Inject Code into Another Process

1.将代码放入DLL中，通过windows hooks将DLL映射到远程进程。
在EXE中显式或隐式调用HookDll.dll中的InjectDll，InjectDll函数调用SetWindowsHookEx。这时，HookDll.dll被映射到目标进程空间，并且通过HookProc监视并处理目标进程的消息。
由于HookDll.dll同时映射到了EXE和远程进程，所以可用通过共享数据区或其它方式进行通信。
以下为HookDll.dll源代码。
<br />#include <windows.h><br />#include <tchar.h><br /><br />#include "HookDll.h"<br /><br />//-------------------------------------------------------<br />// 共享数据区<br />//-------------------------------------------------------<br />#pragma data_seg (".shared")<br />HWND g_hWnd = 0; // 远程进程的窗口(包含其它控件)句柄<br />HHOOK g_hHook = 0;<br />UINT WM_HOOKSPY = 0;<br />#pragma data_seg ()<br /><br />#pragma comment(linker,"/SECTION:.shared,RWS") <br /><br />//-------------------------------------------------------<br />// 全局变量 (不能共享!)<br />//-------------------------------------------------------<br />HINSTANCE hDll;<br /><br />//-------------------------------------------------------<br />// DllMain<br />//-------------------------------------------------------<br />BOOL APIENTRY DllMain(HANDLE hModule, <br /> DWORD ul_reason_for_call, <br /> LPVOID lpReserved)<br />{<br /> hDll = (HINSTANCE)hModule;<br /> return TRUE;<br />}<br /><br />//-------------------------------------------------------<br />// HookProc<br />//-------------------------------------------------------<br />LRESULT HookProc(int code, // hook code<br /> WPARAM wParam, // virtual-key code<br /> LPARAM lParam) // keystroke-message information<br />{ <br /> if(((CWPSTRUCT*)lParam)->message == WM_HOOKSPY)<br /> {<br /> // to-do<br /><br /> ::UnhookWindowsHookEx(g_hHook);<br /> }<br /> return ::CallNextHookEx(g_hHook, code, wParam, lParam);<br />}<br /><br />//-------------------------------------------------------<br />// InjectDll<br />//-------------------------------------------------------<br />bool InjectDll(HWND hWnd) // hWnd为远程进程的窗口(包含其它控件)句柄<br />{ <br /> g_hWnd = hWnd;<br /><br /> g_hHook = SetWindowsHookEx(WH_CALLWNDPROC, (HOOKPROC)HookProc,<br /> hDll, GetWindowThreadProcessId(hWnd, NULL));<br /> <br /> if(g_hHook == NULL)<br /> {<br /> return false;<br /> }<br /> <br /> if (WM_HOOKSPY == NULL)<br /> {<br /> WM_HOOKSPY = ::RegisterWindowMessage("WM_HOOKSPY_RK");<br /> }<br /><br /> SendMessage(hWnd, WM_HOOKSPY, 0, 0);<br /><br /> return true;<br />}<br />
HookProc与窗口过程的区别？
DLL的物理地址相同？


2.将代码放入EXE中，通过使用CreateRemoteThread和LoadLibrary将DLL映射到远程进程。
<br />//-----------------------------------------------<br />// InjectDll<br />//-----------------------------------------------<br />int InjectDll(HANDLE hProcess)<br />{<br /> HANDLE hThread;<br /> char szLibPath [_MAX_PATH];<br /> void* pLibRemote = 0; // address of szLibPath in the remote process<br /> DWORD hLibModule = 0; // base address of loaded module (==HMODULE);<br /><br /> HMODULE hKernel32 = ::GetModuleHandle("Kernel32");<br /> <br /> // Get full path of "LibSpy.dll"<br /> if(!GetModuleFileName(hInst, szLibPath, _MAX_PATH))<br /> {<br /> return false;<br /> }<br /> strcpy( strstr(szLibPath,".exe"),".dll" );<br /><br /> // 1. Allocate memory in the remote process for szLibPath<br /> // 2. Write szLibPath to the allocated memory<br /> pLibRemote = ::VirtualAllocEx(hProcess, NULL, sizeof(szLibPath), <br /> MEM_COMMIT, PAGE_READWRITE );<br /> if(pLibRemote == NULL)<br /> {<br /> return false;<br /> }<br /> ::WriteProcessMemory(hProcess, pLibRemote, (void*)szLibPath, <br /> sizeof(szLibPath), NULL);<br /><br /> // Load "LibSpy.dll" into the remote process <br /> // (via CreateRemoteThread & LoadLibrary)<br /> hThread = ::CreateRemoteThread(hProcess, NULL, 0, <br /> (LPTHREAD_START_ROUTINE)::GetProcAddress(<br /> hKernel32, "LoadLibraryA"), <br /> pLibRemote, 0, NULL);<br /> if(hThread == NULL)<br /> {<br /> goto JUMP;<br /> }<br /><br /> ::WaitForSingleObject(hThread, INFINITE);<br /><br /> // Get handle of loaded module<br /> ::GetExitCodeThread(hThread, &hLibModule);<br /> ::CloseHandle(hThread);<br /><br />JUMP: <br /> ::VirtualFreeEx(hProcess, pLibRemote, sizeof(szLibPath), MEM_RELEASE);<br /> if( hLibModule == NULL )<br /> {<br /> return false;<br /> }<br /><br /> // Unload "LibSpy.dll" from the remote process <br /> // (via CreateRemoteThread & FreeLibrary)<br /> hThread = ::CreateRemoteThread(hProcess, NULL, 0,<br /> (LPTHREAD_START_ROUTINE)::GetProcAddress(<br /> hKernel32,"FreeLibrary"),<br /> (void*)hLibModule, 0, NULL);<br /><br /> if(hThread == NULL) // failed to unload<br /> {<br /> return false;<br /> }<br /><br /> ::WaitForSingleObject(hThread, INFINITE);<br /> ::GetExitCodeThread(hThread, &hLibModule);<br /> ::CloseHandle(hThread);<br /><br /> // return value of remote FreeLibrary (=nonzero on success)<br /> return hLibModule;<br />}<br />