非常简单的利用CreateProcess注入DLL的方法

[cpp] view plain copy

1. TCHAR szDll[] = TEXT("d:\\test.dll");
2. STARTUPINFO si = {0};
3. PROCESS_INFORMATION pi = {0};
4. si.cb = sizeof(si);
5. si.dwFlags = STARTF_USESHOWWINDOW;
6. si.wShowWindow = SW_SHOW;
7. TCHAR szCommandLine[MAX_PATH] = TEXT("C:\\WINDOWS\\notepad.exe");
8. CreateProcess(NULL, szCommandLine, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
9. LPVOID Param = VirtualAllocEx(pi.hProcess, NULL, MAX_PATH, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
10. WriteProcessMemory(pi.hProcess, Param, (LPVOID)szDll, _tcslen(szDll)*2+sizeof(TCHAR), NULL);
11. HANDLE hThread = CreateRemoteThread(pi.hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibraryW,Param, CREATE_SUSPENDED, NULL);
12. ResumeThread(pi.hThread);
13. if (hThread)
14. {
15. ResumeThread(hThread);
16. WaitForSingleObject(hThread, INFINITE);
17. }

http://blog.csdn.net/zwfgdlc/article/details/8827116