[原创]远程进程注入dll工具

采用比较容易实现的远程线程注入dll方法, 简单起见实例用MFC完成. 封装了一个CDllInjector类, 可以直接使用
下面的代码就可以实现dll的注入
CDllInjector m_diDllInjector;
m_diDllInjector.OpenProcess(dwProcessId, FALSE) ; // or m_diDllInjector.OpenProcess(szExecName, FALSE)
m_diDllInjector.RemoteVirtualAlloc();
m_diDllInjector.SetInjectDll(strDllName);
m_diDllInjector.SyncInject();
m_diDllInjector.RemoteVirtualFree();
感兴趣的可以看一看

由于现在论坛的附件大小限制的实在太厉害20.48k!!??, 没办法传截图了, 为了减小附件大小传上来, 项目里面也少了一个资源文件DllInjector.ico.自己添加一个就可以编译了.

#include “stdafx.h”
#include “tlhelp32.h”
#define PROCESSNAME “NOTEPAD.EXE”
#define DLLPATH “D:\\dustbin.dll”

LPVOID pathAddress;

//根据进程名查找进程ID
DWORD FindProcess(LPCTSTR str)
{
DWORD id = 0;
PROCESSENTRY32 processEntry;
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

processEntry.dwSize = sizeof(PROCESSENTRY32);

BOOL bRet = Process32First(hProcessSnap, &processEntry);

while (bRet)
{
  if ( !strcmp(processEntry.szExeFile, str) )
  {
   id = processEntry.th32ProcessID;
   break;
  }
  bRet = Process32Next(hProcessSnap, &processEntry);
}

return id;
}
//向远程线程写数据
HANDLE WriteStringToProcess(LPCTSTR pathStr, DWORD id, DWORD size)
{
size = strlen(pathStr) + 1;

HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, id);
if (NULL == hProcess)
{
  CloseHandle(hProcess);
  return NULL;
}

pathAddress = VirtualAllocEx(hProcess, NULL, size, MEM_COMMIT, PAGE_READWRITE);
if (NULL == pathAddress)
{
  CloseHandle(hProcess);
  return NULL;
}

DWORD dwJudge = NULL;
BOOL iYON = WriteProcessMemory(hProcess, pathAddress, (LPVOID)pathStr, size, &dwJudge);
if (0 == iYON || 0 == dwJudge)
{
  CloseHandle(hProcess);
  return NULL;
}

return hProcess;
}

//主函数
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{

  DWORD dwProcessID = FindProcess(PROCESSNAME);
if (!dwProcessID)
{
  MessageBox(0, “error with find process!”, “fail”, MB_OK);
  return 1;
}
DWORD dwSize = 0;
HANDLE hProcess = WriteStringToProcess(DLLPATH, dwProcessID, dwSize);
if (!hProcess)
{
  MessageBox(0, “error with writing!”, “fail”, MB_OK);
  return 1;
}

HANDLE tRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pathAddress, 0, 0);

WaitForSingleObject(tRemoteThread, INFINITE);

VirtualFreeEx(hProcess, pathAddress, dwSize, MEM_DECOMMIT);
CloseHandle(tRemoteThread);
CloseHandle(hProcess);
return 0;
}

// CDllInjectorApp

BEGIN_MESSAGE_MAP(CDllInjectorApp, CWinApp)
    ON_COMMAND(ID_HELP, &CWinApp::OnHelp)
END_MESSAGE_MAP()
这里有问题，我没有编译成功
提示：
error C2059: syntax error : '&&'
error C2143: syntax error : missing ';' before '}'

回复 2# 的帖子

fatal error C1083: Cannot open include file: 'StdAfx.h': No such file or directory
奇怪，我把这个
StdAfx.h和StdAfx.cpp文件加到工程中了，还是出来上面的错误

回复 3# 的帖子

添加一个资源文件DllInjector.ico后这是vista下的编译结果
------ Build started: Project: DllInjector, Configuration: Debug Win32 ------
1>Compiling resources...
1>Microsoft (R) Windows (R) Resource Compiler Version 6.0.5724.0
1>Copyright (C) Microsoft Corporation.  All rights reserved.
1>Compiling manifest to resources...
1>Microsoft (R) Windows (R) Resource Compiler Version 6.0.5724.0
1>Copyright (C) Microsoft Corporation.  All rights reserved.
1>Linking...
1>Embedding manifest...
1>Microsoft (R) Windows (R) Resource Compiler Version 6.0.5724.0
1>Copyright (C) Microsoft Corporation.  All rights reserved.
1>Build log was saved at "file://d:\Users\Noran\Desktop\DllInjector\DllInjector\Debug\BuildLog.htm"
1>DllInjector - 0 error(s), 0 warning(s)
========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========

if((bool)bEnable == (bool)m_bHighPriv)
        return TRUE;

这句有警告
1>.\DllInjectorMgmt.cpp(131) : warning C4800: “BOOL”: 将值强制为布尔值“true”或“false”(性能警告)
1>.\DllInjectorMgmt.cpp(131) : warning C4800: “BOOL”: 将值强制为布尔值“true”或“false”(性能警告)
建议改成
    if(!!bEnable == !!m_bHighPriv)
        return TRUE;

还有，这个工程是用VC++2005写的，用VC6编译难免出问题……LS的换换编译器就OK了

看看

学习学习

回复 6# StarWing83 的帖子

怎么弄了个双重否定 ？？

回复 2# Janlex 的帖子

这个程序干什么，运行了一点反应也没有！！