dll远程注入

// ConsoleApplication16.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <windows.h>

int _tmain(int argc, _TCHAR* argv[])
{
	if (szDllName[0] == NULL)
		return -1;
	//打开进程
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 进程ID);
	if (hProcess == INVALID_HANDLE_VALUE)
		return -1;
	//2.在远处进程中申请空间
	LPVOID pszDLLName = VirtualAllocEx(hProcess, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if (NULL == pszDLLName)
		return -1;
	//3.向远程进程中写入数据
	if (!WriteProcessMemory(hProcess, pszDLLName, szDllName, MAX_PATH, NULL))
		return -1;
	//4.在远程进程中穿件远程线程
	HANDLE  hInjecthread = CreateRemoteThread(
		hProcess,								//远程进程句柄
		NULL,									//安全属性
		0,										//栈大小
		(LPTHREAD_START_ROUTINE)LoadLibrary,	//进程处理函数
		pszDLLName,								//传入参数
		NULL,									//默认创建后的状态
		NULL);									//线程ID
	if (NULL == hInjecthread)
		return -1;
	//5.等待线程结束返回
	DWORD dw = WaitForSingleObject(hInjecthread, -1);
	//6.获取线程退出码，即LoadLibrary的返回值，即dll的首地址
	DWORD dwExitCode;
	HMODULE hMod = (HMODULE)dwExitCode;
	//7.释放空间
	if (!VirtualFreeEx(hProcess, pszDLLName, 4096, MEM_DECOMMIT))
		return -1;
	CloseHandle(hProcess);


	return 0;
}