远程线程进行DLL注入

#include "stdafx.h"#include <windows.h>#include <stdio.h>DWORD Threads(LPVOID s){  for(;;){    Sleep(1000);    printf("线程注入OK...n");  }}BOOL APIENTRY DllMain( HANDLE hModule,                        DWORD  ul_reason_for_call,                        LPVOID lpReserved           ){  switch(ul_reason_for_call){  case DLL_PROCESS_ATTACH:    CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)Threads,0,0,NULL);    break;    }      return TRUE;}

//被执行的代码
#include "stdafx.h"
void fun(){
  for(int i=0;i<=10;i++){    Sleep(1000);    printf("Fun()...n");  }}
DWORD threads(LPVOID s){  fun();  return 0;}
int main(int argc, char* argv[]){  HANDLE handle = CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)threads,0,0,NULL);  getchar();  return 0;}

1.获取进程句柄  2.计算dll名字  3.给目标进程申请空间 4.拷贝dll进去   5.获取模块地址  6.获取函数地址7.创建远程线程 加载dll    8.关闭句柄

#include "stdafx.h"#include <windows.h>void LoadDll(DWORD Did,char* pathname){  //1.获取进程句柄  HANDLE hprocess = OpenProcess(PROCESS_ALL_ACCESS,NULL,Did);  //2.计算dll名字  DWORD dwlength = strlen(pathname)+1;  //3.给目标进程申请空间  LPSTR FileRemote = (LPSTR)VirtualAllocEx(hprocess,NULL,dwlength,MEM_COMMIT,PAGE_READWRITE);  //4.拷贝dll进去  WriteProcessMemory(hprocess,(LPVOID)FileRemote,(LPVOID)pathname,dwlength,NULL);  //5.获取模块地址  HMODULE hkernel = GetModuleHandle("Kernel32.dll");  //6.获取函数地址  DWORD loadaddr =(DWORD)GetProcAddress(hkernel,"LoadLibraryA");  //7.创建远程线程 加载dll 
  DWORD threadID;  HANDLE t = CreateRemoteThread(hprocess,NULL,0,(LPTHREAD_START_ROUTINE)loadaddr,(LPVOID)FileRemote,0,&threadID);  //8.关闭句柄  CloseHandle(t);

}int main(int argc, char* argv[]){  LoadDll(14144,"C:\Users\Administrator\Desktop\ASD.dll");//PID和DLL  printf("按下回车终止n");  getchar();  return 0;}