利用c#实现远程注入非托管WIN32程序,并利用嵌入汇编调用非托管WIN32程序中的内部过程

c#通过调用windows API函数，可以很轻松的完成非托管WIN32程序的注入、内存读写等操作，以下为c#实现远程注入非托管WIN32程序,并利用嵌入汇编调用非托管WIN32程序中的内部过程的源码：（注：c#内嵌汇编其实是用一个类开实现汇编与机器码之间的转换关系。）

  1  public unsafe partial class Form1 : Form
  2     {
  3         int pHandle = 0;
  4         int pid = 0;
  5         int value = 0;
  6         int baseAddress = 0x452BD4;
  7         Process controlProcess = null;
  8
  9         public Form1()
10         {
11             InitializeComponent();
12         }
13
14
15
16         private void timer1_Tick(object sender, EventArgs e)
17         {
18             Win32API.API.ReadProcessMemory(pHandle, baseAddress, out value, 4, 0);
19             label1.Text = value.ToString();
20         }
21
22         private void asmcall(int addr)
23         {
24             AsmClass asm = new AsmClass();
25             asm.Pushad();
26             asm.Mov_EAX(5555);
27             asm.Mov_EBX(addr);
28             asm.Call_EBX();
29
30             asm.Popad();
31             asm.Ret();
32             asm.RunAsm(this.pid);
33         }
34         private void btnCallTest_Click(object sender, EventArgs e)
35         {
36             int addr = Convert.ToInt32(txtCallAddress.Text, 16);
37             this.asmcall(addr);
38         }
39
40         private void btnSelectProcess_Click(object sender, EventArgs e)
41         {
42             FrmProcessSelect frmProcessSelect = new FrmProcessSelect();
43             if (frmProcessSelect.ShowDialog() == DialogResult.OK)
44             {
45                 controlProcess = frmProcessSelect.resultProcess;
46                 txtProcessName.Text = controlProcess.ProcessName;
47             }
48             else
49             {
50                 frmProcessSelect.Dispose();
51                 return;
52             }
53             frmProcessSelect.Dispose();
54
55             pid = controlProcess.Id;
56             pHandle = Win32API.API.OpenProcess(Win32API.API.OPEN_PROCESS_ALL, 0, pid);
57
58             if (pHandle <= 0)
59             {
60                 lblMsg.Text = "打开进程失败!";
61                 return;
62             }
63             else
64             {
65                 lblMsg.Text = "进程创建成功!";
66                 groupBox1.Enabled = true;
67                 timer1.Interval = 100;
68                 timer1.Start();
69             }
70         }
71
72         private void btnAddCall_Click(object sender, EventArgs e)
73         {
74             AsmClass asm = new AsmClass();
75             asm.Pushad();
76
77             asm.Mov_EBX(0xD53BE4);
78             asm.Mov_EAX(0xD51F28);
79             asm.Mov_EDX_DWORD_Ptr_EBX_Add(0x214);
80             asm.Mov_DWORD_Ptr_EAX_Add_EDX(0x24C);
81             asm.Mov_EAX_EBX();
82
83             asm.Mov_EBX(0x430020);
84             asm.Call_EBX();
85
86             asm.Popad();
87             asm.Ret();
88             asm.RunAsm(this.pid);
89         }
90
91         private void btnSubtractCall_Click(object sender, EventArgs e)
92         {
93             AsmClass asm = new AsmClass();
94             asm.Pushad();
95
96             asm.Mov_EBX(0xD53F8C);
97             asm.Mov_EAX(0xD51F28);
98             asm.Mov_EDX_DWORD_Ptr_EBX_Add(0x214);
99             asm.Mov_DWORD_Ptr_EAX_Add_EDX(0x24C);
100             asm.Mov_EAX_EBX();
101
102             asm.Mov_EBX(0x430020);
103             asm.Call_EBX();
104
105             asm.Popad();
106             asm.Ret();
107             asm.RunAsm(this.pid);
108         }
109     }

测试程序演示下载：https://files.cnblogs.com/myjece/CallTest.rar