CreateRemoteThreadEx(hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE)pFunAddr, Addr, 0, NULL, &dwNewThreadId);
if (dwNewThreadId == NULL){ AfxMessageBox(TEXT("注入失败")); }
else AfxMessageBox(TEXT("成功注入"));
CloseHandle(hThread);
CloseHandle(hProcess);
CDialogEx::OnOK();
}