VC++另类实现进程插入

// WaiGuaTestDlg.cpp : implementation file
//

#include "stdafx.h"
#include "WaiGuaTest.h"
#include "WaiGuaTestDlg.h"

#include "Tlhelp32.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

/////////////////////////////////////////////////////////////////////////////
// CAboutDlg dialog used for App About

class CAboutDlg : public CDialog
{
public:
	CAboutDlg();
	
	// Dialog Data
	//{{AFX_DATA(CAboutDlg)
	enum { IDD = IDD_ABOUTBOX };
	//}}AFX_DATA
	
	// ClassWizard generated virtual function overrides
	//{{AFX_VIRTUAL(CAboutDlg)
protected:
	virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV support
	//}}AFX_VIRTUAL
	
	// Implementation
protected:
	//{{AFX_MSG(CAboutDlg)
	//}}AFX_MSG
	DECLARE_MESSAGE_MAP()
};

CAboutDlg::CAboutDlg() : CDialog(CAboutDlg::IDD)
{
	//{{AFX_DATA_INIT(CAboutDlg)
	//}}AFX_DATA_INIT
}

void CAboutDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialog::DoDataExchange(pDX);
	//{{AFX_DATA_MAP(CAboutDlg)
	//}}AFX_DATA_MAP
}

BEGIN_MESSAGE_MAP(CAboutDlg, CDialog)
//{{AFX_MSG_MAP(CAboutDlg)
// No message handlers
//}}AFX_MSG_MAP
END_MESSAGE_MAP()

/////////////////////////////////////////////////////////////////////////////
// CWaiGuaTestDlg dialog

CWaiGuaTestDlg::CWaiGuaTestDlg(CWnd* pParent /*=NULL*/)
: CDialog(CWaiGuaTestDlg::IDD, pParent)
{
	//{{AFX_DATA_INIT(CWaiGuaTestDlg)
	m_ProcName = _T("");
	//}}AFX_DATA_INIT
	// Note that LoadIcon does not require a subsequent DestroyIcon in Win32
	m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);
}

void CWaiGuaTestDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialog::DoDataExchange(pDX);
	//{{AFX_DATA_MAP(CWaiGuaTestDlg)
	DDX_CBString(pDX, IDC_COM_Proc, m_ProcName);
	//}}AFX_DATA_MAP
}

BEGIN_MESSAGE_MAP(CWaiGuaTestDlg, CDialog)
//{{AFX_MSG_MAP(CWaiGuaTestDlg)
ON_WM_SYSCOMMAND()
ON_WM_PAINT()
ON_WM_QUERYDRAGICON()
ON_BN_CLICKED(IDC_BUT_GetProc, OnBUTGetProc)
ON_BN_CLICKED(IDC_BUT_EXECUTION, OnButExecution)
//}}AFX_MSG_MAP
END_MESSAGE_MAP()

/////////////////////////////////////////////////////////////////////////////
// CWaiGuaTestDlg message handlers

BOOL CWaiGuaTestDlg::OnInitDialog()
{
	CDialog::OnInitDialog();
	
	// Add "About..." menu item to system menu.
	
	// IDM_ABOUTBOX must be in the system command range.
	ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);
	ASSERT(IDM_ABOUTBOX < 0xF000);
	
	CMenu* pSysMenu = GetSystemMenu(FALSE);
	if (pSysMenu != NULL)
	{
		CString strAboutMenu;
		strAboutMenu.LoadString(IDS_ABOUTBOX);
		if (!strAboutMenu.IsEmpty())
		{
			pSysMenu->AppendMenu(MF_SEPARATOR);
			pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);
		}
	}
	
	// Set the icon for this dialog.  The framework does this automatically
	//  when the application's main window is not a dialog
	SetIcon(m_hIcon, TRUE);			// Set big icon
	SetIcon(m_hIcon, FALSE);		// Set small icon
	
	// TODO: Add extra initialization here
	
	return TRUE;  // return TRUE  unless you set the focus to a control
}

void CWaiGuaTestDlg::OnSysCommand(UINT nID, LPARAM lParam)
{
	if ((nID & 0xFFF0) == IDM_ABOUTBOX)
	{
		CAboutDlg dlgAbout;
		dlgAbout.DoModal();
	}
	else
	{
		CDialog::OnSysCommand(nID, lParam);
	}
}

// If you add a minimize button to your dialog, you will need the code below
//  to draw the icon.  For MFC applications using the document/view model,
//  this is automatically done for you by the framework.

void CWaiGuaTestDlg::OnPaint() 
{
	if (IsIconic())
	{
		CPaintDC dc(this); // device context for painting
		
		SendMessage(WM_ICONERASEBKGND, (WPARAM) dc.GetSafeHdc(), 0);
		
		// Center icon in client rectangle
		int cxIcon = GetSystemMetrics(SM_CXICON);
		int cyIcon = GetSystemMetrics(SM_CYICON);
		CRect rect;
		GetClientRect(&rect);
		int x = (rect.Width() - cxIcon + 1) / 2;
		int y = (rect.Height() - cyIcon + 1) / 2;
		
		// Draw the icon
		dc.DrawIcon(x, y, m_hIcon);
	}
	else
	{
		CDialog::OnPaint();
	}
}

// The system calls this to obtain the cursor to display while the user drags
//  the minimized window.
HCURSOR CWaiGuaTestDlg::OnQueryDragIcon()
{
	return (HCURSOR) m_hIcon;
}

void CWaiGuaTestDlg::OnBUTGetProc() 
{
	// TODO: Add your control notification handler code here
	((CComboBox *)GetDlgItem(IDC_COM_Proc))->ResetContent();
	
	for(int i=0 ; i < 100 ; i++)
		szThreadId[i] = 0;
	
	HANDLE hSnapShot;
	PROCESSENTRY32 szEntry;
	
	szEntry.dwSize = sizeof(PROCESSENTRY32);
	
	hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS , 0);
	
	if(hSnapShot == INVALID_HANDLE_VALUE)
	{
		MessageBox("CreateToolhelp32Snapshot Error!");
		return;
	}
	
	if(Process32First(hSnapShot,&szEntry))
	{
		int i=1;
		((CComboBox *)GetDlgItem(IDC_COM_Proc))->AddString(szEntry.szExeFile);
		
		szThreadId[0] = szEntry.th32ProcessID;
		
		while(Process32Next(hSnapShot,&szEntry))
		{
			((CComboBox *)GetDlgItem(IDC_COM_Proc))->AddString(szEntry.szExeFile);
			szThreadId[i] = szEntry.th32ProcessID;
			i++;
		}
		
		MessageBox("获取系统进程列表成功");
		((CComboBox *)GetDlgItem(IDC_COM_Proc))->SetCurSel(i-1);
		
		return;
	}
}

void CWaiGuaTestDlg::OnButExecution() 
{
	// TODO: Add your control notification handler code here
	
	//*******跳过远程线程代码,执行本程序*******
	goto REMOTE_THREAD_END;
	
	
	//////////////////////////////////////////////////////////////////////////
	//////*******远程线程代码*******
	//////////////////////////////////////////////////////////////////////////
REMOTE_THREAD_BEGIN:
	
	_asm	
	{
		//*******给LoadLibrary函数地址占位*******
LoadLibraryAddr:
		nop
		nop
		nop
		nop
		//*******给FreeLibrary函数地址占位*******
FreeLibraryAddr:
		nop
		nop
		nop
		nop
		//*******给动态链接库名占位*******
LibraryName:
		nop
		nop
		nop
		nop
		nop
		nop
		nop
		nop
		

		//*******代码开始的真正位置*******
REMOTE_THREAD_CODE:	
	
		//*******实现地址重定位，ebx保存差值*******
		call	relocal
relocal:
		pop		ebx
		sub		ebx , offset relocal
		
		//////////////////////////////////////////////////////////////////////////
		//*******调用LoadLibrary*******
		//////////////////////////////////////////////////////////////////////////
		//*******压入LoadLibrary参数(动态链接库名)*******
		mov		eax , ebx
		add		eax , offset LibraryName
		push	eax
		
		//*******调用LoadLibrary*******
		mov		eax , ebx
		add		eax , offset LoadLibraryAddr
		mov		eax , [eax]
		call	eax
		
		or		eax , eax
		jnz		NEXT1
		ret
		//////////////////////////////////////////////////////////////////////////
		//*******以上调用LoadLibrary*******
		//////////////////////////////////////////////////////////////////////////

NEXT1:
		// *******压入FreeLibrary参数*******
		push	eax
		
		// *******调用FreeLibrary*******
		mov		eax , ebx
		add		eax , offset FreeLibraryAddr
		mov		eax , [eax]
		call	eax
		//////////////////////////////////////////////////////////////////////////
		//*******以上调用FreeLibrary*******
		//////////////////////////////////////////////////////////////////////////
		ret
		
	}
REMOTE_THREAD_END:
	//////////////////////////////////////////////////////////////////////////
	////以上为远程线程代码
	//////////////////////////////////////////////////////////////////////////
	
	
	//*******首先获取选中的进程句柄*******
	
	int nSelectedThreadId;
	nSelectedThreadId = ((CComboBox *)GetDlgItem(IDC_COM_Proc))->GetCurSel();
	
	nSelectedThreadId = szThreadId[nSelectedThreadId];
	
	HANDLE hSelectedProcHandle;
	
	hSelectedProcHandle = OpenProcess(PROCESS_ALL_ACCESS , FALSE , nSelectedThreadId);
	if(!hSelectedProcHandle)
	{
		MessageBox("打开进程失败!");
		return;
	}
	
	// *******得到远程线程代码长度*******
	
	int nRemoteThreadCodeLength;
	
	_asm 
	{
		mov	eax , offset REMOTE_THREAD_END
			mov	ebx , offset REMOTE_THREAD_BEGIN
			sub	eax , ebx
			mov	nRemoteThreadCodeLength , eax
	}
	
	// *******在宿主进程中申请远程线程代码空间*******
	
	LPVOID pRemoteThreadAddr;
	
	pRemoteThreadAddr = VirtualAllocEx(hSelectedProcHandle , NULL , nRemoteThreadCodeLength , 
		MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	
	if(!pRemoteThreadAddr)
	{
		MessageBox("Alloc Memory Error!");
		return;
	}
	
	
	//*******向宿主进程空间中复制远程线程代码*******
	
	LPVOID	pRemoteThreadCodeBuf;
	DWORD	nWritenNum , nSuccess;
	
	_asm mov	eax , offset REMOTE_THREAD_BEGIN
		_asm mov	pRemoteThreadCodeBuf , eax
		
		nSuccess = WriteProcessMemory(hSelectedProcHandle , pRemoteThreadAddr , pRemoteThreadCodeBuf ,
		nRemoteThreadCodeLength , &nWritenNum);
	
	if(!nSuccess)
	{
		MessageBox("Copy Remote Thread Code Error!");
		return;
	}
	
	
	
	
	
	// *******修正远程线程代码*******
	
	// *******首先获取两个关键函数的地址*******
	
	HMODULE hKernel32;
	hKernel32 = LoadLibrary("Kernel32.dll");
	
	if(!hKernel32)
	{
		MessageBox("导入Kernel32.dll错误!");
		return;
	}
	
	LPVOID pLoadLibrary , pGetProcAddress , pFreeLibrary;
	
	pLoadLibrary = (LPVOID)GetProcAddress(hKernel32 , "LoadLibraryA");
	
	if(!pLoadLibrary)
	{
		MessageBox("获取LoadLibrary函数地址失败!");
		return;
	}
	
	pGetProcAddress = (LPVOID)GetProcAddress(hKernel32 , "GetProcAddress");
	
	if(!pGetProcAddress)
	{
		MessageBox("获取GetProcAddress函数地址失败!");
		return;
	}
	
	pFreeLibrary = (LPVOID)GetProcAddress(hKernel32 , "FreeLibrary");
	
	if(!pGetProcAddress)
	{
		MessageBox("获取FreeLibrary函数地址失败!");
		return;
	}
	
	// *******修正代码*******
	
	PBYTE pRemoteAddrMove;
	
	pRemoteAddrMove = (PBYTE)pRemoteThreadAddr;
	
	// *******修正LoadLibrary地址*******
	
	nSuccess = WriteProcessMemory(hSelectedProcHandle , 
		pRemoteAddrMove , 
		&pLoadLibrary ,
		4 , 
		&nWritenNum);
	
	if(!nSuccess)
	{
		MessageBox("修正LoadLibrary地址错误!");
		return;
	}
	
	//*******修正FreeLibrary地址*******
	
	pRemoteAddrMove +=4;
	
	nSuccess = WriteProcessMemory(hSelectedProcHandle ,
		pRemoteAddrMove , 
		&pFreeLibrary ,
		4 ,
		&nWritenNum);
	
	if(!nSuccess)
	{
		MessageBox("修正FreeLibrary地址错误!");
		return;
	}
	
	//*******传递动态链接库名*******
	
	char szDllName[8] = {"Dll.dll"};
	
	pRemoteAddrMove +=4;
	
	nSuccess = WriteProcessMemory(hSelectedProcHandle , 
		pRemoteAddrMove , 
		szDllName ,
		8 , 
		&nWritenNum);
	
	if(!nSuccess)
	{
		MessageBox("修正GetProcAddress地址错误!");
		return;
	}
	
	//********把指针移动到远程线程代码开始处*******
	pRemoteAddrMove +=8;
	
	// *******创建远程线程*******
	
	HANDLE hRemoteThreadHandle;
	
	// *******定义远程线程函数类型*******
	typedef unsigned long (WINAPI *stRemoteThreadProc)(LPVOID);
	
	stRemoteThreadProc pRemoteThreadProc;
	
	// *******把入口地址赋给声明的函数*******
	pRemoteThreadProc = (stRemoteThreadProc)pRemoteAddrMove;
	
	hRemoteThreadHandle = CreateRemoteThread(hSelectedProcHandle , NULL , 0 , 
		pRemoteThreadProc , 0 , 0 , NULL);
	
	
	//*******测试*******
	CString szBuf;
	szBuf.Format("开始地址：%x\nLoadLibrary地址：%x\nGetProcAddress地址%x\n代码开始地址：%x" , 
		pRemoteThreadAddr , pLoadLibrary , pGetProcAddress , pRemoteAddrMove);
	MessageBox(szBuf);	
	
	
	return;
}