EnhanceFunc__增强函数集

想将经常用到的功能函数写在一起,花时间精心维护,然后以后就用起来就舒服很多了

目前就写了进程调试权限,远程线程注入,远程线程释放这三个函数.还有很多功能,以后慢慢加

 // last code by gwsbhqt@163.com at 20150708

 #pragma once

 #ifndef ENHANCEFUNC_H
 #define ENHANCEFUNC_H

 #include <cstdio>
 #include <windows.h>

 using namespace std;

 BOOL EnableDebugPrivileges();

 HANDLE RemoteThreadInjection(HANDLE hProcess, LPCSTR lpLibFilePath, LPDWORD lpRemoteThreadId = NULL);
 BOOL RemoteThreadFreeing(HANDLE hProcess, LPCSTR lpLibFilePath, DWORD dwMilliseconds = INFINITE);

 #endif    //    def    ENHANCEFUNC_H

EnhanceFunc.h

 // last code by gwsbhqt@163.com at 20150708

 #include "EnhanceFunc.h"

 BOOL EnableDebugPrivileges()
 {
     HANDLE hToken;
     if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken))
         return FALSE;

     LUID luid = {};
     if (!LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &luid))
     {
         CloseHandle(hToken);
         return FALSE;
     }

     TOKEN_PRIVILEGES tp = {};
     tp.PrivilegeCount = ;
     tp.Privileges[].Luid = luid;
     tp.Privileges[].Attributes = SE_PRIVILEGE_ENABLED;
     if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL))
     {
         CloseHandle(hToken);
         return FALSE;
     }

     CloseHandle(hToken);
     return TRUE;
 }

 HANDLE RemoteThreadInjection(HANDLE hProcess, LPCSTR lpLibFilePath, LPDWORD lpRemoteThreadId)
 {
     int len = strlen(lpLibFilePath) + ;

     LPVOID lpVir = VirtualAllocEx(hProcess, NULL, len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
     if (NULL == lpVir)
         return ERROR;

     if (!WriteProcessMemory(hProcess, lpVir, lpLibFilePath, len, NULL))
     {
         VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
         return ERROR;
     }

     HMODULE hModule = GetModuleHandleA("Kernel32.dll");
     if (NULL == hModule)
     {
         hModule = LoadLibraryA("Kernel32.dll");
         if (NULL == hModule)
         {
             VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
             return ERROR;
         }
     }

     FARPROC fpProc = GetProcAddress(hModule, "LoadLibraryA");
     if (NULL == fpProc)
     {
         FreeLibrary(hModule);
         VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
         return ERROR;
     }

     DWORD dwRemoteThreadId;
     HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)fpProc, lpVir, NULL, &dwRemoteThreadId);
     if (NULL == hRemoteThread)
     {
         FreeLibrary(hModule);
         VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
         return ERROR;
     }

     if (NULL != lpRemoteThreadId)
         *lpRemoteThreadId = dwRemoteThreadId;

     FreeLibrary(hModule);
     VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
     return hRemoteThread;
 }

 BOOL RemoteThreadFreeing(HANDLE hProcess, LPCSTR lpLibFilePath, DWORD dwMilliseconds)
 {
     int len = strlen(lpLibFilePath) + ;

     LPVOID lpVir = VirtualAllocEx(hProcess, NULL, len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
     if (NULL == lpVir)
         return FALSE;

     if (!WriteProcessMemory(hProcess, lpVir, lpLibFilePath, len, NULL))
     {
         VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
         return FALSE;
     }

     HMODULE hModule = GetModuleHandleA("Kernel32.dll");
     if (NULL == hModule)
     {
         hModule = LoadLibraryA("Kernel32.dll");
         if (NULL == hModule)
         {
             VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
             return FALSE;
         }
     }

     FARPROC fpProc = GetProcAddress(hModule, "GetModuleHandleA");
     if (NULL == fpProc)
     {
         FreeLibrary(hModule);
         VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
         return FALSE;
     }

     HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)fpProc, lpVir, NULL, NULL);
     if (NULL == hRemoteThread)
     {
         FreeLibrary(hModule);
         VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
         return FALSE;
     }

     if (WAIT_OBJECT_0 != WaitForSingleObject(hRemoteThread, dwMilliseconds))
     {
         CloseHandle(hRemoteThread);
         FreeLibrary(hModule);
         VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
         return FALSE;
     }

     DWORD dwExitCode;
     if (!GetExitCodeThread(hRemoteThread, &dwExitCode))    //    dwExitCode is hRemoteLibModule
     {
         CloseHandle(hRemoteThread);
         FreeLibrary(hModule);
         VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
         return FALSE;
     }

     CloseHandle(hRemoteThread);
     VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);

     //    CreateRemoteThread the second times

     fpProc = GetProcAddress(hModule, "FreeLibrary");
     if (NULL == fpProc)
     {
         FreeLibrary(hModule);
         return FALSE;
     }

     hRemoteThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)fpProc, (LPVOID)((HMODULE)dwExitCode), NULL, NULL);
     if (NULL == hRemoteThread)
     {
         FreeLibrary(hModule);
         return FALSE;
     }

     if (WAIT_OBJECT_0 != WaitForSingleObject(hRemoteThread, dwMilliseconds))
     {
         CloseHandle(hRemoteThread);
         FreeLibrary(hModule);
         return FALSE;
     }

     if (!GetExitCodeThread(hRemoteThread, &dwExitCode))    //    dwExitCode is the return value of Remote FreeLibrary
     {
         CloseHandle(hRemoteThread);
         FreeLibrary(hModule);
         return FALSE;
     }

     FreeLibrary(hModule);
     CloseHandle(hRemoteThread);
     return (BOOL)dwExitCode;
 }

EnhanceFunc.cpp

 #include <cstdio>
 #include <windows.h>

 #include "EnhanceFunc.h"

 using namespace std;

 int main()
 {
     char cTargetDllPath[MAX_PATH] = "C:\\DLL.dll";    //    suppose I have a dll file in this path

     printf("Enable Debug Privilege %s...\n", EnableDebugPrivileges() ? "Succeed" : "Faild");

     system("pause > nul");

     STARTUPINFOA si = {};
     si.cb = sizeof(si);
     PROCESS_INFORMATION pi = {};
     CreateProcessA(NULL, "C:\\Windows\\System32\\calc.exe", NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);

     system("pause > nul");

     printf("DLL.dll Inject %s...\n", RemoteThreadInjection(pi.hProcess, cTargetDllPath) ? "Succeed" : "Faild");

     system("pause > nul");

     printf("DLL.dll Freeing %s...\n", RemoteThreadFreeing(pi.hProcess, cTargetDllPath) ? "Succeed" : "Faild");

     system("pause > nul");

     TerminateProcess(pi.hProcess, NULL);

     system("pause > nul && exit");
     return ;
 }

main.cpp