最近研究 dll注入!自己写了个注入封装类!请高手赐教!
使用方法//只需要 injectDll(dll的完全地址,要插入进程的名字 或者窗口名字,0 or 1)
//0通过进程名字查询，1通过窗口名字查询
// injectdll.h: interface for the Cinjectdll class.
//
//////////////////////////////////////////////////////////////////////
#if !defined(AFX_INJECTDLL_H__57624EF3_3B01_4222_8B40_53E6CB19EEF4__INCLUDED_)
#define AFX_INJECTDLL_H__57624EF3_3B01_4222_8B40_53E6CB19EEF4__INCLUDED_
#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000
class Cinjectdll
{
public:
Cinjectdll();
virtual ~Cinjectdll();
DWORD GetPida(char * fullname);
DWORD processNameToId(LPCTSTR lpszProcessName);
BOOL InjectDll(const char *DllFullPath ,char * ExEFullName,int FindType=0) ;
int EnableDebugPriv(const char * name) ;
DWORD GetPida_FromName(char * fullname);
};
#endif // !defined(AFX_INJECTDLL_H__57624EF3_3B01_4222_8B40_53E6CB19EEF4__INCLUDED_)
// injectdll.cpp: implementation of the Cinjectdll class.
//
//
//只需要 injectDll(dll的完全地址,要插入进程的名字 或者窗口名字,0 or 1)
//0通过进程名字查询，1通过窗口名字查询
//////////////////////////////////////////////////////////////////////
#include "stdafx.h"
#include "injectdll.h"
#include <TlHelp32.h>
//////////////////////////////////////////////////////////////////////
// Construction/Destruction
//////////////////////////////////////////////////////////////////////
Cinjectdll::Cinjectdll()
{
}
Cinjectdll::~Cinjectdll()
{
}
/////////////////////////////////////////////
//
//通过进程名字来取得 pid
//
////////////////////////////////////////////
DWORD Cinjectdll::GetPida(char * fullname)
{
DWORD dwProcessId = processNameToId(fullname);
if (dwProcessId <= 0)
{
//MessageBox(NULL, "The target process have not been found !","Notice", MB_OK);
//错误
return -1;
}
return dwProcessId;
}
DWORD Cinjectdll::processNameToId(LPCTSTR lpszProcessName)
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 pe;
pe.dwSize = sizeof(PROCESSENTRY32);
if (!Process32First(hSnapshot, &pe))
{
//MessageBox(NULL, "The frist entry of the process list has not been copyied to the buffer", "Notice", MB_ICONINFORMATION | MB_OK);
//错误
return -1;
}
while (Process32Next(hSnapshot, &pe))
{
if (!strcmp(lpszProcessName, pe.szExeFile))
{
return pe.th32ProcessID;
}
}
return -1;
}
BOOL Cinjectdll::InjectDll(const char *DllFullPath ,char * ExEFullName,int FindType)
{
DWORD dwRemoteProcessId;
if(FindType==1)
{
dwRemoteProcessId=GetPida_FromName(ExEFullName);
if(dwRemoteProcessId<=0)
{
return false;
}
}
else
{
dwRemoteProcessId=GetPida(ExEFullName);
if(dwRemoteProcessId<=0)
{
return false;
}
}
HANDLE hRemoteProcess;
EnableDebugPriv(SE_DEBUG_NAME) ;
//打开远程线程
hRemoteProcess = OpenProcess( PROCESS_CREATE_THREAD | //允许远程创建线程
PROCESS_VM_OPERATION | //允许远程VM操作
PROCESS_VM_WRITE,//允许远程VM写
FALSE, dwRemoteProcessId );
char *pszLibFileRemote;
//使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名空间
pszLibFileRemote = (char *) VirtualAllocEx( hRemoteProcess, NULL, lstrlenA(DllFullPath)+1,
MEM_COMMIT, PAGE_READWRITE);
//使用WriteProcessMemory函数将DLL的路径名写入到远程进程的内存空间
WriteProcessMemory(hRemoteProcess,
pszLibFileRemote, (void *) DllFullPath, lstrlenA(DllFullPath)+1, NULL);
//计算LoadLibraryA的入口地址
PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)
GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryA");
//启动远程线程LoadLibraryA，通过远程线程调用创建新的线程
HANDLE hRemoteThread;
if( (hRemoteThread = CreateRemoteThread( hRemoteProcess, NULL, 0, pfnStartAddr, pszLibFileRemote, 0, NULL) ) == NULL)
{
//MessageBox(NULL,_T("CreateRemoteThread error!"),"",MB_OK);
//错误
return FALSE;
}
return TRUE;
}
int Cinjectdll::EnableDebugPriv(const char * name)
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
LUID luid;
//打开进程令牌环
OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,
&hToken);
//获得进程本地唯一ID
LookupPrivilegeValue(NULL,name,&luid) ;
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
tp.Privileges[0].Luid = luid;
//调整权限
AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL);
return 0;
}
/////////////////////////////////////////////////////////////
///
///利用 窗口名字查询进程id
///
//////////////////////////////////////////////////////////////
DWORD Cinjectdll::GetPida_FromName(char * fullname)
{
HWND hWnd = FindWindow(fullname, NULL); // 以NOTEPAD为例 修改下即可插入 explorer
if(NULL == hWnd)
{
return -1;
}
DWORD dwProcessId;
::GetWindowThreadProcessId(hWnd, &dwProcessId);
return dwProcessId;
}
代码写的不好 有什么不好之处 请高手 指教一下!
原文件已经打包! 不错，学习下子
页:
[1]