简单的CreateRemoteThread例程(进程注入)

#include "stdafx.h"
#include <windows.h>
#include <iostream>
using namespace std;

// 保存数据的结构体
typedef struct tagRpcData
{
	char	m_szData[MAX_PATH];
	void*	m_pfunCall;
}stRpcData, *LPRPCDATA;

int const MAX_REMOTE_DATA = 1024 * 4;

typedef int(__stdcall* PFUNMESSAGE)(HWND, LPCTSTR, LPCTSTR, UINT);
int RemoteThread(HWND hwnd, LPCTSTR lpszContent);
DWORD __stdcall RpcFunc(LPRPCDATA pData);

int main()
{
	HWND hwnd = FindWindow("notepad", NULL);

	RemoteThread(hwnd, "Hello, andylin!");

	return 0;
};

//远程线程的函数
DWORD __stdcall RpcFunc(LPRPCDATA pData)
{
	PFUNMESSAGE pfunMsg = (PFUNMESSAGE)pData->m_pfunCall;
	pfunMsg(NULL, pData->m_szData, NULL, MB_OK);

	return 0;
}

int RemoteThread(HWND hwnd, LPCTSTR lpszContent)
{
	DWORD		dwThreadId	= 0;
	HANDLE		hProcess	= NULL;
	HINSTANCE	hInst		= NULL;

	//如果显示内容为NULL,直接返回失败!
	if ( (NULL == lpszContent) || (NULL == hwnd) )
	{
		cout << "err param!" << endl;
		return -1;
	}

	//打开进程
	::GetWindowThreadProcessId(hwnd, &dwThreadId);
	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwThreadId);

	if (NULL == hProcess)
	{
		cout << "Open Processs failed!" << endl;
		return -2;
	}	

	//初始化调用结构
	stRpcData stData = {0};
	strncpy(stData.m_szData, lpszContent, sizeof(stData.m_szData));

	hInst = ::LoadLibrary("user32.dll");
	if (!hInst)
	{
		cout << "can't load user32.dll" << endl;
		return -3;
	}

	stData.m_pfunCall = GetProcAddress(hInst, "MessageBoxA");
	FreeLibrary(hInst);

	if (NULL == stData.m_pfunCall)
	{
		cout << "get function address failed!" << endl;
		return -4;
	}

	//分配空间
	LPVOID pRmtFunc = VirtualAllocEx(hProcess, NULL, MAX_REMOTE_DATA, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	if (NULL == pRmtFunc)
	{
		cout << "Virtual Alloc Memory failed!" << endl;
		return -5;
	}

	if (!WriteProcessMemory(hProcess, pRmtFunc, RpcFunc, MAX_REMOTE_DATA, NULL))
	{
		cout << "write remote data failed!";
		return -6;
	}

	LPRPCDATA pstRmtData = (LPRPCDATA)VirtualAllocEx(hProcess, NULL, MAX_REMOTE_DATA, MEM_COMMIT, PAGE_READWRITE);
	if (NULL == pstRmtData)
	{
		cout << "Virtual Alloc Memory failed!" << endl;
		return -5;
	}

	if (!WriteProcessMemory(hProcess, pstRmtData, &stData, sizeof(stData), 0))
	{
		cout << "write remote data failed!";
		return -6;
	}


	//创建远程线程
	HANDLE hRmtThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRmtFunc, pstRmtData, 0, 0);

	if (NULL == hRmtThread)
	{
		cout << "create remote thread failed!" << endl;
		return -7;
	}

	//清除工作
	if (NULL != hRmtThread)
	{
		CloseHandle(hRmtThread);
		hRmtThread = NULL;
	}	

	if (NULL != hProcess)
	{
		VirtualFreeEx(hProcess, pRmtFunc, MAX_REMOTE_DATA, MEM_RELEASE);
		VirtualFreeEx(hProcess, pstRmtData, MAX_REMOTE_DATA, MEM_RELEASE);

		CloseHandle(hProcess);
		hProcess = NULL;
	}
	
	cout << "create remote thread succ!" << endl;

	return 0;
}

 

评论

1 楼 andylin02 2009-09-10  

编译成RELEASE版本就不会出错了,主要是DEBUG版本加了一个__chkesp的函数导致调用了非法地址