ssageBox(NULL,_T("Failed to Open Process. Err = ") + SysErrorMessage(GetLastError()),
            NULL,MB_OK | MB_APPLMODAL | MB_ICONWARNING);
        return;
    }

    //初始化参数
    ZeroMemory(&DeinjectLibInfo,sizeof(DEINJECTLIBINFO ));
    DeinjectLibInfo.pfnFreeLibrary = (PFREELIBRARY)GetProcAddress(GetModuleHandle("Kernel32.dll"),FreeLibraryFuncStr);
    DeinjectLibInfo.pfnGetModuleHandle = (PGETMODULEHANDLE)GetProcAddress(GetModuleHandle("Kernel32.dll"),GetModuleHandleFuncStr);
    DeinjectLibInfo.pfnGetLastError = (PGETLASTERROR)GetProcAddress(GetModuleHandle("Kernel32.dll"),GetLastErrorFuncStr);

    lstrcpyn(DeinjectLibInfo.szDllName,CTaskKeyMgr::strRemoteDllName,CTaskKeyMgr::strRemoteDllName.GetLength()+1);

    //在远程线程分配内存来存放参数
    pRemoteParam = VirtualAllocEx(hRemoteProcess,NULL,sizeof(DEINJECTLIBINFO),MEM_COMMIT,PAGE_READWRITE);
    if(pRemoteParam == NULL)
    {
        MessageBox(NULL,_T("Failed to Allocate Memory at Remote Process.Err = ") + SysErrorMessage(GetLastError()),
        NULL,MB_OK | MB_APPLMODAL | MB_ICONWARNING);
    }
    Ret = WriteProcessMemory(hRemoteProcess,pRemoteParam,(LPVOID)&DeinjectLibInfo,sizeof(DEINJECTLIBINFO),&dwWriten);
    if(Ret == 0)
    {
        MessageBox(NULL,_T("Failed to Write Param to Remote Process.Err = ") + SysErrorMessage(GetLastError()),
        NULL,MB_OK | MB_APPLMODAL | MB_ICONWARNING);
        return;
    }

    //拷贝线程体
    dwThreadSize = (int)AfterThreadFuncDetach - (int)ThreadFuncDetach + 1024 + sizeof(DEINJECTLIBINFO);
    pRemoteThread = VirtualAllocEx(hRemoteProcess,NULL,dwThreadSize,MEM_COMMIT,PAGE_READWRITE);
    if(pRemoteThread == NULL)
    {
        MessageBox(NULL,_T("Failed to Allocate Memory at Remote Process for Thread Code.Err = ") +     SysErrorMessage(GetLastError()),
        NULL,MB_OK | MB_APPLMODAL | MB_ICONWARNING);
        return;
    }
    Ret = WriteProcessMemory(hRemoteProcess,pRemoteThread,(LPVOID)ThreadFuncDetach,dwThreadSize,&dwWriten);
    if(Ret == 0)
    {
        MessageBox(NULL,_T("Failed to Write Thread Code to Remote Process.Err = ") + SysErrorMessage(GetLastError()),
        NULL,MB_OK | MB_APPLMODAL | MB_ICONWARNING);
        return;
    }

    //启动远程线程
    HANDLE hRemoteThread;

    hRemoteThread = CreateRemoteThread(hRemoteProcess ,0,0,(DWORD(__stdcall *)(VOID*))pRemoteThread,(DEINJECTLIBINFO*)pRemoteParam,0,&dwWriten);
    if(hRemoteThread == NUL

上一页  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]  ... 下一页  >> 

相关专题：

网友评论：（评论内容只代表网友观点，与本站立场无关！）

GOOGLE广告

相关文章

[Tip]如何在SQL*PLUS中插入含有&的字符串?