遠程線程注入

// 遠程插入線程
 // char szDllFullPath[] DLL文件完整路徑.
 // DWORD dwRemoteProcessID 要插入的進程ID號
 // 返回: TRUE 插入進程成功
 //       FALSE 失敗
 BOOL InjectDll(char szDllFullPath[],DWORD dwRemoteProcessID)
 {
     HANDLE hRemoteProcess;
     if(EnableDebugPriv(SE_DEBUG_NAME) == 0)
     {
         return FALSE;
     }
     
     // 打開遠程線程
     if((hRemoteProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,FALSE,dwRemoteProcessID))== NULL)
     {
         return FALSE;
     }
     
     char * pszLibFileRemote;
     
     // 使用VirtualAllocEx函數在遠程進程內存地址空間分配DLL文件名緩衝區
     pszLibFileRemote = (char *)VirtualAllocEx( hRemoteProcess,NULL,lstrlen(szDllFullPath)+1,MEM_COMMIT,PAGE_READWRITE);
     if(pszLibFileRemote == NULL)
     {
         return FALSE;
     }
     
     if(WriteProcessMemory(hRemoteProcess,pszLibFileRemote,(void *)szDllFullPath,lstrlen(szDllFullPath)+1,NULL) == 0)
     {
         return FALSE;
     }
     
     PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE) GetProcAddress(GetModuleHandle("Kernel32"),"LoadLibraryA");
     if(pfnStartAddr == NULL)
     {
         return FALSE;
     }
     // 經過創建遠程鏈接的地址:pfnStartAddr
     // 傳遞參數 pszLibFileRemote 遠程啓動DLL
     // 啓動遠程線程 LoadLibraryA 經過遠程線程調用用戶的DLL文件
     HANDLE hRemoteThread;
     if((hRemoteThread = CreateRemoteThread(hRemoteProcess,NULL,0,pfnStartAddr,pszLibFileRemote,0,NULL)) == NULL)
     {
   CloseHandle(hRemoteThread);
         return FALSE;
     }
  CloseHandle(hRemoteThread);
     return TRUE;
 }
 ////////////////////////////////////////////////////////////////////////
 // 獲取進程ID號
 // 如無此進程則返回 0;
 // char szProcName[] 進程名: .exe文件.
 DWORD GetProcID(char szProcName[])
 {
     HANDLE th = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
     PROCESSENTRY32 pe = {sizeof(pe)};
     DWORD dwProcID = 0;
     BOOL bOK=Process32First(th,&pe);
     while(bOK)
     {
         bOK = Process32Next(th,&pe);
         LPCTSTR lpszExeFile = strrchr(pe.szExeFile,'//');
         if(lpszExeFile == NULL)
             lpszExeFile = pe.szExeFile;
         else
             lpszExeFile++;
         if(_stricmp(szProcName,lpszExeFile) == 0)
         {
                 dwProcID = pe.th32ProcessID;
                 break;
         }
     }
     return dwProcID;
 }
 ////////////////////////////////////////////////////////////////////////
 // 提高系統權限到DEBUG模式
 int EnableDebugPriv(char szName[])
 {
     HANDLE hToken;
     TOKEN_PRIVILEGES tp;
     LUID luid;
     
     // 打開進程環令牌
     if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
     {
         return 0;
     }
     
     if(!LookupPrivilegeValue(NULL,szName,&luid))
     {
         return 0;
     }
     
     tp.PrivilegeCount = 1;
     tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
     tp.Privileges[0].Luid = luid;
     // 調整權限
     if(!AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL))
     {
         return 0;
     }
     
     return 1;
 }