#include <stdio.h>02 | #include <tchar.h> |
03 | #include <windows.h> |
04 | #include <atlbase.h> |
05 |
06 | BOOL EnableDebugPriv(LPCTSTR name) |
07 | { |
08 | HANDLE h; |
09 | TOKEN_PRIVILEGES tp; |
10 | LUID id; |
11 |
12 | // 打开进程令牌环 |
13 | if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &h)) |
14 | return FALSE; |
15 |
16 | // 获得进程本地唯一ID |
17 | if (!LookupPrivilegeValue(NULL, name, &id)) |
18 | return FALSE; |
19 |
20 | tp.PrivilegeCount = 1; |
21 | tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; |
22 | tp.Privileges[0].Luid = id; |
23 |
24 | // 调整权限 |
25 | if (!AdjustTokenPrivileges(h, 0, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) |
26 | return FALSE; |
27 |
28 | return TRUE; |
29 | } |
30 |
31 | BOOL InjectDll(LPCTSTR dll_full_path, DWORD remote_process_id) |
32 | { |
33 | HANDLE h; |
34 |
35 | if (!EnableDebugPriv(SE_DEBUG_NAME)) |
36 | return FALSE; |
37 |
38 | // 打开远程线程. |
39 | h = OpenProcess(PROCESS_ALL_ACCESS, FALSE, remote_process_id); |
40 | if (!h) |
41 | return FALSE; |
42 |
43 | DWORD size = _tcsclen(dll_full_path) + 1; |
44 |
45 | // 使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名空间 |
46 | LPVOID r = VirtualAllocEx(h, NULL, size, MEM_COMMIT, PAGE_READWRITE); |
47 | if (!r) |
48 | return FALSE; |
49 |
50 | // 使用WriteProcessMemory函数将DLL的路径名写入到远程进程的内存空间 |
51 | if (!WriteProcessMemory(h, r, (void *)dll_full_path, size, NULL)) |
52 | return FALSE; |
53 |
54 | // 计算LoadLibraryA的入口地址 |
55 | PTHREAD_START_ROUTINE start = |
56 | (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryA"); |
57 | if (!start) |
58 | return FALSE; |
59 |
60 | // (关于GetModuleHandle函数和GetProcAddress函数) |
61 | // 启动远程线程LoadLibraryA，通过远程线程调用创建新的线程. |
62 | DWORD tid; |
63 | HANDLE t = CreateRemoteThread(h, NULL, 0, start, r, 0, &tid); |
64 | if(!t) |
65 | return FALSE; |
66 |
67 | WaitForSingleObject(t, INFINITE); |
68 |
69 | // 释放资源和句柄 |
70 | VirtualFreeEx(h, r, size, MEM_DECOMMIT); |
71 | CloseHandle(t); |
72 | CloseHandle(h); |
73 |
74 | return TRUE; |
75 | } |
76 |
77 | int main(int argc, char **argv) |
78 | { |
79 | if (argc < 3) |
80 | { |
81 | printf("usage: InjectDll.exe <dll_path> <process_id>\n"); |
82 | return -1; |
83 | } |
84 |
85 | TCHAR dll[MAX_PATH]; |
86 | int id = atoi(argv[2]); |
87 |
88 | USES_CONVERSION; |
89 | _tcscpy(dll, A2T(argv[1])); |
90 |
91 | if (!InjectDll(dll, id)) |
92 | { |
93 | printf("inject dll failed!\n"); |
94 | return -1; |
95 | } |
96 |
97 | return 0; |
98 | } |