远程注入Dll后呼出

魔兽贱队

注入所有满足条件的程序
我判断的是进程名

复制代码
const char* GName = "elementclient.exe";


以下为注入部分代码
HANDLE th = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
    PROCESSENTRY32 pe32;
    Process32First(th,&pe32);
DWORD dwProcessID = 0;
    do
    {
        if(!strcmp(GName,pe32.szExeFile))
        {
   dwProcessID = pe32.th32ProcessID;
   HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE,dwProcessID);  
   if(NULL == hProcess)
   {
    AfxMessageBox("打开进程失败！");
    return;
   }
   // 向目标进程地址空间写入DLL名称   
    DWORD dwWritten;   
    LPCSTR lpszDll;
    char path[1024];
    CString tempDll;
    WIN32_FIND_DATA  fdata;
    lpszDll = "MyHook.dll";  //此处设置Dll名称
    GetCurrentDirectory(1024,path);
    tempDll = path;
    tempDll += "\\";
    tempDll += lpszDll;
    if (FindFirstFile(tempDll,&fdata)==INVALID_HANDLE_VALUE)
    {
     AfxMessageBox("DLL不存在，请检查！");
     return;
    }
    DWORD dwSize = tempDll.GetLength() + 1;
    LPVOID lpBuf = VirtualAllocEx( hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );   
    if ( NULL == lpBuf )   
    {   
     CloseHandle( hProcess );  
     AfxMessageBox("申请内存出错！");
     return;
     // 失败处理   
    }   
    if ( WriteProcessMemory( hProcess, lpBuf, (LPVOID)tempDll.GetBuffer(tempDll.GetLength()), dwSize, &dwWritten ) )   
    {   
     // 要写入字节数与实际写入字节数不相等，仍属失败   
     if ( dwWritten != dwSize )   
     {   
      VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );
      CloseHandle( hProcess );  
      AfxMessageBox("写入内存大小不符！");
      return;
      // 失败处理   
     }   
     else
     {
      tempDll.ReleaseBuffer();
     }
    }   
    else   
    {   
     CloseHandle( hProcess );   
     AfxMessageBox("写入内存出错！");
     return;
     // 失败处理   
    }   
    // 使目标进程调用LoadLibrary，加载DLL
    DWORD dwID;   
    LPVOID pFunc = LoadLibraryA;   
    HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, lpBuf, 0, &dwID );
    // 等待LoadLibrary加载完毕   
    WaitForSingleObject( hThread, INFINITE );   
    // 释放目标进程中申请的空间     
    VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );
    CloseHandle( hThread );   
    CloseHandle( hProcess );         }
    } while (Process32Next(th,&pe32));


Dll入口处
InitInstance函数内加入
::CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)CreateDialogBox,(LPVOID)pCWndWGGameWg,NULL,NULL);


新建个函数

void CreateDialogBox(CMyHookDlg *pCWndWGGameWg)
{
HWND h = GetHwndByPid(GetCurrentProcessId());
DWORD GameTid =GetWindowThreadProcessId(h,NULL);
HHOOK keyhhk =SetWindowsHookEx(WH_KEYBOARD,(HOOKPROC)KeyboardProc,theApp.m_hInstance,GameTid);
bool hwndok = FALSE; //设置一个死循环
do
{
  Sleep(10000); //延迟无意义
}while (hwndok == FALSE);
}

同时新增GetHwndByPid()函数

// 进程ID取窗口句柄
// 枚举窗口信息
typedef struct myWindowInfo
{
HWND  hwnd1;
char WindowText[255];
char ClassName[255];
DWORD dwProcessId;
DWORD dwThreadId;
}WindowInfo;
typedef WindowInfo *  PWindowInfo;
typedef WindowInfo *  LPWindowInfo;
DWORD EnumWindowInfo(WindowInfo WInfo[]);
HWND m_hwndFind[100];
int m_num = 0 ;
BOOL CALLBACK EnumWindowsProc(HWND hWnd, LPARAM lParam)
{
//判断窗口是否可见
if(::GetWindowLong(hWnd,GWL_STYLE)& WS_VISIBLE)
{
  m_hwndFind[m_num] = hWnd;//
  m_num++;//
}
     return true;
}
DWORD EnumWindowInfo(WindowInfo WInfo[])//枚举窗口信息，成功返回窗口数量，失败返回
{
int i = 0;
WindowInfo Winpro;
m_num=0;
::EnumWindows(EnumWindowsProc,NULL);
for(i = 0;i <m_num;i++)
{
  Winpro.hwnd1 = m_hwndFind;
  ::GetWindowText(m_hwndFind,Winpro.WindowText,128);
  ::GetClassName(m_hwndFind,Winpro.ClassName,MAX_PATH-1);
  Winpro.dwThreadId=::GetWindowThreadProcessId(m_hwndFind,&Winpro.dwProcessId);
  WInfo=Winpro;
}
return i;
}
HWND GetHwndByPid(DWORD ProcessId)//进程ID取窗口句柄
{
WindowInfo WinInfo1[255];
HWND _hwnd=0;
DWORD aa=EnumWindowInfo(WinInfo1);
for (DWORD i=0;i<aa;i++)
{
  if (WinInfo1.dwProcessId==ProcessId)
  {
   _hwnd=WinInfo1.hwnd1;
   if (0 ==::GetWindowLong(WinInfo1.hwnd1,GWL_HWNDPARENT))
   {
    return WinInfo1.hwnd1;
   }
  }
}
return _hwnd;
}

编程者

继续更新吧  最好有视频的教程