无DLL远程注入

界面如下：

主要代码如下：

 #define STRLEN 20

 typedef struct _DATA
 {
     DWORD dwLoadLibrary;
     DWORD dwGetProcAddress;
     DWORD dwGetModuleHandle;
     DWORD dwGetModuleFileName;

     char User32Dll[STRLEN];
     char MessageBox[STRLEN];
     char Str[STRLEN];
 }DATA, *PDATA;

 void CNoDllInjectDlg::OnBnClickedButtonInject()
 {
     // TODO: 在此添加控件通知处理程序代码
     UpdateData(TRUE);
     InjectCode(m_dwPid);
 }

 DWORD WINAPI RemoteThreadProc(LPVOID lpParam)
 {
     PDATA pData = (PDATA)lpParam;

     HMODULE (__stdcall *MyLoadLibrary)(LPCSTR);
     FARPROC (__stdcall *MyGetProcAddress)(HMODULE, LPCSTR);
     HMODULE (__stdcall *MyGetModuleHandle)(LPCSTR);
     int (__stdcall *MyMessageBox)(HWND, LPCSTR, LPCSTR, UINT);
     DWORD (__stdcall *MyGetModuleFileName)(HMODULE, LPSTR, DWORD);

     MyLoadLibrary = (HMODULE (__stdcall *)(LPCSTR))pData->dwLoadLibrary;
     MyGetProcAddress = (FARPROC (__stdcall *)(HMODULE, LPCSTR))pData->dwGetProcAddress;
     MyGetModuleHandle = (HMODULE (__stdcall *)(LPCSTR))pData->dwGetModuleHandle;
     MyGetModuleFileName = (DWORD (__stdcall *)(HMODULE, LPSTR, DWORD))pData->dwGetModuleFileName;

     HMODULE hModule = MyLoadLibrary(pData->User32Dll);
     MyMessageBox = (int (__stdcall *)(HWND, LPCSTR, LPCSTR, UINT))MyGetProcAddress(hModule, pData->MessageBox);
     char szModuleName[MAX_PATH] = {};
     MyGetModuleFileName(NULL, szModuleName, MAX_PATH);

     MyMessageBox(NULL, pData->Str, szModuleName, MB_OK);

     return ;
 }

 void CNoDllInjectDlg::InjectCode(DWORD dwPid)
 {
     DebugPrivilege();
     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
     if (NULL == hProcess)
     {
         AfxMessageBox(_T("OpenProcess Error!"));
         return;
     }

     DATA Data = {};
     Data.dwLoadLibrary = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
     Data.dwGetProcAddress = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetProcAddress");
     Data.dwGetModuleHandle = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetModuleHandleA");
     Data.dwGetModuleFileName = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetModuleFileNameA");

     strcpy(Data.User32Dll, "user32.dll");
     strcpy(Data.MessageBox, "MessageBoxA");
     strcpy(Data.Str, "Inject Code !!");

     LPVOID lpData = VirtualAllocEx(hProcess, NULL, sizeof(DATA), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
     DWORD dwWriteNum = ;
     WriteProcessMemory(hProcess, lpData, &Data, sizeof(DATA), &dwWriteNum);

     DWORD dwFunSize = 0x2000;
     LPVOID lpCode = VirtualAllocEx(hProcess, NULL, dwFunSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
     WriteProcessMemory(hProcess, lpCode, RemoteThreadProc, dwFunSize, &dwWriteNum);

     HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, , (LPTHREAD_START_ROUTINE)lpCode, lpData, , NULL);
     WaitForSingleObject(hRemoteThread, INFINITE);

     CloseHandle(hRemoteThread);
     CloseHandle(hProcess);
 }

 void CNoDllInjectDlg::DebugPrivilege(void)
 {
     HANDLE hToken = NULL;
     BOOL bRet = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken);
     if (TRUE == bRet)
     {
         TOKEN_PRIVILEGES tp;
         tp.PrivilegeCount = ;
         LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[].Luid);
         tp.Privileges[].Attributes = SE_PRIVILEGE_ENABLED;
         AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);

         CloseHandle(hToken);
     }
 }