无论我在哪里看到通过CreateRemoteThread注入的方法都是一样的,但抓取进程ID的方法不是......我的函数将返回正确的进程ID,我对此没有任何帮助,所以我将该部分取消,仅包括实际注射。
我只是学习DLL注入而且我正在尝试使用notepad.exe。如果注射工作,记事本的标题将从“无标题 - 记事本”变为“挂钩”。
#define DLL_NAME "injectme.dll"
.....
BOOL InjectRemoteThread(DWORD ProcessID)
{
HANDLE RemoteProc;
char buf[50] = {0};
LPVOID MemAlloc;
LPVOID LoadLibAddress;
// Process ID does show correctly!
WCHAR id[100];
StringCbPrintf(id, 100, L"%d", ProcessID); // id contains the process ID... is confirmed in comparing ID shown in tasklist and the messagebox.
MessageBox(NULL, id, L"Process ID", MB_ICONINFORMATION);
// Process ID does show correctly!
if ( !ProcessID )
{
MessageBox(NULL, (LPCWSTR)GetLastError(), L"An error occured", NULL);
return 0;
}
RemoteProc = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, ProcessID);
if ( !RemoteProc )
{
MessageBox(NULL, (LPCWSTR)GetLastError(), L"An error occured", NULL);
return 0;
}
LoadLibAddress = (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
MemAlloc = (LPVOID)VirtualAllocEx(RemoteProc, NULL, strlen(DLL_NAME)+1, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(RemoteProc, (LPVOID)MemAlloc, DLL_NAME, strlen(DLL_NAME)+1, NULL);
CreateRemoteThread(RemoteProc, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddress, (LPVOID)MemAlloc, NULL, NULL);
CloseHandle(RemoteProc);
VirtualFreeEx(RemoteProc, (LPVOID)MemAlloc, 0, MEM_RELEASE | MEM_DECOMMIT);
return 1;
}
DLL使用另一个人的注射器,但我不明白为什么...... 它确实与注射器位于同一目录中。
答案 0 :(得分:6)
我发现了问题......我觉得很蠢。 任何有类似问题的人:使用绝对路径而不是相对路径。
我改变了
#define DLL_NAME "injectme.dll"
要
#define DLL_NAME "C:\\Users\\Raikazu\\Documents\\Visual Studio 2012\\Projects\\Hooking\\Release\\injectme.dll"