随笔——简单的DLL远程线程注入

最新推荐文章于 2024-11-04 11:00:53 发布

原创最新推荐文章于 2024-11-04 11:00:53 发布 · 624 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#DLL注入 #编程

随笔专栏收录该内容

8 篇文章

订阅专栏

本文介绍了一个C语言程序示例，该程序能够将指定的DLL注入到由进程ID标识的目标进程中。文章提供了完整的代码实现，并强调了DLL路径中不应包含空格的重要性。

#include "Windows.h"
#include "stdio.h"
#include "string.h"
#include "stdafx.h"
typedef VOID (*PFUNMSG)(char *);

#pragma comment (lib,"Dll_test")

void InjectDll(DWORD dwPid, char *szDllName)
{
	if(dwPid == 0)
	{
		MessageBox(NULL, "Process name error!","Error",MB_OK);
		return; 
	}
	else if(strlen(szDllName) == 0)
	{
		MessageBox(NULL, "Dll name error!","Error",MB_OK);
		return; 
	}

	char *pFunName = "LoadLibraryA";

	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);
	if(hProcess == NULL)
	{
		return ;
	} 
	
	int nDllLen = strlen(szDllName) + sizeof(char);

	PVOID pDllAddr = VirtualAllocEx(hProcess,
						NULL,
						nDllLen,
						MEM_COMMIT,
						PAGE_READWRITE);

	if(pDllAddr == NULL)
	{
		CloseHandle(hProcess);
		return ;
	}

	DWORD dwWriteNum = 0;
	WriteProcessMemory(hProcess,pDllAddr,szDllName,nDllLen,&dwWriteNum);

	FARPROC pFunAddr = GetProcAddress(GetModuleHandle("Kernel32.dll"),pFunName);

	HANDLE hThread = CreateRemoteThread(hProcess,
						NULL,
						0,
						(LPTHREAD_START_ROUTINE)pFunAddr,
						pDllAddr,
						0,
						NULL);
	WaitForSingleObject(hThread,INFINITE);
	CloseHandle(hThread);
	CloseHandle(hProcess);

}

int main()
{
	InjectDll(3600,"C:\\Documents and Settings\\Administrator\\桌面\\dll_test\\Dll_test.dll");
	return 0;
}

DLL的目录不要包含空格，否则总会报错。

这里使用DLL的静态调用方式，使用语句：