扫一扫
分享文章到微信
扫一扫
关注官方公众号
至顶头条
作者:佚名 来源:CESDN 2007年10月20日
关键字: Visual C++ 远程线程 嵌入技术
hRemoteProcess = OpenProcess( PROCESS_CREATE_THREAD | file://允许远程创建线程 PROCESS_VM_OPERATION | file://允许远程VM操作 PROCESS_VM_WRITE,//允许远程VM写 FALSE, dwRemoteProcessId ) |
file://计算DLL路径名需要的内存空间 int cb = (1 + lstrlenW(pszLibFileName)) * sizeof(WCHAR); file://使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名缓冲区 pszLibFileRemote = (PWSTR) VirtualAllocEx( hRemoteProcess, NULL, cb, MEM_COMMIT, PAGE_READWRITE); file://使用WriteProcessMemory函数将DLL的路径名复制到远程进程的内存空间 iReturnCode = WriteProcessMemory(hRemoteProcess, pszLibFileRemote, (PVOID) pszLibFileName, cb, NULL); file://计算LoadLibraryW的入口地址 PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE) GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW"); |
file://启动远程线程LoadLibraryW,通过远程线程调用用户的DLL文件 hRemoteThread = CreateRemoteThread( hRemoteProcess, NULL, 0, pfnStartAddr, pszLibFileRemote, 0, NULL); |
BOOL APIENTRY DllMain(HANDLE hModule, DWORD reason, LPVOID lpReserved) { char szProcessId[64] ; switch ( reason ) { case DLL_PROCESS_ATTACH: { file://获取当前进程ID _itoa ( GetCurrentProcessId(), szProcessId, 10 ); MessageBox ( NULL, szProcessId, "RemoteDLL", MB_OK ); } default: return TRUE; } } |
Process ID: 1208 C:\WINNT\Explorer.exe (0x00400000) …… C:\TestDLL.dll (0x100000000) …… |
濡傛灉鎮ㄩ潪甯歌揩鍒囩殑鎯充簡瑙T棰嗗煙鏈€鏂颁骇鍝佷笌鎶€鏈俊鎭紝閭d箞璁㈤槄鑷抽《缃戞妧鏈偖浠跺皢鏄偍鐨勬渶浣抽€斿緞涔嬩竴銆�