原来在写内存挂的时候写的这个小软件,现在给大家共享出来! 本来想实现一个编写汇编代码注入的功能,结果没实现出来。哈哈……转成机器码有点小难度就没深入研究了。
项目源码:MemHelper
// MemHelperDlg.cpp : 实现文件 // #include "stdafx.h" #include "MemHelper.h" #include "MemHelperDlg.h" #include "AsmCode.h" #ifdef _DEBUG #define new DEBUG_NEW #endif #pragma hdrstop // CMemHelperDlg 对话框 CMemHelperDlg::CMemHelperDlg(CWnd* pParent /*=NULL*/) : CDialogEx(CMemHelperDlg::IDD, pParent) { m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME); m_tempHwnd = NULL; pGT = NULL; } void CMemHelperDlg::DoDataExchange(CDataExchange* pDX) { CDialogEx::DoDataExchange(pDX); DDX_Control(pDX, IDC_BTN_FWND, m_fwnd); } BEGIN_MESSAGE_MAP(CMemHelperDlg, CDialogEx) ON_WM_PAINT() ON_WM_QUERYDRAGICON() ON_WM_TIMER() ON_WM_HOTKEY() ON_WM_CTLCOLOR() ON_WM_CLOSE() ON_WM_DESTROY() ON_WM_LBUTTONDOWN() ON_BN_CLICKED(IDC_BTN_READ, &CMemHelperDlg::OnBnClickedBtnRead) ON_BN_CLICKED(IDC_BTN_WRITE, &CMemHelperDlg::OnBnClickedBtnWrite) ON_EN_SETFOCUS(IDC_EDIT_HWND_VALUE, &CMemHelperDlg::OnEnSetfocusEditHwndValue) ON_EN_SETFOCUS(IDC_EDIT_READ_VALUE, &CMemHelperDlg::OnEnSetfocusEditReadValue) ON_EN_SETFOCUS(IDC_EDIT_TITLE, &CMemHelperDlg::OnEnSetfocusEditTitle) ON_WM_LBUTTONUP() ON_WM_NCLBUTTONUP() ON_WM_SYSCOMMAND() ON_WM_NCLBUTTONDOWN() ON_WM_NCMOUSEMOVE() ON_WM_LBUTTONUP() ON_WM_NCLBUTTONUP() ON_WM_SYSCOMMAND() ON_WM_LBUTTONUP() ON_WM_LBUTTONDOWN() ON_WM_NCLBUTTONUP() ON_WM_MOUSEMOVE() ON_BN_CLICKED(IDC_CHK_READ_HEX, &CMemHelperDlg::OnBnClickedChkReadHex) ON_BN_CLICKED(IDC_CHK_WRITE_HEX, &CMemHelperDlg::OnBnClickedChkWriteHex) ON_BN_CLICKED(IDC_BTN_READS, &CMemHelperDlg::OnBnClickedBtnReads) ON_BN_CLICKED(IDC_BTN_WRITES, &CMemHelperDlg::OnBnClickedBtnWrites) ON_EN_SETFOCUS(IDC_EDIT_READ_VALUES, &CMemHelperDlg::OnEnSetfocusEditReadValues) ON_EN_SETFOCUS(IDC_EDIT_PROCESS, &CMemHelperDlg::OnEnSetfocusEditProcess) ON_BN_CLICKED(IDC_BTN_OTHER, &CMemHelperDlg::OnBnClickedBtnOther) ON_BN_CLICKED(IDC_BTN_CAPTURE, &CMemHelperDlg::OnBnClickedBtnCapture) END_MESSAGE_MAP() // CMemHelperDlg 消息处理程序 BOOL CMemHelperDlg::OnInitDialog() { CDialogEx::OnInitDialog(); // 设置此对话框的图标。当应用程序主窗口不是对话框时,框架将自动 // 执行此操作 pGT = new CGameTool; SetIcon(m_hIcon, TRUE); // 设置大图标 SetIcon(m_hIcon, FALSE); // 设置小图标 pressFbutton = FALSE; readHex = FALSE; writeHex = FALSE; SetDlgItemText(IDC_EDIT_READ_VALUES_SIZE,"32"); // TODO: 在此添加额外的初始化代码 /*LOGFONT lf; //定义字体结构 内存即将被覆盖无须初始 lf.lfWeight=500; //字体磅数=1000粗体 lf.lfHeight=13; //字体高度(旋转后的字体宽度)=56 lf.lfWidth=7; //字体宽度(旋转后的字体高度)=20 lf.lfUnderline=FALSE; //无下划线 lf.lfStrikeOut=FALSE; //无删除线 lf.lfItalic=FALSE; //非斜体 lf.lfEscapement=0; //字体显示角度=0° lf.lfCharSet=GB2312_CHARSET; //使用缺省字符集 strcpy_s(lf.lfFaceName,sizeof(lf.lfFaceName),"新宋体"); //字体名 m_editFont.CreateFontIndirect(&lf);*/ CRect rt;//资源窗口宽度为171 GetWindowRect(rt); SetWindowPos(NULL,0,0,305,rt.Height(),SWP_SHOWWINDOW|SWP_NOMOVE); CenterWindow(); return TRUE; // 除非将焦点设置到控件,否则返回 TRUE } // 如果向对话框添加最小化按钮,则需要下面的代码 // 来绘制该图标。对于使用文档/视图模型的 MFC 应用程序, // 这将由框架自动完成。 void CMemHelperDlg::OnPaint() { if (IsIconic()) { CPaintDC dc(this); // 用于绘制的设备上下文 SendMessage(WM_ICONERASEBKGND, reinterpret_cast(dc.GetSafeHdc()), 0); // 使图标在工作区矩形中居中 int cxIcon = GetSystemMetrics(SM_CXICON); int cyIcon = GetSystemMetrics(SM_CYICON); CRect rect; GetClientRect(&rect); int x = (rect.Width() - cxIcon + 1) / 2; int y = (rect.Height() - cyIcon + 1) / 2; // 绘制图标 dc.DrawIcon(x, y, m_hIcon); } else { CDialogEx::OnPaint(); } } //当用户拖动最小化窗口时系统调用此函数取得光标 //显示。 HCURSOR CMemHelperDlg::OnQueryDragIcon() { return static_cast (m_hIcon); } void CMemHelperDlg::ClearFocus(int ID) { GetDlgItem(ID)->SetFocus(); GetDlgItem(ID)->HideCaret(); } void CMemHelperDlg::OnTimer(UINT_PTR nIDEvent) { // TODO: 在此添加消息处理程序代码和/或调用默认值 CDialogEx::OnTimer(nIDEvent); } void CMemHelperDlg::OnHotKey(UINT nHotKeyId, UINT nKey1, UINT nKey2) { // TODO: 在此添加消息处理程序代码和/或调用默认值 CDialogEx::OnHotKey(nHotKeyId, nKey1, nKey2); } HBRUSH CMemHelperDlg::OnCtlColor(CDC* pDC, CWnd* pWnd, UINT nCtlColor) { HBRUSH hbr = CDialogEx::OnCtlColor(pDC, pWnd, nCtlColor); // TODO: 在此更改 DC 的任何特性 if (pWnd->GetDlgCtrlID() == IDC_STATIC_AUT) { pDC->SetTextColor(RGB(0x0,0x0,0xFF)); //字体颜色 //pDC->SelectObject(&m_editFont); } // TODO: 如果默认的不是所需画笔,则返回另一个画笔 return hbr; } void CMemHelperDlg::OnClose() { // TODO: 在此添加消息处理程序代码和/或调用默认值 CDialogEx::OnClose(); if (pGT != NULL) { delete pGT; pGT = NULL; } } void CMemHelperDlg::OnDestroy() { CDialogEx::OnDestroy(); // TODO: 在此处添加消息处理程序代码 } void CMemHelperDlg::OnBnClickedBtnRead() { // TODO: 在此添加控件通知处理程序代码 if (m_tempHwnd) { DWORD proID; GetWindowThreadProcessId(m_tempHwnd,&proID);//获取进程ID HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,proID); if (hProc) { CString temp; GetDlgItemText(IDC_EDIT_READ_ADD,temp); DWORD ads_ps = HexToDem(temp); DWORD d_value = 0x0; BOOL bAccess = FALSE; bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);//读取动态地址 for(int i=0; i<4; i++) { //读取偏移量 GetDlgItemText(IDC_EDIT_READ_OFFSET1+i,temp); if (temp == "")continue;//没有输入跳过 DWORD offset = HexToDem(temp); ads_ps = d_value + offset; bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL); } if (bAccess) { CString outValue; outValue.Format(readHex?"%0X":"%d",d_value); SetDlgItemText(IDC_EDIT_READ_VALUE,outValue); } else MessageBox("内存读取失败"); CloseHandle(hProc); } else { MessageBox("进程打开失败"); } } else { MessageBox("窗口柄柄未初始."); } } void CMemHelperDlg::OnBnClickedBtnWrite() { // TODO: 在此添加控件通知处理程序代码 if (m_tempHwnd) { DWORD proID; GetWindowThreadProcessId(m_tempHwnd,&proID);//获取进程ID HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,proID); if (hProc) { CString temp; GetDlgItemText(IDC_EDIT_READ_ADD,temp); DWORD ads_ps = HexToDem(temp); DWORD d_value = 0x0; BOOL bAccess = FALSE; bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);//读取动态地址 for(int i=0; i<4; i++) { //读取偏移量 GetDlgItemText(IDC_EDIT_READ_OFFSET1+i,temp); if (temp == "")continue;//没有输入跳过 DWORD offset = HexToDem(temp); ads_ps = d_value + offset; bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL); } if (bAccess) { CString inValue; GetDlgItemText(IDC_EDIT_WRITE_VALUE,inValue); if (writeHex) d_value = HexToDem(inValue); else d_value = _ttoi(inValue); bAccess = WriteProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL); if(!bAccess) MessageBox("内存写入失败"); } else MessageBox("内存读取失败"); CloseHandle(hProc); } else { MessageBox("进程打开失败"); } } else { MessageBox("窗口柄柄未初始."); } } void CMemHelperDlg::OnBnClickedBtnReads() { // TODO: 在此添加控件通知处理程序代码 if (m_tempHwnd) { DWORD proID; GetWindowThreadProcessId(m_tempHwnd,&proID);//获取进程ID HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,proID); if (hProc) { CString temp; GetDlgItemText(IDC_EDIT_READ_ADD,temp); DWORD ads_ps = HexToDem(temp); DWORD d_value = 0x0; BOOL bAccess = FALSE; BOOL hasOffset = FALSE; //读取偏移量 GetDlgItemText(IDC_EDIT_READ_OFFSET1,temp); if(temp != "") hasOffset = TRUE;//有偏移量 if (hasOffset) { bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);//读取动态地址 for(int i=0; i<4; i++) { GetDlgItemText(IDC_EDIT_READ_OFFSET1+i,temp); if(temp == "") { //结束偏移量准备读取字符串 GetDlgItemText(IDC_EDIT_READ_VALUES_SIZE,temp); int size = _ttoi(temp); char *pBuf = new char[size]; bAccess = ReadProcessMemory(hProc,(void*)d_value,pBuf,size,NULL); if (bAccess) { temp.Format("%s",pBuf); SetDlgItemText(IDC_EDIT_READ_VALUES,temp); } else { MessageBox("内存读取失败"); } delete pBuf; } else { //继续读取偏移量 DWORD offset = HexToDem(temp); ads_ps = d_value + offset; bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL); } } } else { //直接读取字符串 //结束偏移量准备读取字符串 CString temp; GetDlgItemText(IDC_EDIT_READ_VALUES_SIZE,temp); int size = _ttoi(temp); char *pBuf = new char[size]; bAccess = ReadProcessMemory(hProc,(void*)ads_ps,pBuf,size,NULL); if (bAccess) { temp.Format("%s",pBuf); SetDlgItemText(IDC_EDIT_READ_VALUES,temp); } else { MessageBox("内存读取失败"); } delete pBuf; } CloseHandle(hProc); } else { MessageBox("进程打开失败"); } } else { MessageBox("窗口柄柄未初始."); } } void CMemHelperDlg::OnBnClickedBtnWrites() { // TODO: 在此添加控件通知处理程序代码 if (m_tempHwnd) { DWORD proID; GetWindowThreadProcessId(m_tempHwnd,&proID);//获取进程ID HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,proID); if (hProc) { CString temp; GetDlgItemText(IDC_EDIT_READ_ADD,temp); DWORD ads_ps = HexToDem(temp); DWORD d_value = 0x0; BOOL bAccess = FALSE; BOOL hasOffset = FALSE; //读取偏移量 GetDlgItemText(IDC_EDIT_READ_OFFSET1,temp); if(temp != "") hasOffset = TRUE;//有偏移量 if (hasOffset) { bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);//读取动态地址 for(int i=0; i<4; i++) { GetDlgItemText(IDC_EDIT_READ_OFFSET1+i,temp); if(temp == "") { //结束偏移量准备读取字符串 GetDlgItemText(IDC_EDIT_WRITE_VALUES,temp); char *pBuf = temp.GetBuffer(); temp.ReleaseBuffer(); bAccess = WriteProcessMemory(hProc,(void*)d_value,pBuf,strlen(pBuf),NULL); if (!bAccess) MessageBox("内存写入失败"); } else { //继续读取偏移量 DWORD offset = HexToDem(temp); ads_ps = d_value + offset; bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL); } } } else { //直接读取字符串 //结束偏移量准备读取字符串 CString temp; GetDlgItemText(IDC_EDIT_WRITE_VALUES,temp); char *pBuf = temp.GetBuffer(); temp.ReleaseBuffer(); bAccess = WriteProcessMemory(hProc,(void*)ads_ps,pBuf,strlen(pBuf),NULL); if (!bAccess) MessageBox("内存写入失败"); } CloseHandle(hProc); } else { MessageBox("进程打开失败"); } } else { MessageBox("窗口柄柄未初始."); } } void CMemHelperDlg::OnEnSetfocusEditHwndValue() { // TODO: 在此添加控件通知处理程序代码 ClearFocus(IDC_EDIT_HWND_VALUE); } void CMemHelperDlg::OnEnSetfocusEditReadValue() { // TODO: 在此添加控件通知处理程序代码 ClearFocus(IDC_EDIT_READ_VALUE); } void CMemHelperDlg::OnEnSetfocusEditReadValues() { // TODO: 在此添加控件通知处理程序代码 ClearFocus(IDC_EDIT_READ_VALUES); } void CMemHelperDlg::OnEnSetfocusEditProcess() { // TODO: 在此添加控件通知处理程序代码 ClearFocus(IDC_EDIT_PROCESS); } void CMemHelperDlg::OnEnSetfocusEditTitle() { // TODO: 在此添加控件通知处理程序代码 ClearFocus(IDC_EDIT_TITLE); } CString CMemHelperDlg::DecToHex(DWORD d_value) { CString strHec; strHec.Format("%0X",d_value); return strHec; } int CMemHelperDlg::HexToDem(LPCSTR hexStr) { int dem = 0; int length = strlen(hexStr); for (int i = 0; i < length; i++) { dem = dem * 16; if ((hexStr[i] <= '9') && (hexStr[i] >= '0')) // 0~9之间的字符 dem += hexStr[i] - '0'; else if ((hexStr[i] <= 'F') && (hexStr[i] >= 'A')) // A~F之间的字符 dem += hexStr[i] - 'A' + 10; else if ((hexStr[i] <= 'f') && (hexStr[i] >= 'a')) // a~f之间的字符 dem += hexStr[i] - 'a' + 10; else return -1; // 出错时返回-1 } return dem; } DWORD CMemHelperDlg::RemoteCall(HWND hwnd,LPVOID mFunc, LPVOID Param, DWORD ParamSize) { if(hwnd == NULL) { AfxMessageBox("请先初始窗口句柄!"); return 0; } HANDLE hProcess;//远程句柄 LPVOID mFuncAddr;//申请函数内存地址 LPVOID ParamAddr;//申请参数内存地址 HANDLE hThread; //线程句柄 DWORD NumberOfByte; //辅助返回值 DWORD d_size = 10240; BOOL HasParam = (ParamSize > 0 && Param != NULL); //打开被注入的进程句柄 DWORD processId; ::GetWindowThreadProcessId(hwnd,&processId); hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,processId); if(NULL == hProcess || INVALID_HANDLE_VALUE == hProcess) { AfxMessageBox("进程打开失败"); return 0; } //申请内存 MEM_COMMIT物理内存MEM_RESERVE虚拟内存 mFuncAddr = VirtualAllocEx(hProcess,NULL,d_size,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE); if(NULL == mFuncAddr) { AfxMessageBox("代码内存申请失败"); return 0; } if(HasParam) { ParamAddr = VirtualAllocEx(hProcess,NULL,ParamSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE); if(NULL == ParamAddr) { AfxMessageBox("参数内存申请失败"); if(mFuncAddr) VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE); VirtualFreeEx(hProcess,ParamAddr,ParamSize,MEM_RELEASE); return 0; } } //写内存 if(!WriteProcessMemory(hProcess,mFuncAddr,mFunc,d_size, &NumberOfByte)) { VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE); return 0; } if(HasParam && !WriteProcessMemory(hProcess,ParamAddr,Param,ParamSize, &NumberOfByte)) { VirtualFreeEx(hProcess,ParamAddr,ParamSize,MEM_RELEASE); return 0; } //创建远程线程 hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)(mFuncAddr), ParamAddr, 0, &NumberOfByte); WaitForSingleObject(hThread, INFINITE);//等待1s线程结束 //释放申请有内存 VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE); if(HasParam) VirtualFreeEx(hProcess,ParamAddr,ParamSize,MEM_RELEASE); //释放远程句柄 CloseHandle(hThread); CloseHandle(hProcess); return NumberOfByte; } void CMemHelperDlg::SetFButton(BOOL b) { this->pressFbutton = b; if(pressFbutton) m_fwnd.SetIcon(::LoadIconA(AfxGetInstanceHandle(),MAKEINTRESOURCE(IDI_ICON2))); else m_fwnd.SetIcon(::LoadIconA(AfxGetInstanceHandle(),MAKEINTRESOURCE(IDI_ICON1))); } void CMemHelperDlg::OnLButtonUp(UINT nFlags, CPoint point) { // TODO: 在此添加消息处理程序代码和/或调用默认值 CDialogEx::OnLButtonUp(nFlags, point); if(pressFbutton) { FindWindowInfo(point); ::ReleaseCapture(); SetFButton(FALSE); } } void CMemHelperDlg::OnLButtonDown(UINT nFlags, CPoint point) { // TODO: 在此添加消息处理程序代码和/或调用默认值 CDialogEx::OnLButtonDown(nFlags, point); ::ClientToScreen(m_hWnd,&point); CPoint *p = &point; CRect r; m_fwnd.GetWindowRect(&r); if (p->x>=r.left&&p->x<=r.right&&p->y>=r.top&&p->y<=r.bottom) { ::SetCapture(m_hWnd); SetFButton(TRUE); //将鼠标光标改为靶子 HINSTANCE ins = AfxGetInstanceHandle(); HCURSOR cursor = LoadCursorA(ins,MAKEINTRESOURCE(IDC_CURSOR_CROSS)); SetCursor(cursor); } } void CMemHelperDlg::OnMouseMove(UINT nFlags, CPoint point) { // TODO: 在此添加消息处理程序代码和/或调用默认值 CDialogEx::OnMouseMove(nFlags, point); if (pressFbutton) FindWindowInfo(point); } void CMemHelperDlg::FindWindowInfo(CPoint &point) { ::ClientToScreen(m_hWnd,&point); m_tempHwnd = ::WindowFromPoint(point); if (m_tempHwnd) { char title[256]; ::GetWindowText(m_tempHwnd,title,sizeof(title)); SetDlgItemText(IDC_EDIT_TITLE,(LPCTSTR)title); CString hexStr; hexStr.Format("%08X",m_tempHwnd); SetDlgItemText(IDC_EDIT_HWND_VALUE,hexStr); DWORD dwProcessID; GetWindowThreadProcessId(m_tempHwnd,&dwProcessID); hexStr; hexStr.Format("%08X",dwProcessID); SetDlgItemText(IDC_EDIT_PROCESS,hexStr); pGT->setGameHwnd(m_tempHwnd); } } void CMemHelperDlg::OnBnClickedChkReadHex() { // TODO: 在此添加控件通知处理程序代码 if (IsDlgButtonChecked(IDC_CHK_READ_HEX) == BST_CHECKED) { readHex = TRUE; CString text; GetDlgItemText(IDC_EDIT_READ_VALUE,text); DWORD d_value = _ttoi(text); SetDlgItemText(IDC_EDIT_READ_VALUE,DecToHex(d_value)); } else { readHex = FALSE; CString text; GetDlgItemText(IDC_EDIT_READ_VALUE,text); DWORD d_value = HexToDem(text); text.Format("%d",d_value); SetDlgItemText(IDC_EDIT_READ_VALUE,text); } } void CMemHelperDlg::OnBnClickedChkWriteHex() { // TODO: 在此添加控件通知处理程序代码 if (IsDlgButtonChecked(IDC_CHK_WRITE_HEX) == BST_CHECKED) writeHex = TRUE; else writeHex = FALSE; } void CMemHelperDlg::OnBnClickedBtnOther() { // TODO: 在此添加控件通知处理程序代码 CRect rt;//资源窗口宽度为171 GetWindowRect(rt); int width = rt.Width(); if(width == 305) { SetWindowPos(NULL,0,0,rt.Width()+200,rt.Height(),SWP_SHOWWINDOW|SWP_NOMOVE); SetDlgItemText(IDC_BTN_OTHER,"<"); } else { SetWindowPos(NULL,0,0,rt.Width()-200,rt.Height(),SWP_SHOWWINDOW|SWP_NOMOVE); SetDlgItemText(IDC_BTN_OTHER,">"); } } void CMemHelperDlg::OnBnClickedBtnCapture() { // TODO: 在此添加控件通知处理程序代码 if(pGT->getGameHwnd() == NULL) { MessageBox("窗口句柄未开始"); return; } pGT->captureScreen(); }
项目源码:MemHelper
收藏的用户(0) X
正在加载信息~
推荐阅读
最新回复 (2)
- 后续把汇编代码注入实现了,补充到这里来!
void CMemHelperDlg::OnBnClickedBtnTest() { // TODO: 在此添加控件通知处理程序代码 CEdit* pEdit = (CEdit*)GetDlgItem(IDC_EDIT_ASM); int nCount = pEdit->GetLineCount(); BYTE buf[2018] = {0};//要写入的shell代码 int bufIndex = 0; for (int i=0;i<nCount;i++) { t_asmmodel t_asm; char szError[512] = {0}; char szLine[256] = {0}; pEdit->GetLine(i,szLine,sizeof(szLine)); Assemble(szLine,0x400000,&t_asm,0,0,szError); if (t_asm.length <= 0) { MessageBox(szError); return; } //char tmp[256] = {0}; //int tempIndex = 0; //for (int j=0;j<t_asm.length;j++) // tempIndex += sprintf_s(tmp+tempIndex,256-tempIndex,"%0X",t_asm.code[j]&0xFF); //println("%s",tmp); memcpy(buf+bufIndex,t_asm.code,t_asm.length); bufIndex += t_asm.length; } buf[bufIndex++] = 0xC3;//retn 不加目标程序自动退出 RemoteCall(m_tempHwnd,bufIndex,buf); } DWORD CMemHelperDlg::RemoteCall(HWND hwnd,LPVOID mFunc) { if(hwnd == NULL) { AfxMessageBox("请先初始窗口句柄!"); return 0; } EnableDebugPriv(); HANDLE hProcess;//远程句柄 LPVOID mFuncAddr;//申请函数内存地址 HANDLE hThread; //线程句柄 DWORD NumberOfByte; //辅助返回值 DWORD d_size = 2048; //打开被注入的进程句柄 DWORD processId; ::GetWindowThreadProcessId(hwnd,&processId); hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,processId); if(NULL == hProcess || INVALID_HANDLE_VALUE == hProcess) { AfxMessageBox("进程打开失败"); return 0; } //申请内存 MEM_COMMIT物理内存MEM_RESERVE虚拟内存 mFuncAddr = VirtualAllocEx(hProcess,NULL,d_size,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE); if(NULL == mFuncAddr) { AfxMessageBox("代码内存申请失败"); return 0; } //写内存 if(!WriteProcessMemory(hProcess,mFuncAddr,mFunc,d_size, &NumberOfByte)) { VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE); return 0; } //创建远程线程 hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)(mFuncAddr), NULL, 0, &NumberOfByte); WaitForSingleObject(hThread, INFINITE);//等待1s线程结束 //释放申请有内存 VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE); //释放远程句柄 CloseHandle(hThread); CloseHandle(hProcess); return NumberOfByte; }
-
站点信息
- 文章2300
- 用户1336
- 访客10863090
每日一句
True success inspires others to act.
真正的成功是激励他人行动。
真正的成功是激励他人行动。
新会员