无DLL线程注入

注意要在release方式编译

//线程函数

DWORD WINAPI RemoteThreadProc(LPVOID lpParam)

{

     PDATA pData = (PDATA)lpParam;



     //定义API函数原型

     HMODULE (_stdcall *MyLoadLibrary)(LPCTSTR);

     FARPROC (_stdcall *MyGetProcAddress)(HMODULE,LPCSTR);

     HMODULE (_stdcall *MyGetModuleHandle)(LPCTSTR);

     int (_stdcall *MyMessageBox)(HWND , LPCTSTR , LPCTSTR,UINT);

     DWORD (_stdcall *MyGetModuleFileName)(HMODULE , LPTSTR , DWORD);



     MyLoadLibrary = (HMODULE (_stdcall *) (LPCTSTR)) pData ->dwLoadLibrary;

     MyGetProcAddress = (FARPROC(_stdcall *)(HMODULE,LPCSTR))pData ->dwGetProcAddress;

     MyGetModuleHandle = (HMODULE (_stdcall *)(LPCSTR))pData ->dwGetModuleHandle;

     MyGetModuleFileName = (DWORD (_stdcall *)(HMODULE,LPTSTR,DWORD nSize))pData ->dwGetModuleFileName;



     HMODULE hModule = MyLoadLibrary( pData ->User32Dll);

     MyMessageBox = (int (_stdcall *)(HWND , LPCTSTR ,LPCTSTR,UINT))MyGetProcAddress

          (hModule , pData->MessageBox);

     char szModuleName[MAX_PATH] = {0};

     MyGetModuleFileName(NULL,szModuleName,MAX_PATH);



     MyMessageBox(NULL,pData->Str,szModuleName,MB_OK);

    

     return 0;

}



void CNoDllInjectDlg::InjectCode(DWORD dwPid)

{

     DWORD error = 0;

     //提升权限

     DebugPrivilege();



     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);

     if( hProcess == NULL)

     {

          MessageBox("OpenProcess Error");

          error = GetLastError();

          return ;

     }



     DATA Data = {0};

     Data.dwLoadLibrary = (DWORD)GetProcAddress(

                              GetModuleHandle("kernel32.dll"),

                              "LoadLibraryA");

     Data.dwGetProcAddress = (DWORD)GetProcAddress(

                                   GetModuleHandle("kernel32.dll"),

                                   "GetProcAddress");

     Data.dwGetModuleHandle = (DWORD)GetProcAddress(

                                   GetModuleHandle("kernel32.dll"),

                                   "GetModuleHandleA");

     Data.dwGetModuleFileName = (DWORD)GetProcAddress(

                                   GetModuleHandleA("kernel32.dll"),

                                   "GetModuleFileNameA");



     lstrcpy(Data.User32Dll , "user32.dll");

     lstrcpy(Data.MessageBox,"MessageBoxA");

     lstrcpy(Data.Str , "Inject Code !!!");



     LPVOID lpData = VirtualAllocEx(hProcess,

                                   NULL,

                                   sizeof(DATA),

                                   MEM_COMMIT | MEM_RESERVE,

                                   PAGE_READWRITE);

     DWORD dwWriteNum = 0;

     WriteProcessMemory(hProcess , lpData , &Data, sizeof(DATA) , &dwWriteNum);



     DWORD dwFunSize = 0x2000;

     LPVOID lpCode = VirtualAllocEx(hProcess,

                                   NULL,

                                   dwFunSize,

                                   MEM_COMMIT,

                                   PAGE_EXECUTE_READWRITE);

     WriteProcessMemory(hProcess , lpCode , RemoteThreadProc , dwFunSize , &dwWriteNum);



     HANDLE hRemoteThread = CreateRemoteThread(hProcess,

                                             NULL,

                                             0,

                                             (LPTHREAD_START_ROUTINE)lpCode,

                                             lpData,

                                             0,

                                             NULL);

     WaitForSingleObject(hRemoteThread,INFINITE);



     CloseHandle(hRemoteThread);

     CloseHandle(hProcess);



}





void CNoDllInjectDlg::OnBtnInject()

{

     // TODO: Add your control notification handler code here

     CString str;

     GetDlgItemText(IDC_EDIT_INJECT,str);

     InjectCode(atoi(str.GetBuffer(str.GetLength())));

}



void CNoDllInjectDlg::DebugPrivilege()

{

     HANDLE hToken = NULL;

     //打开当前进程的访问令牌

     int hRet = OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken);

    

     if( hRet)

     {

          TOKEN_PRIVILEGES tp;

          tp.PrivilegeCount = 1;

          //取得描述权限的LUID

          LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid);

          tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

          //调整访问令牌的权限

          AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);

         

          CloseHandle(hToken);

     }

    

}