• 目标：使calc程序输入的数自动加1

　（当别人使用时，总会得不到正确的结果，哈哈）

• 编写注入程序

—————————————————————————————————
class Program中的方法，注入dll到目标进程
——————————————————————-——————————
static String ChannelName = null;

        static void Main(string[] args)
        {
            Int32.TryParse(args[0], out TargetPID) ;
            RemoteHooking.IpcCreateServer<FileMonInterface>(ref ChannelName, WellKnownObjectMode.SingleCall);
            string injectionLibrary = Path.Combine(Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location), "Inject.dll");
            RemoteHooking.Inject(
                        TargetPID,
                        injectionLibrary,
                        injectionLibrary,
                        ChannelName);
            Console.WriteLine("Injected to process {0}", TargetPID);
            Console.WriteLine("<Press any key to exit>");
            Console.ReadKey();
            }
__________________________________________________
MarshalByRefObject的实现，供dll进行调用，判断是否正常
__________________________________________________
 public class FileMonInterface : MarshalByRefObject
    {
        public void IsInstalled(Int32 InClientPID)
        {
            Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID);
        }
    }

• 编写注入使用的dll程序

—————————————————————————————————
注入成功后，调用Run方法，钩取SetWindowTextW  API，修改为DSetWindowText的委托
—————————————————————————————————
 public void Run(
            RemoteHooking.IContext InContext,
            String InChannelName)
        {
            // install hook...
                Hook = LocalHook.Create(
                    LocalHook.GetProcAddress("user32.dll", "SetWindowTextW"),
                    new DSetWindowText(SetWindowText_Hooked),
                    this);

                Hook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
         Interface.IsInstalled(RemoteHooking.GetCurrentProcessId());
            RemoteHooking.WakeUpProcess();while (true)
                {
                    Thread.Sleep(500);
                }
        }

—————————————————————————————————
委托
—————————————————————————————————
        [UnmanagedFunctionPointer(CallingConvention.StdCall,
            CharSet = CharSet.Ansi,
            SetLastError = true)]
        delegate bool DSetWindowText(
         IntPtr hWnd, //对于句柄采用IntPtr类型
         string text
     );
—————————————————————————————————
API
—————————————————————————————————
        [DllImport("user32.dll",
        CharSet = CharSet.Ansi,
        SetLastError = true,
        CallingConvention = CallingConvention.StdCall)]
        static extern bool SetWindowText(
         IntPtr hWnd,    string text
         );
—————————————————————————————————
 傀儡API
—————————————————————————————————
    static bool SetWindowText_Hooked(
            IntPtr hWnd,
             string text)
        {
            text = (int.Parse(text.Remove(text.Length-2))+1).ToString();//修改要显示的数据
            return SetWindowText( hWnd, text);//调用API
        }                

• 效果图