能力值:
( LV2,RANK:10 )
|
-
-
3 楼
陷入死循环了?
|
能力值:
( LV9,RANK:410 )
|
-
-
4 楼
应该是你的编码问题.把你的代码拿来看看.这样凭空很难解释
|
能力值:
( LV9,RANK:970 )
|
-
-
5 楼
unit ThreadInject;
interface
uses
Windows,
Messages,
Classes,
tlhelp32, //必须要的
SysUtils; //必须要的
type
TLog = procedure(s : PChar);stdcall;
TServiceMain = procedure(argc : Integer; VAR argv : pchar);stdcall;
EDLLLoadError = class(Exception);
procedure GetMyProcessID(const AFilename: string; const PathMatch: Boolean; var ProcessID: DWORD);
function EnabledDebugPrivilege(const Enabled : Boolean) : Boolean;
function InjectTo(const Host, Guest: string; const PID: DWORD = 0): DWORD;
implementation
{*************************
* 作用:远程注入
* 调用:InjectTo('twin.exe', extractfilepath(paramstr(0))+'Twin.dll');
************************** }
function InjectTo(const Host, Guest: string; const PID: DWORD = 0): DWORD;
var
{ 被注入的进程句柄,进程ID}
hRemoteProcess: THandle;
dwRemoteProcessId: DWORD;
{ 写入远程进程的内容大小 }
memSize: DWORD;
{ 写入到远程进程后的地址 }
pszLibFileRemote: Pointer;
iReturnCode: Boolean;
TempVar: DWORD;
{ 指向函数LoadLibraryW的地址 }
pfnStartAddr: TFNThreadStartRoutine;
{ dll全路径,需要写到远程进程的内存中去 }
pszLibAFilename: PwideChar;
begin
Result := 0;
{ 设置权限 }
EnabledDebugPrivilege(True);
{ 为注入的dll文件路径分配内存大小,由于为WideChar,故要乘2 }
Getmem(pszLibAFilename, Length(Guest) * 2 + 1);
StringToWideChar(Guest, pszLibAFilename, Length(Guest) * 2 + 1);
{ 获取进程ID }
if PID > 0 then
dwRemoteProcessID := PID
else
GetMyProcessID(Host, False, dwRemoteProcessID);
{ 取得远程进程句柄,具有写入权限}
hRemoteProcess := OpenProcess(PROCESS_CREATE_THREAD + {允许远程创建线程}
PROCESS_VM_OPERATION + {允许远程VM操作}
PROCESS_VM_WRITE, {允许远程VM写}
FALSE, dwRemoteProcessId);
{ 用函数VirtualAllocex在远程进程分配空间,并用WriteProcessMemory中写入dll路径 }
memSize := (1 + lstrlenW(pszLibAFilename)) * sizeof(WCHAR);
pszLibFileRemote := PWIDESTRING(VirtualAllocEx(hRemoteProcess, nil, memSize, MEM_COMMIT, PAGE_READWRITE));
TempVar := 0;
iReturnCode := WriteProcessMemory(hRemoteProcess, pszLibFileRemote, pszLibAFilename, memSize, TempVar);
if iReturnCode then
begin
pfnStartAddr := GetProcAddress(GetModuleHandle('Kernel32'), 'LoadLibraryW');
TempVar := 0;
{ 在远程进程中启动dll }
Result := CreateRemoteThread(hRemoteProcess, nil, 0, pfnStartAddr, pszLibFileRemote, 0, TempVar);
end;
{ 释放内存空间 }
Freemem(pszLibAFilename);
end;
{*************************
* 作用:列举进程
* 返回:bool类型
************************** }
procedure GetMyProcessID(const AFilename: string; const PathMatch: Boolean; var ProcessID: DWORD);
var
lppe: TProcessEntry32;
SsHandle: Thandle;
FoundAProc, FoundOK: boolean;
begin
ProcessID :=0;
{ 创建系统快照 }
SsHandle := CreateToolHelp32SnapShot(TH32CS_SnapProcess, 0);
{ 取得快照中的第一个进程 }
{ 一定要设置结构的大小,否则将返回False }
lppe.dwSize := sizeof(TProcessEntry32);
FoundAProc := Process32First(Sshandle, lppe);
while FoundAProc do
begin
{ 进行匹配 }
if PathMatch then
FoundOK := AnsiStricomp(lppe.szExefile, PChar(AFilename)) = 0
else
FoundOK := AnsiStricomp(PChar(ExtractFilename(lppe.szExefile)), PChar(ExtractFilename(AFilename))) = 0;
if FoundOK then
begin
ProcessID := lppe.th32ProcessID;
break;
end;
{ 未找到,继续下一个进程 }
FoundAProc := Process32Next(SsHandle, lppe);
end;
CloseHandle(SsHandle);
end;
{*************************
* 作用:设置权限
* 返回:bool类型
************************** }
function EnabledDebugPrivilege(const Enabled : Boolean) : Boolean;
var
hTk : THandle; { 打开令牌句柄 }
rtnTemp : Dword; { 调整权限时返回的值 }
TokenPri : TOKEN_PRIVILEGES;
const
SE_DEBUG = 'SeDebugPrivilege'; { 查询值 }
begin
Result := False;
{ 获取进程令牌句柄,设置权限 }
if (OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,hTk)) then
begin
TokenPri.PrivilegeCount := 1;
{ 获取Luid值 }
LookupPrivilegeValue(nil,SE_DEBUG,TokenPri.Privileges[0].Luid);
if Enabled then
TokenPri.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED
else
TokenPri.Privileges[0].Attributes := 0;
rtnTemp := 0;
{ 设置新的权限 }
AdjustTokenPrivileges(hTk,False,TokenPri,sizeof(TokenPri),nil,rtnTemp);
Result := GetLastError = ERROR_SUCCESS;
CloseHandle(hTk);
end;
end;
end.
|
能力值:
( LV2,RANK:10 )
|
-
-
7 楼
你注进去的那个DLL的问题吧,看看那个DLL写的有什么问题
|