远程DLL注入

界面如下：

关键部分代码如下：

 void CInjectDllDlg::OnBnClickedButtonInject()
 {
     // TODO: 在此添加控件通知处理程序代码
     UpdateData(TRUE);
     int iBufSize = WideCharToMultiByte(CP_ACP, , m_strPathName.GetBuffer(), -, NULL, , NULL, NULL);
     char *pszBuffer = new char[iBufSize];
     WideCharToMultiByte(CP_ACP, , m_strPathName.GetBuffer(), -, pszBuffer, iBufSize, NULL, NULL);
     InjectDll(m_dwPid, pszBuffer);
     delete []pszBuffer;
     pszBuffer = NULL;
 }

 void CInjectDllDlg::OnBnClickedButtonUnload()
 {
     // TODO: 在此添加控件通知处理程序代码
     UpdateData(TRUE);
     int iBufSize = WideCharToMultiByte(CP_ACP, , m_strPathName.GetBuffer(), -, NULL, , NULL, NULL);
     char *pszBuffer = new char[iBufSize];
     WideCharToMultiByte(CP_ACP, , m_strPathName.GetBuffer(), -, pszBuffer, iBufSize, NULL, NULL);
     UnInjectDll(m_dwPid, pszBuffer);
     delete []pszBuffer;
     pszBuffer = NULL;
 }

 void CInjectDllDlg::InjectDll(DWORD dwPid, char* szDllName)
 {
     if (dwPid ==  || strlen(szDllName) == )
     {
         return;
     }

     char *pFunName = "LoadLibraryA";
     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
     if (NULL == hProcess)
     {
         return;
     }

     int iDllLen = strlen(szDllName) + sizeof(char);
     PVOID pDllAddr = VirtualAllocEx(hProcess, NULL, iDllLen, MEM_COMMIT, PAGE_READWRITE);
     if (NULL == pDllAddr)
     {
         CloseHandle(hProcess);
         return;
     }

     DWORD dwWriteNum = ;
     WriteProcessMemory(hProcess, pDllAddr, szDllName, iDllLen, &dwWriteNum);
     FARPROC pFunAddr = GetProcAddress(GetModuleHandleA("kernel32.dll"), pFunName);
     HANDLE hThread = CreateRemoteThread(hProcess, NULL, , (LPTHREAD_START_ROUTINE)pFunAddr, pDllAddr, , NULL);
     WaitForSingleObject(hThread, INFINITE);

     CloseHandle(hThread);
     CloseHandle(hProcess);
 }

 void CInjectDllDlg::UnInjectDll(DWORD dwPid, char* szDllName)
 {
     HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPid);
     MODULEENTRY32 Me32 = {};
     Me32.dwSize = sizeof(MODULEENTRY32);

     BOOL bRet = Module32First(hSnap, &Me32);
     while (bRet)
     {
         int iBufSize = WideCharToMultiByte(CP_ACP, , Me32.szExePath, -, NULL, , NULL, NULL);
         char *pszBuffer = new char[iBufSize];
         WideCharToMultiByte(CP_ACP, , Me32.szExePath, -, pszBuffer, iBufSize, NULL, NULL);
         if (strcmp(pszBuffer, szDllName) == )
         {
             delete []pszBuffer;
             pszBuffer = NULL;
             break;
         }
         delete []pszBuffer;
         pszBuffer = NULL;
         bRet = Module32Next(hSnap, &Me32);
     }
     CloseHandle(hSnap);
     char *pFunName = "FreeLibrary";

     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
     FARPROC pFunAddr = GetProcAddress(GetModuleHandleA("kernel32.dll"), pFunName);
     HANDLE hThread = CreateRemoteThread(hProcess, NULL, , (LPTHREAD_START_ROUTINE)pFunAddr, Me32.hModule, , NULL);
     WaitForSingleObject(hThread, INFINITE);

     CloseHandle(hThread);
     CloseHandle(hProcess);
 }

下载地址：

http://pan.baidu.com/s/1xk7Jw