XP/Win7通用的CreateRemoteThread类

Inject.h

#pragma once

typedef DWORD (WINAPI *PFNTCREATETHREADEX)

(

 PHANDLE                 ThreadHandle,

 ACCESS_MASK             DesiredAccess,

 LPVOID                  ObjectAttributes,

 HANDLE                  ProcessHandle,

 LPTHREAD_START_ROUTINE  lpStartAddress,

 LPVOID                  lpParameter,

 BOOL                    CreateSuspended,

 DWORD                   dwStackSize,

 DWORD                   dw1,

 DWORD                   dw2,

 LPVOID                  Unknown

);

BOOL InjectDll(DWORD dwPID, char *szDllName);

Inject.cpp

#include "StdAfx.h"

#include "stdio.h"

#include "tchar.h"

#include "Inject.h"

#include <Windows.h>

BOOL IsVistaOrLater()

{

    OSVERSIONINFO osvi;

    ZeroMemory(&osvi, sizeof(OSVERSIONINFO));

    osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);

    GetVersionEx(&osvi);

    if( osvi.dwMajorVersion >= 6 )

        return TRUE;

    return FALSE;

}
BOOL MyCreateRemoteThread(HANDLE hProcess, LPTHREAD_START_ROUTINE pThreadProc, LPVOID pRemoteBuf)

{

    HANDLE      hThread = NULL;

    FARPROC     pFunc = NULL;

    if( IsVistaOrLater() )    // Vista, 7, Server2008

    {

        pFunc = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtCreateThreadEx");

        if( pFunc == NULL )

        {

            return FALSE;

        }

        ((PFNTCREATETHREADEX)pFunc)(&hThread,

                                    0x1FFFFF,

                                    NULL,

                                    hProcess,

                                    pThreadProc,

                                    pRemoteBuf,

                                    FALSE,

                                    NULL,

                                    NULL,

                                    NULL,

                                    NULL);

        if( hThread == NULL )

        {

            //printf("MyCreateRemoteThread() : NtCreateThreadEx() 调用失败！错误代码: [%d]/n", GetLastError());

            return FALSE;

        }

    }

    else                    // 2000, XP, Server2003

    {

        hThread = CreateRemoteThread(hProcess,

                                     NULL,

                                     0,

                                     pThreadProc,

                                     pRemoteBuf,

                                     0,

                                     NULL);

        if( hThread == NULL )

        {

            //printf("MyCreateRemoteThread() : CreateRemoteThread() 调用失败！错误代码: [%d]/n", GetLastError());

            return FALSE;

        }

    }

    if( WAIT_FAILED == WaitForSingleObject(hThread, INFINITE) )

    {

        //printf("MyCreateRemoteThread() : WaitForSingleObject() 调用失败！错误代码: [%d]/n", GetLastError());

        return FALSE;

    }

    return TRUE;

}
BOOL InjectDll(DWORD dwPID, char *szDllName)

{

    HANDLE hProcess = NULL;

    LPVOID pRemoteBuf = NULL;

    FARPROC pThreadProc = NULL;

    char szAppPath[MAX_PATH];

    GetModuleFileName(NULL, szAppPath, MAX_PATH);

    (strrchr(szAppPath, ‘\\‘))[1] = 0;

    strcat(szAppPath,szDllName);

    DWORD dwBufSize = strlen(szAppPath)+1;

    if ( !(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID)) )

    {

        //printf("[错误] OpenProcess(%d) 调用失败！错误代码: [%d]/n", dwPID, GetLastError());

        return FALSE;

    }

    pRemoteBuf = VirtualAllocEx(hProcess, NULL, dwBufSize,

                                MEM_COMMIT, PAGE_READWRITE);

    WriteProcessMemory(hProcess, pRemoteBuf, (LPVOID)szAppPath,

                       dwBufSize, NULL);

    pThreadProc = GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");

    if( !MyCreateRemoteThread(hProcess, (LPTHREAD_START_ROUTINE)pThreadProc, pRemoteBuf) )

    {

        //printf("[错误] CreateRemoteThread() 调用失败！错误代码: [%d]/n", GetLastError());

        return FALSE;

    }

    VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE);

    CloseHandle(hProcess);

    return TRUE;

}

XP/Win7通用的CreateRemoteThread类