创建进程注入DLL源码

Team莫寒

创建进程注入DLL源码

1. //创建进程注入DLL
   
2. BOOL CreateProcessWithDll(
   
3.     LPCTSTR lpApplicationName,
   
4.     LPTSTR  lpCommandLine,
   
5.     LPCTSTR lpCurrentDirectory,
   
6.     LPCTSTR lpDllPath,
   
7.     LPSTARTUPINFO lpStartupInfo,
   
8.     LPPROCESS_INFORMATION
   
9.     lpProcessInformation)
   
10. {
    
11.     if (!CreateProcess(lpApplicationName, lpCommandLine, nullptr, nullptr, FALSE, CREATE_SUSPENDED, nullptr, lpCurrentDirectory, lpStartupInfo, lpProcessInformation))
    
12.         return FALSE;
    
13. 
    
14.     HANDLE hProcess = lpProcessInformation->hProcess;
    
15.     HANDLE hThread = lpProcessInformation->hThread;
    
16. 
    
17.     CONTEXT ct = { 0 };
    
18.     ct.ContextFlags = CONTEXT_ALL;
    
19.     GetThreadContext(hThread, &ct);
    
20. 
    
21.     BYTE * pProcessMem = (BYTE *)::VirtualAllocEx(hProcess, NULL, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    
22.     if (!pProcessMem) return FALSE;
    
23. 
    
24.     DWORD dwWrited = 0;
    
25. 
    
26.     ::WriteProcessMemory(hProcess, (pProcessMem + 0x100), lpDllPath, _tcslen(lpDllPath)*sizeof(TCHAR) +1, &dwWrited);
    
27. 
    
28.     FARPROC pLoadLibrary = NULL;
    
29. 
    
30. #ifdef UNICODE
    
31.     pLoadLibrary = (FARPROC)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryW");
    
32. #else
    
33.     pLoadLibrary = (FARPROC)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryA");
    
34. #endif
    
35. 
    
36. 
    
37.     BYTE shellcode[] = { 0x60, 0x9C, 0x68, 0x90, 0x90, 0x90, 0x90, 0xB8, 0x90, 0x90, 0x90, 0x90, 0xFF, 0xD0, 0x9D, 0x61, 0x68, 0x90, 0x90, 0x90, 0x90, 0xC3 };
    
38.    
    
39.     DWORD *pdwAddr = NULL;
    
40.     pdwAddr = (DWORD *)&shellcode[3];    *pdwAddr = (DWORD)(pProcessMem + 0x100); //dllpath
    
41.     pdwAddr = (DWORD *)&shellcode[8];    *pdwAddr = (DWORD)pLoadLibrary;
    
42.     pdwAddr = (DWORD *)&shellcode[17];    *pdwAddr = (DWORD)ct.Eip;
    
43. 
    
44.     ::WriteProcessMemory(hProcess, pProcessMem, &shellcode, sizeof(shellcode), &dwWrited);
    
45. 
    
46.     ct.Eip = (DWORD)pProcessMem;
    
47.     ::SetThreadContext(hThread, &ct);
    
48.     ResumeThread(hThread);
    
49.     return TRUE;
    
50. }

复制代码

联系我时，请说是在 挂海论坛 上看到的，谢谢！

n69l67399

向楼主学习

爱情里么小三╮

一直在看

zhang_game

垃圾内容，路过为证。

ghost_z

顶顶更健康

jockerzoo

元芳你怎么看？

嗷嗷叫的老马

帖子不错 万一火了呢

xiaocoa

就不告诉你，就不告诉你，就不~告诉你！

yinghao20

回复就能得海币，我爱你！