远程函数注入

// 远程注入
BOOL CFuntion::InjectRemoteFunc(DWORD dwProcId, LPVOID mFunc, LPVOID pRemoteParam, DWORD ParamSize)
{
HANDLE hProcess;  
LPVOID ThreadAdd;  
LPVOID ParamAdd = NULL;  
HANDLE hThread  = NULL;  
DWORD lpNumberOfBytes;  
BOOL BO;  
ThreadAdd = mFunc;  
if(dwProcId == NULL ){
::AfxMessageBox(_T("dwProcId"),0,0);
}


hProcess = ::OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcId);//打开被注入的进程  


ThreadAdd =::VirtualAllocEx(hProcess,NULL,4096,MEM_COMMIT,PAGE_EXECUTE_READWRITE);  


BO = ::WriteProcessMemory(hProcess,ThreadAdd,mFunc,4096, &lpNumberOfBytes);//写入函数地址  
if(ParamSize!=0)  
{  
ParamAdd =::VirtualAllocEx(hProcess,NULL,ParamSize, MEM_COMMIT, PAGE_READWRITE);  
BO = WriteProcessMemory(hProcess,ParamAdd, pRemoteParam, ParamSize, &lpNumberOfBytes); //写入参数地址  
}  
hThread = ::CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)ThreadAdd, ParamAdd, 0,&lpNumberOfBytes); //创建远程线程  


::WaitForSingleObject(hThread, INFINITE);//等待线程结束  
::VirtualFreeEx(hProcess, ThreadAdd, 4096, MEM_RELEASE);  
if(ParamSize!=0)  
{  
::VirtualFreeEx(hProcess, ParamAdd,ParamSize, MEM_RELEASE); //释放申请的地址  
}  
::CloseHandle(hThread);  
::CloseHandle(hProcess);  
return TRUE;  
}