#include?“stdafx.h“
#include?
#undef???UNICODE?
#include?
#include?
#include?

#define?INJECT_PROCESS_NAME????“explorer.exe“?//目標進程
typedef?WCHAR?WPATH[MAX_PATH];
typedef?DWORD64?（WINAPI?*PFNTCREATETHREADEX）??
	（???
	PHANDLE?????????????????ThreadHandle?????
	ACCESS_MASK?????????????DesiredAccess????
	LPVOID??????????????????objectAttributes?????
	HANDLE??????????????????ProcessHandle????
	LPTHREAD_START_ROUTINE??lpStartAddress???
	LPVOID??????????????????lpParameter??????
	BOOL????????????????????CreateSuspended??????
	DWORD64???????????????????dwStackSize??????
	DWORD64???????????????????dw1???
	DWORD64???????????????????dw2???
	LPVOID??????????????????Unknown???
	）;?

//函數前置聲明?
BOOL???CreateRemoteThreadLoadDll（LPCWSTR???lpwLibFile???DWORD64???dwProcessId）;?
BOOL???CreateRemoteThreadUnloadDll（LPCWSTR???lpwLibFile???DWORD64???dwProcessId）;?
HANDLE?MyCreateRemoteThread（HANDLE?hProcess?LPTHREAD_START_ROUTINE?pThreadProc?LPVOID?pRemoteBuf）;

BOOL???EnableDebugPrivilege（VOID）;?
int???AddPrivilege（LPCWSTR???*Name）;
void???GetWorkPath（???TCHAR???szPath[]???int???nSize???）;?

//全局變量聲明?
HANDLE???hProcessSnap=NULL;?????//進程快照句柄?
DWORD64???dwRemoteProcessId;???????//目標進程ID?

//---------------------------------------------------------------------?
//注入函數，調用該函數即可
int?injectDll（）
{
	BOOL?result?=?FALSE;
	//提升權限
	result?=?EnableDebugPrivilege（）;
	if（result?!=?TRUE）
	{
		printf（“add?privilege?failed!\n“）;
		return?-1;
	}
	PROCESSENTRY32???pe32={0};?
	//打開進程快照
	hProcessSnap=CreateToolhelp32Snapshot（TH32CS_SNAPPROCESS0）;?

	if（hProcessSnap==（HANDLE）-1）?
	{?
		return???-1;?
	}????

	pe32.dwSize=sizeof（PROCESSENTRY32）;?
	
	//獲取目標進程的ID
	if（Process32First（hProcessSnap&pe32））???//獲取第一個進程?
	{?
		do{?
			char?te[MAX_PATH];?
			strcpy（tepe32.szExeFile）;?
			if（strcmp（te?INJECT_PROCESS_NAME）?==?0）
			{?
				dwRemoteProcessId=pe32.th32ProcessID;?
				printf（“%d\n“dwRemoteProcessId）;
				break;?
			}?????
		}?????
		while（Process32Next（hProcessSnap&pe32））;//獲取下一個進程?
	}?
	else?
	{?
		return???-1;?
	}?


	WCHAR???wsz[MAX_PATH];?
	swprintf（wsz???L“%S?““F:\\hookdll.dll“）;?//dll地址

	LPCWSTR???p???=???wsz;?
	//在目標進程中創建線程并注入dll
	if（CreateRemoteThreadLoadDll（pdwRemoteProcessId））?
		return?1;
}

//---------------------------------------------------------------------?
//在目標進程中創建線程并注入dll
BOOL???CreateRemoteThreadLoadDll（LPCWSTR???lpwLibFile???DWORD64???dwProcessId）?
{?
	BOOL???bRet?=?FALSE;?
	HANDLE???hProcess?=?NULLhThread?=?NULL;?
	LPVOID?pszLibRemoteFile???=???NULL;
	SIZE_T?dwWritten?=?0;
	__try?
	{?
		//1.打開進程，同時申請權限，這里申請了PROCESS_ALL_ACCESS
		hProcess?=?OpenProcess（PROCESS_ALL_ACCESS?TRUE?dwProcessId）;
		if???（hProcess???==???NULL）?
			__leave;?

		int???cch???=???1???+???lstrlenW（lpwLibFile）;?
		int???cb???=???cch???*???sizeof（WCHAR）;?
		printf（“cb:%d\n“cb）;
		printf（“cb1:%d\n“sizeof（lpwLibFile））;
		//2.申

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件???????9536??2012-07-20?14:56??injectDLL.cpp

-----------?---------??----------?-----??----

?????????????????9536????????????????????1