随笔——简单的DLL远程线程注入

#include "Windows.h"
#include "stdio.h"
#include "string.h"
#include "stdafx.h"
typedef VOID (*PFUNMSG)(char *);

#pragma comment (lib,"Dll_test")

void InjectDll(DWORD dwPid, char *szDllName)
{
if(dwPid == 0)
{
MessageBox(NULL, "Process name error!","Error",MB_OK);
return;
}
else if(strlen(szDllName) == 0)
{
MessageBox(NULL, "Dll name error!","Error",MB_OK);
return;
}

char *pFunName = "LoadLibraryA";

HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);
if(hProcess == NULL)
{
return ;
}

int nDllLen = strlen(szDllName) + sizeof(char);

PVOID pDllAddr = VirtualAllocEx(hProcess,
NULL,
nDllLen,
MEM_COMMIT,
PAGE_READWRITE);

if(pDllAddr == NULL)
{
CloseHandle(hProcess);
return ;
}

DWORD dwWriteNum = 0;
WriteProcessMemory(hProcess,pDllAddr,szDllName,nDllLen,&dwWriteNum);

FARPROC pFunAddr = GetProcAddress(GetModuleHandle("Kernel32.dll"),pFunName);

HANDLE hThread = CreateRemoteThread(hProcess,
NULL,
0,
(LPTHREAD_START_ROUTINE)pFunAddr,
pDllAddr,
0,
NULL);
WaitForSingleObject(hThread,INFINITE);
CloseHandle(hThread);
CloseHandle(hProcess);

}

int main()
{
InjectDll(3600,"C:\\Documents and Settings\\Administrator\\桌面\\dll_test\\Dll_test.dll");
return 0;
}

#pragma comment (lib,"Dll_test")