detours将dll远程注入程序出现的有关问题！谢一辈子

detours将dll远程注入程序出现的问题！！谢一辈子
我看到一例子
HINSTANCE g_dll;
g_dll=LoadLibrary(”SleepHOOKDll.dll”);

貌似这个是注入当前进程吧

问如何远程注入呢？
explorer.exe
懂的人告诉我下比如如何注入explorer.exe

------解决方案--------------------
CreateRemoteThread
或
SetWindowHookEx
貌似都可以

------解决方案--------------------
explorer.exe还可以用Shell Extension
------解决方案--------------------
mobile平台没玩过，我的手机还是黑白屏的
------解决方案--------------------
CreateRemoteThread 容易被杀毒软件拦截。
用 Shell Extension 好点
------解决方案--------------------
我看到一例子
HINSTANCE g_dll;
g_dll=LoadLibrary(”SleepHOOKDll.dll”);

貌似这个是注入当前进程吧
===========
这个不能叫注入吧，这个只是加载DLL而已，注入要用SetWindowsHookEx下钩子或者用CreateRemoteThread 之类的
------解决方案--------------------

C/C++ code


BOOL InjectDLL()
{
    long pid = 0;
    int ret = 0;    
    char szDllPath[MAX_PATH] = {0};

    ret = GetSystemDirectory(szDllPath, MAX_PATH);
    if(szDllPath[ret - 1] != '\\')
        strcat(szDllPath, "\\");
    strcat(szDllPath, "InjectDll.dll");
    if(_access(szDllPath, 0) == -1)
    {
        return -1;
    }

    pid = GetProcessID("explorer.exe");
    if(pid == -1)
    {
        return FALSE;
    }

    HANDLE hProcess = NULL;
    HANDLE hRemoteThread = NULL;
    void *pLibRemote = NULL;
    DWORD hLibModule = 0;
    HMODULE hKernel32 = NULL;

    hKernel32 = GetModuleHandle("Kernel32");
    if(hKernel32 == NULL)
    {
        return FALSE;
    }

    hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE, pid);
    if(hProcess == NULL)
    {
        return FALSE;
    }

    pLibRemote = VirtualAllocEx(hProcess, NULL,sizeof(szDllPath),MEM_COMMIT,PAGE_READWRITE);

    ret = WriteProcessMemory(hProcess,pLibRemote,(void *) szDllPath,sizeof(szDllPath),NULL);
    if(ret == 0)
    {
        return FALSE;
    }

    hRemoteThread = CreateRemoteThread(hProcess,NULL, 0,(LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32, "LoadLibraryA"),pLibRemote,0,NULL);

    WaitForSingleObject(hRemoteThread, INFINITE);

    GetExitCodeThread(hRemoteThread, &hLibModule);

    CloseHandle(hRemoteThread);
    VirtualFreeEx(hProcess, pLibRemote, sizeof(szDllPath), MEM_RELEASE);

    CloseHandle(hProcess);
    return TRUE;
}

------解决方案--------------------

C/C++ code


DWORD GetProcessID(TCHAR pProcessName[])
{
    BOOL bRet;    
    HANDLE hProcessSnap;
    DWORD ProcessID = -1;
    PROCESSENTRY32 pe;
    pe.dwSize = sizeof(pe);

    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if(hProcessSnap == INVALID_HANDLE_VALUE)
    {
        return -1;
    }
    bRet = Process32First(hProcessSnap, &pe);
    while(bRet)
    {    
        if(lstrcmpi(pe.szExeFile, pProcessName) == 0)
        {
            ProcessID = pe.th32ProcessID;
            break;
        }

        bRet = Process32Next(hProcessSnap, &pe);
    }
    CloseHandle(hProcessSnap);
    return ProcessID;
}

detours将dll远程注入程序出现的有关问题！谢一辈子

相关推荐