#include<stdio.h>

 #include<Windows.h>

 #include<TlHelp32.h>

 //typedef unsigned long       DWORD;

 //typedef __nullterminated CONST CHAR *LPCSTR, *PCSTR;

 //typedef void *HANDLE;

 DWORD getProcessHandle(LPCTSTR lpProcessName)//根据进程名查找进程PID

 {

     DWORD dwRet=;

     HANDLE hSnapShot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,);/*CreateToolhelp32Snapshot函数为指定的进程、

                                                                     进程使用的堆[HEAP]、模块[MODULE]、

                                                                     线程[THREAD]）建立一个快照[snapshot]。*/

     if(hSnapShot==INVALID_HANDLE_VALUE)

     {

         //句柄无效

         printf("\n获得PID=%s的进程快照失败%d",lpProcessName,GetLastError());

         return dwRet;

     }

     //快照抓取成功

     PROCESSENTRY32 pe32;//声明进程入口对象

     pe32.dwSize=sizeof(PROCESSENTRY32 );//填充进程入口大小

     Process32First(hSnapShot,&pe32);//遍历进程列表

     do

     {

         if(!lstrcmp(pe32.szExeFile,lpProcessName))

         {

             dwRet=pe32.th32ProcessID;

             break;

         }

     }

     while(Process32Next(hSnapShot,&pe32));

     CloseHandle(hSnapShot);

     return dwRet;

 }

 void EnableDebugPriv()

 {

     HANDLE hToken;          // 进程访问令牌的句柄

     LUID luid;              // 用于存储调试权对应的局local unique identifier

     TOKEN_PRIVILEGES tkp;   // 要设置的权限

     OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);

     // 获取访问令牌

     LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);   // 获得调试权的luid

     tkp.PrivilegeCount = ; // 设置调试权

     tkp.Privileges[].Luid = luid;

     tkp.Privileges[].Attributes = SE_PRIVILEGE_ENABLED;

     AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof tkp, NULL, NULL); // 使进程拥有调试权

     CloseHandle(hToken);

 }  

 int main(int argc,char *argv[])

 {

     DWORD dwpid=getProcessHandle("calc.exe");

     LPCSTR lpDllName="D:\\WorkProject\\C++\\20160314\\DLLImport\\Debug\\dllDemo.dll";

     EnableDebugPriv();//权限提升

     HANDLE hProcess=OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE,dwpid);//获得要注入进程的句柄

     if(hProcess==NULL)

     {

         printf("\n获取进程句柄错误%d",GetLastError());

         return -;

     }

     DWORD dwSize=strlen(lpDllName)+;

     DWORD dwHasWrite;

     LPVOID lpRemoteBuf=VirtualAllocEx(hProcess,NULL,dwSize,MEM_COMMIT,PAGE_READWRITE);//在远程空间分配地址

     if(WriteProcessMemory(hProcess,lpRemoteBuf,lpDllName,dwSize,&dwHasWrite))//写入内存函数执行成功返回非零

     {

         if(dwHasWrite!=dwSize)

         {

             //写入内存不完整，释放内存

             VirtualFreeEx(hProcess,lpRemoteBuf,dwSize,MEM_COMMIT);

             CloseHandle(hProcess);

             return -;

         }

     }

     else

     {

         printf("\n写入远程进程内存空间出错%d",GetLastError());

         CloseHandle(hProcess);

         return -;

     }

     //写入成功

     DWORD dwNewThreadId;

     LPVOID lpLoadDll=LoadLibraryA;

     //将LoadLIbraryA作为线程函数,参数为Dll，创建新线程

     HANDLE hNewRemoteThread=CreateRemoteThread(hProcess,NULL,,(LPTHREAD_START_ROUTINE)lpLoadDll,lpRemoteBuf,,&dwNewThreadId);

     //HANDLE hNewRemoteThread=

     if(hNewRemoteThread==NULL)

     {

         printf("\n建立远程线程失败%d",GetLastError());

         CloseHandle(hProcess);

         return -;

     }

     //等待对象句柄返回

     WaitForSingleObject(hNewRemoteThread,INFINITE);

     CloseHandle(hNewRemoteThread);

      //准备卸载之前注入的Dll

     DWORD dwHandle,dwID;

     LPVOID pFunc = GetModuleHandleA;//获得在远程线程中被注入的Dll的句柄

     HANDLE hThread = CreateRemoteThread(hProcess,NULL,,(LPTHREAD_START_ROUTINE)pFunc,lpRemoteBuf,,&dwID);

     WaitForSingleObject(hThread,INFINITE);

     GetExitCodeThread(hThread,&dwHandle);//线程的结束码即为Dll模块儿的句柄

     CloseHandle(hThread);

     pFunc = FreeLibrary;

     hThread = CreateRemoteThread(hThread,NULL,,(LPTHREAD_START_ROUTINE)pFunc,(LPVOID)dwHandle,,&dwID); //将FreeLibraryA注入到远程线程中去卸载Dll

     WaitForSingleObject(hThread,INFINITE);

     CloseHandle(hThread);

     CloseHandle(hProcess);

     return ;

 }