\u4e3b\u7a0b\u5e8f\u4ee3\u7801:<\/p>\n
#include <stdio.h>
\n#include <stdlib.h>
\n#include <string.h>
\n#include <conio.h>
\n#include <windows.h>
\n#include <tlhelp32.h><\/p>\n
bool Privilege()
\n{
\n \/\/\u63d0\u5347\u5f53\u524d\u8fdb\u7a0b\u7684\u8bbf\u95ee\u4ee4\u724c
\n HANDLE hToken=NULL;
\n
\n if(OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken)!=TRUE) return false;
\n TOKEN_PRIVILEGES tp;
\n tp.PrivilegeCount=1;
\n LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid);
\n tp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
\n AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);
\n
\n CloseHandle(hToken);
\n return true;
\n}<\/p>\n
bool ListProcess()
\n{
\n HANDLE hProcessSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL); \/\/\u83b7\u53d6\u8fdb\u7a0b\u5feb\u7167
\n if(hProcessSnapshot==INVALID_HANDLE_VALUE)
\n {
\n printf(“\u521b\u5efa\u8fdb\u7a0b\u5feb\u7167\u5931\u8d25!\\n”);
\n return false;
\n }
\n Privilege(); \/\/\u63d0\u5347\u4ee4\u724c\u6743\u9650
\n PROCESSENTRY32 pe32; \/\/\u7528\u6765\u5b58\u653e\u5feb\u7167\u8fdb\u7a0b\u4fe1\u606f\u7684\u7ed3\u6784\u4f53
\n \/*
\n typedef struct tagPROCESSENTRY32
\n {
\n DWORD dwSize;
\n DWORD cntUsage;
\n DWORD th32ProcessID;
\n ULONG_PTR th32DefaultHeapID;
\n DWORD th32ModuleID;
\n DWORD cntThreads;
\n DWORD th32ParentProcessID;
\n LONG pcPriClassBase;
\n DWORD dwFlags;
\n TCHAR szExeFile[MAX_PATH];
\n } PROCESSENTRY32, *PPROCESSENTRY32;
\n *\/
\n pe32.dwSize=sizeof(PROCESSENTRY32); \/\/\u5b58\u653e\u7ed3\u6784\u4f53\u5927\u5c0f
\n if(!Process32First(hProcessSnapshot,&pe32))
\n {
\n printf(“\u5217\u4e3e\u7b2c\u4e00\u4e2a\u8fdb\u7a0b\u5931\u8d25\u3002\\n”);
\n return false;
\n }
\n do
\n {
\n printf(“FileName:%s\\t\\t\\tPID:%d\\n”,pe32.szExeFile,pe32.th32ProcessID);
\n }
\n while(Process32Next(hProcessSnapshot,&pe32));<\/p>\n
return true;
\n}<\/p>\n
int main(int argc,char *argv[])
\n{
\n HANDLE hRemoteProcess;
\n HANDLE hRemoteThread;
\n DWORD dwRemoteProcess;
\n char DllPath[260];
\n DWORD size;<\/p>\n
ListProcess();
\n printf(“\u8bf7\u8f93\u5165\u8981\u6ce8\u5165\u8fdb\u7a0b\u7684ID:”);
\n if(scanf(“%d”,&dwRemoteProcess)!=1) return -1;<\/p>\n
hRemoteProcess=OpenProcess(PROCESS_ALL_ACCESS,false,dwRemoteProcess); \/\/\u6253\u5f00\u8fdc\u7a0b\u8fdb\u7a0b
\n if(hRemoteProcess==0)
\n {
\n printf(“\u6253\u5f00\u8fdb\u7a0b\u5931\u8d25\u3002\\n”);
\n getch();
\n return -1;
\n }<\/p>\n
memset(DllPath,NULL,sizeof(DllPath));
\n GetCurrentDirectoryA(sizeof(DllPath)-1,DllPath);
\n strcat(DllPath,”\\\\DLL.dll”);
\n LPVOID pRemoteDllPath=VirtualAllocEx(hRemoteProcess,NULL,strlen(DllPath)+1,MEM_COMMIT,PAGE_READWRITE); \/\/\u5728\u8fdb\u7a0b\u4e2d\u5f00\u8f9f\u7a7a\u95f4
\n if(pRemoteDllPath==NULL)
\n {
\n printf(“VirtualAlloc Error!\\n”);
\n getch();
\n return -1;
\n }<\/p>\n
if(WriteProcessMemory(hRemoteProcess,pRemoteDllPath,DllPath,strlen(DllPath)+1,&size)==0) \/\/\u5411\u8fdb\u7a0b\u7a7a\u95f4\u4e2d\u5199\u5165\u6570\u636e
\n {
\n printf(“WriteProcessMemory Error!\\n”);
\n getch();
\n return -1;
\n }<\/p>\n
\/\/\u83b7\u5f97\u8fdc\u7a0b\u8fdb\u7a0b\u4e2dLoadLibrary()\u7684\u5730\u5740
\n LPTHREAD_START_ROUTINE pLoadLibrary = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT(“kernel32.dll”)), \\
\n “LoadLibraryA”);
\n if (pLoadLibrary == NULL)
\n {
\n printf(“GetProcAddress error\\n”);
\n getch();
\n return -1;
\n }
\n if((hRemoteThread=CreateRemoteThread(hRemoteProcess,NULL,0,pLoadLibrary,pRemoteDllPath,0,NULL))==NULL)
\n {
\n printf(“\u521b\u5efa\u7ebf\u7a0b\u5931\u8d25\u3002\\n”);
\n getch();
\n return -1;
\n }
\n WaitForSingleObject(hRemoteThread,INFINITE);
\n \/\/\u91ca\u653e\u5360\u7528\u7684\u5185\u5b58
\n if(VirtualFreeEx(hRemoteProcess,pRemoteDllPath,0,MEM_RELEASE)==NULL)
\n {
\n printf(“VirtualFreeEx Error!\\n”);
\n getch();
\n return -1;
\n }
\n CloseHandle(hRemoteProcess);
\n CloseHandle(hRemoteThread);
\n printf(“\u7a0b\u5e8f\u7ed3\u675f\u3002\\n”);
\n getch();<\/p>\n
return 0;
\n}<\/p>\n
DLL\u6d4b\u8bd5\u4ee3\u7801:<\/p>\n
#include <windows.h>
\n#include <stdio.h><\/p>\n
BOOL APIENTRY DllMain(HINSTANCE hInstDll, DWORD fdwReason, PVOID fImpLoad)
\n{
\n switch (fdwReason)
\n {
\n case DLL_PROCESS_ATTACH : \/\/DLL\u6587\u4ef6\u6620\u88ab\u5c04\u5230\u8fdb\u7a0b\u7684\u5730\u5740\u7a7a\u95f4
\n MessageBox(NULL, “DLL has been mapped!”, NULL, MB_OK);
\n break;
\n case DLL_THREAD_ATTACH: \/\/\u8fdb\u7a0b\u4e2d\u6709\u7ebf\u7a0b\u88ab\u521b\u5efa\uff0c\u53ea\u6709\u5f53\u6240\u6709\u7684DLL\u90fd\u5904\u7406\u5b8c\u8fd9\u4e00\u901a\u77e5\u540e\uff0c\u7cfb\u7edf\u624d\u5141\u8bb8\u8fdb\u7a0b\u5f00\u59cb\u6267\u884c\u5b83\u7684\u7ebf\u7a0b\u51fd\u6570\u3002
\n MessageBox(NULL, “RemoteThread has been created!”, NULL, MB_OK);
\n break;
\n case DLL_THREAD_DETACH: \/\/\u7ebf\u7a0b\u8c03\u7528\u4e86ExitThread\u6765\u7ed3\u675f\u7ebf\u7a0b
\n MessageBox(NULL, “RemoteThread exit!”, NULL, MB_OK);
\n break;
\n case DLL_PROCESS_DETACH: \/\/DLL\u6587\u4ef6\u5728\u8fdb\u7a0b\u7a7a\u95f4\u5185\u88ab\u89e3\u9664\u6620\u5c04
\n MessageBox(NULL, “DLL has been unmapped!”, NULL, MB_OK);
\n break;
\n }
\n return TRUE;
\n}<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e3b\u7a0b\u5e8f\u4ee3\u7801:<\/p>\n
#include <stdio.h>
\n#include <stdlib.h>
\n#include <string.h>
\n#include <conio.h>
\n#include <windows.h>
\n#include <tlhelp32.h><\/p>\n
bool Privilege()
\n{
\n &nbs…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[324],"tags":[],"class_list":["post-40","post","type-post","status-publish","format-standard","hentry"],"yoast_head":"\n