Author:linshao

#include <windows.h> #include <iostream>int main() {//x64不能用宏，所以直接寫原函數，加載Kernel32.dll模塊，下面的內存操作api都是在此模塊里HMODULE a=LoadLibraryA("C:\\windows\\system32\\Kernel32.dll");if (a) {}else { printf("導入模塊失敗"); }//拿到進程句柄HANDLE h = OpenProcess(2097151, true, 16208);if (h) { printf("打開句柄成功\n"); }else { printf("打開句柄失敗"); }//定義要注入dll的路徑，下一步將他傳入注入目標的進程內存里, dll里面的代碼注意x86和x64位shellcodeconst char* s = "F:\\TEMP\\64.dll";printf(s); //在目標進程里面申請虛擬一塊內存存放dll路徑LPVOID pbuf=VirtualAllocEx(h, 0, strlen(s), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); if (!pbuf) {printf("申請內存失敗\n");}else {printf("申請內存成功\n");}//寫入內存區域BOOL aaa=WriteProcessMemory(h,pbuf,s, strlen(s),0); if (aaa){printf("寫入成功\n");}else{printf("寫入失敗\n");}//創建遠程線程，傳入LoadLibrary函數，參數為上面返回的目標進程里的dll路徑HANDLE hand3=CreateRemoteThread(h,0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pbuf,0,NULL);if (hand3!=NULL) {printf("注入成功\n");}else{printf("注入失敗\n");}HANDLE hand2 = CreateRemoteThread(h, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pbuf, 0, NULL);if (hand2 != NULL) { printf("注入成功\n"); }else { printf("注入失敗\n"); }HANDLE hand1 = CreateRemoteThread(h,NULL,0,(LPTHREAD_START_ROUTINE)LoadLibraryA,pbuf,0,NULL);//h, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, pbuf, 0, NULL);if (hand1 != NULL) { printf("注入成功\n"); }else { printf("注入失敗\n"); }WaitForSingleObject(h, -1);CloseHandle(h);return 0; }

湊文字：

#include <windows.h>
#include <iostream>

int main() {
?? ?//x64不能用宏，所以直接寫原函數，加載Kernel32.dll模塊，下面的內存操作api都是在此模塊里
?? ?HMODULE a=LoadLibraryA("C:\\windows\\system32\\Kernel32.dll");
?? ?if (a) {}
?? ?else { printf("導入模塊失敗"); }
?? ?//拿到進程句柄
?? ?HANDLE h = OpenProcess(2097151, true, 16208);
?? ?if (h) { printf("打開句柄成功\n"); }
?? ?else { printf("打開句柄失敗"); }

?? ?//定義要注入dll的路徑，下一步將他傳入注入目標的進程內存里, dll里面的代碼注意x86和x64位shellcode
?? ?const char* s = "F:\\TEMP\\64.dll";
?? ?printf(s);?? ?

?? ?//在目標進程里面申請虛擬一塊內存存放dll路徑
?? ?LPVOID pbuf=VirtualAllocEx(h, 0, strlen(s), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);?? ?
?? ?if (!pbuf) {printf("申請內存失敗\n");}else {printf("申請內存成功\n");}

?? ?//寫入內存區域
?? ?BOOL aaa=WriteProcessMemory(h,pbuf,s, strlen(s),0);?? ??? ?
?? ?if (aaa){printf("寫入成功\n");}else{printf("寫入失敗\n");}

?? ?//創建遠程線程，傳入LoadLibrary函數，參數為上面返回的目標進程里的dll路徑
?? ?HANDLE hand3=CreateRemoteThread(h,0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pbuf,0,NULL);
?? ?if (hand3!=NULL) {printf("注入成功\n");}else{printf("注入失敗\n");}

?? ?HANDLE hand2 = CreateRemoteThread(h, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pbuf, 0, NULL);
?? ?if (hand2 != NULL) { printf("注入成功\n"); }
?? ?else { printf("注入失敗\n"); }

?? ?HANDLE hand1 = CreateRemoteThread(h,NULL,0,(LPTHREAD_START_ROUTINE)LoadLibraryA,pbuf,0,NULL);
?? ??? ?//h, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, pbuf, 0, NULL);
?? ?if (hand1 != NULL) {?
?? ??? ?printf("注入成功\n");?
?? ??? ?
?? ?}
?? ?else { printf("注入失敗\n"); }
?? ?WaitForSingleObject(h, -1);
?? ?CloseHandle(h);
?? ?
?? ?return 0;
}

總結

以上是生活随笔為你收集整理的c++ dll注入的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。