Team莫寒 发表于 2015-2-5 22:40:58

创建进程注入DLL源码

创建进程注入DLL源码

//创建进程注入DLL
BOOL CreateProcessWithDll(
    LPCTSTR lpApplicationName,
    LPTSTRlpCommandLine,
    LPCTSTR lpCurrentDirectory,
    LPCTSTR lpDllPath,
    LPSTARTUPINFO lpStartupInfo,
    LPPROCESS_INFORMATION
    lpProcessInformation)
{
    if (!CreateProcess(lpApplicationName, lpCommandLine, nullptr, nullptr, FALSE, CREATE_SUSPENDED, nullptr, lpCurrentDirectory, lpStartupInfo, lpProcessInformation))
      return FALSE;

    HANDLE hProcess = lpProcessInformation->hProcess;
    HANDLE hThread = lpProcessInformation->hThread;

    CONTEXT ct = { 0 };
    ct.ContextFlags = CONTEXT_ALL;
    GetThreadContext(hThread, &ct);

    BYTE * pProcessMem = (BYTE *)::VirtualAllocEx(hProcess, NULL, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (!pProcessMem) return FALSE;

    DWORD dwWrited = 0;

    ::WriteProcessMemory(hProcess, (pProcessMem + 0x100), lpDllPath, _tcslen(lpDllPath)*sizeof(TCHAR) +1, &dwWrited);

    FARPROC pLoadLibrary = NULL;

#ifdef UNICODE
    pLoadLibrary = (FARPROC)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryW");
#else
    pLoadLibrary = (FARPROC)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryA");
#endif


    BYTE shellcode[] = { 0x60, 0x9C, 0x68, 0x90, 0x90, 0x90, 0x90, 0xB8, 0x90, 0x90, 0x90, 0x90, 0xFF, 0xD0, 0x9D, 0x61, 0x68, 0x90, 0x90, 0x90, 0x90, 0xC3 };
   
    DWORD *pdwAddr = NULL;
    pdwAddr = (DWORD *)&shellcode;    *pdwAddr = (DWORD)(pProcessMem + 0x100); //dllpath
    pdwAddr = (DWORD *)&shellcode;    *pdwAddr = (DWORD)pLoadLibrary;
    pdwAddr = (DWORD *)&shellcode;    *pdwAddr = (DWORD)ct.Eip;

    ::WriteProcessMemory(hProcess, pProcessMem, &shellcode, sizeof(shellcode), &dwWrited);

    ct.Eip = (DWORD)pProcessMem;
    ::SetThreadContext(hThread, &ct);
    ResumeThread(hThread);
    return TRUE;
}

n69l67399 发表于 2015-2-9 14:27:07

向楼主学习

爱情里么小三╮ 发表于 2015-3-5 20:15:17

一直在看

zhang_game 发表于 2015-3-10 20:36:24

垃圾内容，路过为证。

ghost_z 发表于 2015-3-27 18:46:46

顶顶更健康

jockerzoo 发表于 2015-3-29 04:15:02

元芳你怎么看？

嗷嗷叫的老马 发表于 2015-5-21 14:51:12

帖子不错 万一火了呢

xiaocoa 发表于 2015-6-9 18:19:22

就不告诉你，就不告诉你，就不~告诉你！

yinghao20 发表于 2015-8-9 17:22:05

回复就能得海币，我爱你！
页: [1]
查看完整版本: 创建进程注入DLL源码