利用VB编写dll注入其他进程的源代码(2).VB DLL thread inject(2)

Private Sub Enject()

Dim MySnapHandle As Long
Dim ProcessInfo As PROCESSENTRY32
Dim MyRemoteProcessId As Long
Dim MyDllFileLength As Long
Dim MyDllFileBuffer As Long
Dim MyReturn As Long
Dim MyAddr As Long
Dim MyResult As Long
Dim MyDllFileName As String
Dim dwHandle As Long

MySnapHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
ProcessInfo.dwSize = Len(ProcessInfo)


If Process32First(MySnapHandle, ProcessInfo) <> 0 Then
Do
    If InStr(ProcessInfo.szExeFile, "explorer.exe") > 0 Then
        MyRemoteProcessId = OpenProcess(PROCESS_ALL_ACCESS, False, ProcessInfo.th32ProcessID)
        If MyRemoteProcessId = 0 Then MsgBox "error OpenProcess"
        
        MyStartAddr = GetProcAddress(GetModuleHandle("Kernel32"), "GetModuleHandleA")
        '与注入一样,只不过这里换成了GetModuleHandleA. _
         原理就是先在目标进程执行GetModuleHandleA得到我们的dll的地址，然后再用FreeLibrary卸载掉我们的dll。
        If MyStartAddr = 0 Then MsgBox "error GetProcAddress"
        
        MyDllFileName = IIf(LCase(Right(Text1, 4)) = ".dll", Text1, Text1.Text & ".dll")
        MyDllFileLength = LenB(StrConv(MyDllFileName, vbFromUnicode)) + 1
        
        MyDllFileBuffer = VirtualAllocEx(MyRemoteProcessId, 0, MyDllFileLength, MEM_COMMIT, PAGE_READWRITE)
        If MyDllFileBuffer = 0 Then MsgBox "error VirtualAllocEx"
        
        MyReturn = WriteProcessMemory(MyRemoteProcessId, MyDllFileBuffer, ByVal (MyDllFileName), MyDllFileLength, temp)
        If MyReturn = 0 Then MsgBox "error WriteProcessMemory"

        MyResult = CreateRemoteThread(MyRemoteProcessId, 0, 0, MyAddr, MyDllFileBuffer, 0, temp)
        '都与注入一样。执行到这里就得到了
        WaitForSingleObject MyResult, INFINITE '等待远程线程执行完毕。
        GetExitCodeThread MyResult, dwHandle '这里可以得到远程线程的返回值，也就是GetModuleHandleA返回的我们的dll的句柄。
        
        VirtualFreeEx MyRemoteProcessId, MyDllFileBuffer, MyDllFileLength, MEM_DECOMMIT
        '释放掉我们申请的内存段
        CloseHandle MyResult
        
        MyAddr = GetProcAddress(GetModuleHandle("Kernel32"), "FreeLibrary")
        If MyAddr = 0 Then MsgBox "error FreeLibrary"
        MyResult = CreateRemoteThread(MyRemoteProcessId, 0, 0, MyAddr, dwHandle, 0, temp)
        '这次不需要再用WriteProcessMemory写入FreeLibrary的参数了， _
         因为我们的dll的句柄刚才已经保存在dwHandle里面了。
        If MyResult = 0 Then MsgBox "error CreateRemoteThread"
        CloseHandle MyResult
        CloseHandle MyRemoteProcessId
    End If
Loop While Process32Next(MySnapHandle, ProcessInfo) <> 0
End If


CloseHandle MySnapHandle

End Sub
 

Private Sub Command1_Click()
Inject
End Sub

Private Sub Command2_Click()
Enject
End Sub

Private Sub Form_Load()
Text1 = GetSetting(App.Title, "dllname", "dllname")
End Sub

Private Sub Form_Unload(Cancel As Integer)
SaveSetting App.Title, "dllname", "dllname", Text1
End Sub

Private Sub Text1_GotFocus()
Text1.SelStart = 0
Text1.SelLength = Len(Text1.Text)
End Sub