测试环境
ϵͳ:Windows 10 64bit
注入目标: Ps2模拟器
主要思路:
1.使用进程PID打开进程,获得句柄
2.使用进程句柄申请内存空间
3.把dll路径写入内存
4.创建远程线程,调用LoadLibrary
5.释放收尾工作或者卸载dll
主要函数:
主要代码:
1 bool InjectDll(SIZE_T szPid) 2 { 3 //1.远线程注入 4 HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, 5 NULL, szPid); 6 7 if (hProcess == INVALID_HANDLE_VALUE) { 8 printf("打开进程失败！"); 9 return false; 10 } 11 //2.在远程进程中申请空间 12 LPVOID pszDllName = VirtualAllocEx(hProcess, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE); 13 //3.在远程进程中写入数据 14 TCHAR* szDllName = PATH; 15 if (!WriteProcessMemory(hProcess, pszDllName, szDllName, MAX_PATH, NULL)) { 16 return false; 17 } 18 //4.在远程进程中创建远程线程 19 HANDLE hlnjecthread = CreateRemoteThread( 20 hProcess, //远程进程句柄 21 NULL, //安全属性 22 0, //栈大小 23 (LPTHREAD_START_ROUTINE)LoadLibrary, //进程处理函数 24 pszDllName, //传入参数 25 NULL, //默认创建后的状态 26 NULL); //线程ID 27 28 if (hlnjecthread == NULL) { 29 return false; 30 } 31 //5.等待线程结束返回 32 DWORD dw = WaitForSingleObject(hlnjecthread, -1); 33 //6.获取线程退出码，即LoadLibray的返回值，即Dll的首地址 34 DWORD dwExitCode; 35 GetExitCodeThread(hlnjecthread, &dwExitCode); 36 HMODULE hMod = (HMODULE)dwExitCode; 37 //7.释放空间 38 if (!VirtualFreeEx(hProcess, pszDllName, 4096, MEM_DECOMMIT)) { 39 return false; 40 } 41 CloseHandle(hProcess); 42 43 return true; 44 } DLL代码:
1 BOOL CDllForPsApp::InitInstance() 2 { 3 CWinApp::InitInstance(); 4 //__debugbreak(); 5 OutputDebugString(L"注入成功！"); 6 7 CString Cstr; 8 Cstr.Format(L"原资源:%d,原资源:%d", 9 *g_pCapital, *g_pResources); 10 OutputDebugString(Cstr.GetBuffer()); 11 12 *g_pCapital = 5555555; 13 *g_pResources = 5555555; 14 15 return TRUE; 16 } 注入效果:
来源：博客园
作者：Adolph_J
链接：https://www.cnblogs.com/Schicksal/p/11435081.html