int
main()
{
/
/
获取目标进程的句柄
HWND hWnd
=
FindWindow(NULL, L
"无标题 - Notepad"
);
if
(hWnd
=
=
NULL) {
printf(
"未找到目标进程\n"
);
return
1
;
}
DWORD processId;
GetWindowThreadProcessId(hWnd, &processId);
HANDLE hProcess
=
OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);
if
(hProcess
=
=
NULL) {
printf(
"无法打开目标进程\n"
);
return
1
;
}
/
/
在目标进程中分配内存
LPVOID pRemoteBuffer
=
VirtualAllocEx(hProcess, NULL, MAX_PATH, MEM_COMMIT, PAGE_READWRITE);
if
(pRemoteBuffer
=
=
NULL) {
printf(
"无法在目标进程中分配内存\n"
);
return
1
;
}
/
/
将DLL路径写入目标进程
char dllPath[]
=
"E:\\Test\\InjectDll.dll"
;
if
(!WriteProcessMemory(hProcess, pRemoteBuffer, dllPath, sizeof(dllPath), NULL)) {
printf(
"无法写入目标进程内存\n"
);
return
1
;
}
/
/
获取LoadLibrary函数的地址
HMODULE hKernel32
=
GetModuleHandle(L
"kernel32.dll"
);
if
(hKernel32
=
=
NULL) {
printf(
"未找到kernel32.dll\n"
);
return
1
;
}
FARPROC pLoadLibrary
=
GetProcAddress(hKernel32,
"LoadLibraryA"
);
if
(pLoadLibrary
=
=
NULL) {
printf(
"未找到LoadLibrary函数\n"
);
return
1
;
}
/
/
在目标进程中调用LoadLibrary函数加载DLL
HANDLE hThread
=
CreateRemoteThread(hProcess, NULL,
0
, (LPTHREAD_START_ROUTINE)pLoadLibrary, pRemoteBuffer,
0
, NULL);
if
(hThread
=
=
NULL) {
printf(
"无法在目标进程中创建远程线程\n"
);
return
1
;
}
printf(
"DLL注入成功\n"
);
/
/
等待远程线程退出
WaitForSingleObject(hThread, INFINITE);
/
/
清理资源
CloseHandle(hThread);
VirtualFreeEx(hProcess, pRemoteBuffer,
0
, MEM_RELEASE);
CloseHandle(hProcess);
return
0
;
}