+ -
当前位置:首页 → 问答吧 → 关于DLL注入问题求高人帮我分析下

关于DLL注入问题求高人帮我分析下

时间:2011-12-07

来源:互联网

DWORD FindTarget( LPCTSTR lpszProcess )  
{  
DWORD dwRet = 0;  
HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );  
PROCESSENTRY32 pe32;  
pe32.dwSize = sizeof( PROCESSENTRY32 );  
Process32First( hSnapshot, &pe32 );  
do  
{  
  if ( lstrcmpi( pe32.szExeFile, lpszProcess ) == 0 )  
{  
dwRet = pe32.th32ProcessID;  
  break;  
}  
} while ( Process32Next( hSnapshot, &pe32 ) );  
CloseHandle( hSnapshot );  
 
return dwRet;  
 
HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwRet );
// 向目标进程地址空间写入DLL名称  
DWORD dwSize, dwWritten;  
dwSize = lstrlenA( "luom_dll.dll" ) + 1;  
LPVOID lpBuf = VirtualAllocEx( hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );  
if ( NULL == lpBuf )  
{  
CloseHandle( hProcess );  
// 失败处理  
}  
  if ( WriteProcessMemory( hProcess, lpBuf, (LPVOID)"luom_dll.dll", dwSize, &dwWritten ) )  
{  
// 要写入字节数与实际写入字节数不相等,仍属失败  
if ( dwWritten != dwSize )  

VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );  
CloseHandle( hProcess );  
// 失败处理  
}  
}  
else  
{  
CloseHandle( hProcess );  
// 失败处理  
}  
// 使目标进程调用LoadLibrary,加载DLL  
DWORD dwID;  
  LPVOID pFunc = LoadLibraryA;  
HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, lpBuf, 0, &dwID );  

// 等待LoadLibrary加载完毕  
WaitForSingleObject( hThread, INFINITE );  
// 释放目标进程中申请的空间  
VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );  
CloseHandle( hThread );  
CloseHandle( hProcess );  
 
}  

// 打开目标进程  


void CTESTDlg::OnButtonDLL() 
{
// TODO: Add your control notification handler code here
  FindTarget("MyGame.exe");  

} }  

// 打开目标进程  


void CTESTDlg::OnButtonDLL() 
{
// TODO: Add your control notification handler code here
  FindTarget("MyGame.exe");  

}}

作者: lm2005xy   发布时间: 2011-12-07

有什么问题啊???dll路径不是完整路径外还有就是CreateRemoteThread不一定会成功。

作者: chenhui530   发布时间: 2011-12-07