IE8关于注入DLL解决方案

// host.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <windows.h>

#include <stdlib.h>

#include <stdio.h>

#include <Tlhelp32.h>

void CheckError ( int, int, char *); //出错处理函数

PDWORD pdwThreadId; 

HANDLE hRemoteThread, hRemoteProcess;

DWORD fdwCreate, dwStackSize, dwRemoteProcessId;

PWSTR pszLibFileRemote=NULL;
//提升权限
bool EnableDebugPriv() 

{

    HANDLE hToken;

    LUID sedebugnameValue;

    TOKEN_PRIVILEGES tkp;



    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))

        return false;



    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))

    {

        CloseHandle(hToken);

        return false;

    }



    tkp.PrivilegeCount = 1;

    tkp.Privileges[0].Luid = sedebugnameValue;

    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;



    if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
    {

        CloseHandle(hToken);
        return false;
    }
    return true;

}
//获得PID
DWORD GetProcessID(WCHAR FileName[260])
{
    HANDLE myhProcess;
    PROCESSENTRY32 mype;
    BOOL mybRet;
    //进行进程快照
    mype.dwSize =sizeof(mype);
    myhProcess=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); //TH32CS_SNAPPROCESS快照所有进程 
    mybRet=Process32First(myhProcess,&mype);
    //循环比较，得出ProcessID

    while(mybRet)
    {
        if(wcscmp(FileName,mype.szExeFile)==0)
            return mype.th32ProcessID;
        else
            mybRet=Process32Next(myhProcess,&mype);
    }
    return 0;
}

int _tmain(int argc, _TCHAR* argv[])
{

 if(!EnableDebugPriv())

     system("pause");

int iReturnCode;

char lpDllFullPathName[MAX_PATH];

WCHAR pszLibFileName[MAX_PATH]={0};

      const   char   *pFilePathName   = "iexplore.exe";   
      int   nLen   =   strlen(pFilePathName)   +   1;   
      int   nwLen   =   MultiByteToWideChar(CP_ACP,   0,   pFilePathName,   nLen,   NULL,   0);   
    
      TCHAR   lpszFile[260];   
      MultiByteToWideChar(CP_ACP,   0,   pFilePathName,   nLen,   lpszFile,   nwLen);


dwRemoteProcessId = GetProcessID(lpszFile);

strcpy(lpDllFullPathName, "C:\\Windows\\VeryNB.dll");

//将DLL文件全路径的ANSI码转换成UNICODE码

iReturnCode = MultiByteToWideChar(CP_ACP, MB_ERR_INVALID_CHARS,

lpDllFullPathName, strlen(lpDllFullPathName),

pszLibFileName, MAX_PATH);

CheckError(iReturnCode, 0, "MultByteToWideChar");

//打开远程进程

hRemoteProcess = OpenProcess(/*PROCESS_CREATE_THREAD | //允许创建线程 

PROCESS_VM_OPERATION | //允许VM操作

PROCESS_VM_WRITE, //允许VM写*/PROCESS_ALL_ACCESS, 

FALSE, dwRemoteProcessId ); 

CheckError( (int) hRemoteProcess, NULL, "Remote Process not Exist or Access Denied!");

//计算DLL路径名需要的内存空间

int cb = (1 + lstrlenW(pszLibFileName)) * sizeof(WCHAR);

pszLibFileRemote = (PWSTR) VirtualAllocEx( hRemoteProcess, NULL, cb, MEM_COMMIT, PAGE_READWRITE);

CheckError((int)pszLibFileRemote, NULL, "VirtualAllocEx");

//将DLL的路径名复制到远程进程的内存空间

iReturnCode = WriteProcessMemory(hRemoteProcess, pszLibFileRemote, (PVOID) pszLibFileName, cb, NULL);

CheckError(iReturnCode, false, "WriteProcessMemory");

//计算LoadLibraryW的入口地址 

PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)

GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW");

CheckError((int)pfnStartAddr, NULL, "GetProcAddress");

//启动远程线程，通过远程线程调用用户的DLL文件 

hRemoteThread = CreateRemoteThread( hRemoteProcess, NULL, 0, pfnStartAddr, pszLibFileRemote, 0, NULL);

CheckError((int)hRemoteThread, NULL, "Create Remote Thread");

//等待远程线程退出

WaitForSingleObject(hRemoteThread, INFINITE);

//清场处理

if (pszLibFileRemote != NULL)

{

VirtualFreeEx(hRemoteProcess, pszLibFileRemote, 0, MEM_RELEASE);

}

if (hRemoteThread != NULL) 

{

CloseHandle(hRemoteThread );

}

if (hRemoteProcess!= NULL) 

{

CloseHandle(hRemoteProcess);

}

}

//错误处理函数CheckError()

void CheckError(int iReturnCode, int iErrorCode, char *pErrorMsg)

{

if(iReturnCode==iErrorCode)

{

printf("%s Error:%d\n\n", pErrorMsg, GetLastError());
system("pause");

//清场处理

if (pszLibFileRemote != NULL)

{

VirtualFreeEx(hRemoteProcess, pszLibFileRemote, 0, MEM_RELEASE);

}

if (hRemoteThread != NULL) 

{

CloseHandle(hRemoteThread );

}

if (hRemoteProcess!= NULL)

{

CloseHandle(hRemoteProcess);

}

exit(0);

}

}