C++学习之DLL注入

  1 #include<stdio.h>
  2 #include<Windows.h>
  3 #include<TlHelp32.h>
  4 
  5 
  6 //typedef unsigned long       DWORD;
  7 //typedef __nullterminated CONST CHAR *LPCSTR, *PCSTR;
  8 //typedef void *HANDLE;
  9 
 10 DWORD getProcessHandle(LPCTSTR lpProcessName)//根据进程名查找进程PID
 11 {
 12     DWORD dwRet=0;
 13     HANDLE hSnapShot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);/*CreateToolhelp32Snapshot函数为指定的进程、
 14                                                                     进程使用的堆[HEAP]、模块[MODULE]、
 15                                                                     线程[THREAD]）建立一个快照[snapshot]。*/
 16     if(hSnapShot==INVALID_HANDLE_VALUE)
 17     {
 18         //句柄无效
 19         printf("
获得PID=%s的进程快照失败%d",lpProcessName,GetLastError());
 20         return dwRet;
 21     }
 22 
 23     //快照抓取成功  
 24     PROCESSENTRY32 pe32;//声明进程入口对象
 25     pe32.dwSize=sizeof(PROCESSENTRY32 );//填充进程入口大小
 26     Process32First(hSnapShot,&pe32);//遍历进程列表
 27     do
 28     {
 29         if(!lstrcmp(pe32.szExeFile,lpProcessName))
 30         {
 31             dwRet=pe32.th32ProcessID;
 32             break;
 33         }
 34     }
 35     while(Process32Next(hSnapShot,&pe32));
 36     CloseHandle(hSnapShot);
 37     return dwRet;
 38 
 39 }
 40 
 41 
 42 void EnableDebugPriv()  
 43 {  
 44     HANDLE hToken;          // 进程访问令牌的句柄  
 45     LUID luid;              // 用于存储调试权对应的局local unique identifier  
 46     TOKEN_PRIVILEGES tkp;   // 要设置的权限  
 47     OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);  
 48     // 获取访问令牌  
 49     LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);   // 获得调试权的luid  
 50     tkp.PrivilegeCount = 1; // 设置调试权  
 51     tkp.Privileges[0].Luid = luid;  
 52     tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;  
 53     AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof tkp, NULL, NULL); // 使进程拥有调试权  
 54     CloseHandle(hToken);  
 55 }  
 56 
 57 int main(int argc,char *argv[])
 58 {
 59     DWORD dwpid=getProcessHandle("calc.exe");
 60     LPCSTR lpDllName="D:\WorkProject\C++\20160314\DLLImport\Debug\dllDemo.dll";
 61     EnableDebugPriv();//权限提升
 62     HANDLE hProcess=OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE,dwpid);//获得要注入进程的句柄
 63     
 64     if(hProcess==NULL)
 65     {
 66         printf("
获取进程句柄错误%d",GetLastError());
 67         return -1;
 68     }
 69 
 70     DWORD dwSize=strlen(lpDllName)+1;
 71     DWORD dwHasWrite;
 72     LPVOID lpRemoteBuf=VirtualAllocEx(hProcess,NULL,dwSize,MEM_COMMIT,PAGE_READWRITE);//在远程空间分配地址
 73     if(WriteProcessMemory(hProcess,lpRemoteBuf,lpDllName,dwSize,&dwHasWrite))//写入内存函数执行成功返回非零
 74     {
 75         if(dwHasWrite!=dwSize)
 76         {
 77             //写入内存不完整，释放内存
 78             VirtualFreeEx(hProcess,lpRemoteBuf,dwSize,MEM_COMMIT);
 79             CloseHandle(hProcess);
 80             return -1;
 81         }
 82     }
 83     else
 84     {
 85         printf("
写入远程进程内存空间出错%d",GetLastError());
 86         CloseHandle(hProcess);
 87         return -1;
 88     }
 89     //写入成功
 90     DWORD dwNewThreadId;
 91     LPVOID lpLoadDll=LoadLibraryA;
 92     //将LoadLIbraryA作为线程函数,参数为Dll，创建新线程
 93     HANDLE hNewRemoteThread=CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)lpLoadDll,lpRemoteBuf,0,&dwNewThreadId);
 94     //HANDLE hNewRemoteThread=
 95     if(hNewRemoteThread==NULL)
 96     {
 97         printf("
建立远程线程失败%d",GetLastError());
 98         CloseHandle(hProcess);
 99         return -1;
100     }
101     //等待对象句柄返回
102     WaitForSingleObject(hNewRemoteThread,INFINITE);
103 
104     CloseHandle(hNewRemoteThread);
105 
106 
107      //准备卸载之前注入的Dll 
108     DWORD dwHandle,dwID; 
109     LPVOID pFunc = GetModuleHandleA;//获得在远程线程中被注入的Dll的句柄 
110     HANDLE hThread = CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)pFunc,lpRemoteBuf,0,&dwID); 
111     WaitForSingleObject(hThread,INFINITE); 
112     GetExitCodeThread(hThread,&dwHandle);//线程的结束码即为Dll模块儿的句柄 
113     CloseHandle(hThread); 
114     pFunc = FreeLibrary; 
115     hThread = CreateRemoteThread(hThread,NULL,0,(LPTHREAD_START_ROUTINE)pFunc,(LPVOID)dwHandle,0,&dwID); //将FreeLibraryA注入到远程线程中去卸载Dll 
116     WaitForSingleObject(hThread,INFINITE); 
117     CloseHandle(hThread); 
118     CloseHandle(hProcess); 
119     return 0; 
120 }