// Injection.cpp : 定義控制檯應用程序的入口點。
//
#include "stdafx.h"
#include "Injection.h"
#ifdef _DEBUG
#define new DEBUG_NEW
#endif
// 唯一的應用程序對象
CWinApp theApp;
using namespace std;
typedef struct _RemotePara{//參數結構
char pMessageBox[12];
DWORD dwMessageBox;
}RemotePara;
//遠程線程
DWORD __stdcall ThreadProc (RemotePara *lpPara){
typedef int (__stdcall *MMessageBoxA)(HWND,LPCTSTR,LPCTSTR,DWORD);//定義MessageBox函數
MMessageBoxA myMessageBoxA;
myMessageBoxA =(MMessageBoxA) lpPara->dwMessageBox ;//得到函數入口地址
myMessageBoxA(NULL,lpPara->pMessageBox ,lpPara->pMessageBox,0);//call
return 0;
}
void EnableDebugPriv();//提升應用級調試權限
int _tmain(int argc, TCHAR* argv[], TCHAR* envp[])
{
const DWORD THREADSIZE=1024*4;
DWORD byte_write;
EnableDebugPriv();//提升權限
HANDLE hWnd = ::OpenProcess (PROCESS_ALL_ACCESS,FALSE,760);
if(!hWnd)return 0;
void *pRemoteThread =::VirtualAllocEx(hWnd,0,THREADSIZE,MEM_COMMIT| MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if(!pRemoteThread)return 0;
if(!::WriteProcessMemory(hWnd,pRemoteThread,&ThreadProc,THREADSIZE,0))
return 0;
//再付值
RemotePara myRemotePara;
::ZeroMemory(&myRemotePara,sizeof(RemotePara));
HINSTANCE hUser32 = ::LoadLibrary ("user32.dll");
myRemotePara.dwMessageBox =(DWORD) ::GetProcAddress (hUser32 , "MessageBoxA");
strcat(myRemotePara.pMessageBox,"hello/0");
//寫進目標進程
RemotePara *pRemotePara =(RemotePara *) ::VirtualAllocEx (hWnd ,0,sizeof(RemotePara),MEM_COMMIT,PAGE_READWRITE);//注意申請空間時的頁面屬性
if(!pRemotePara)return 0;
if(!::WriteProcessMemory (hWnd ,pRemotePara,&myRemotePara,sizeof myRemotePara,0))return 0;
//啓動線程
HANDLE hThread = ::CreateRemoteThread (hWnd ,0,0,(DWORD (__stdcall *)(void *))pRemoteThread ,pRemotePara,0,&byte_write);
if(!hThread){
return 0;
}
return 0;
}
void EnableDebugPriv( void )
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if ( ! OpenProcessToken( GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
return;
if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) ){
CloseHandle( hToken );
return;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) )
CloseHandle( hToken );
}
一份進程注入的代碼
發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章
獲得INTEL系列CPU序列號
//取得IntelCPU的ID號:void IntelCPUIDDlg::OnButtonCPUID(){ unsigned long s1,s2
kugou123
2020-06-21 14:33:54
WINAPI HOOK (修改前五個字節,JMP跳轉法)
kugou123
2020-06-21 14:33:53
獲取磁盤使用空間和剩餘空間(代碼)
char crDrv[3];CStringArray strArray;_ULARGE_INTEGER n64TotalNumberOfBytes,
kugou123
2020-06-21 14:33:42
在VC中使用WMI(英文原版)作者:BugSearcher
kugou123
2020-02-26 02:10:05
枚舉系統進程核心代碼(代碼)
kugou123
2018-08-31 01:54:47
用.DEF文件導出DLL中的函數
kugou123
2018-08-31 01:54:47
Windows 任務管理器如何確定應用程序"沒有響應"(收藏)
kugou123
2018-08-31 01:54:46
屏蔽WIN、ALT+TAB、CTRL+ESC鍵的低級鍵盤鉤子
kugou123
2018-08-31 01:54:46
FAQ200412:獲取系統有幾個邏輯分區
kugou123
2018-08-31 01:54:45