procedure TForm1.btn1Click(Sender: TObject);
var
hd: HWND;
MyPid: DWORD;
begin
hd := findwindow(nil, '我的电脑');
GetWindowThreadprocessID(hd, MyPid);
//ShowMessage(IntToStr(MyPid));//找到Pid是没错的
InjectDll('testDll.dll', MyHwnd);
end;
为什么不成功啊?PS:同样的代码换成注入Dll到记事本中就成功~真是晕啊请高手指点一下,哪里出问题啦?以下是调用:
——————————————————————————————————————
function EnableDebugPriv: Boolean;
var
hToken: THandle;
tp: TTokenPrivileges;
rl: Cardinal;
begin
Result := false; //打开进程令牌环
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY,
hToken); //获得进程本地唯一ID
if LookupPrivilegeValue(nil, 'SeDebugPrivilege', tp.Privileges[0].Luid) then
begin
tp.PrivilegeCount := 1;
tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
//调整权限
Result := AdjustTokenPrivileges(hToken, false, tp, SizeOf(tp), nil, rl);
end;
end;function InjectDll(const DllFullPath: string; const dwRemoteProcessId:
Cardinal): Boolean;
var
hRemoteProcess, hRemoteThread: THandle;
pszLibFileRemote: Pointer;
pszLibAFilename: PwideChar;
pfnStartAddr: TFNThreadStartRoutine;
memSize, WriteSize, lpThreadId: Cardinal;
begin
Result := false;
// 调整权限,使程序可以访问其他进程的内存空间
if EnableDebugPriv then
begin
//打开远程线程 PROCESS_ALL_ACCESS 参数表示打开所有的权限
hRemoteProcess := OpenProcess(PROCESS_ALL_ACCESS, false, dwRemoteProcessId); try // 为注入的dll文件路径分配内存大小,由于为WideChar,故要乘2
GetMem(pszLibAFilename, Length(DllFullPath) * 2 + 1);
// 之所以要转换成 WideChar, 是因为当DLL位于有中文字符的路径下时不会出错
StringToWideChar(DllFullPath, pszLibAFilename, Length(DllFullPath) * 2 +
1);
// 计算 pszLibAFilename 的长度,注意,是以字节为单元的长度
memSize := (1 + lstrlenW(pszLibAFilename)) * SizeOf(WCHAR); //使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名空间
pszLibFileRemote := VirtualAllocEx(hRemoteProcess, nil,
memSize, MEM_COMMIT, PAGE_READWRITE); if Assigned(pszLibFileRemote) then
begin
//使用WriteProcessMemory函数将DLL的路径名写入到远程进程的内存空间
if WriteProcessMemory(hRemoteProcess, pszLibFileRemote,
pszLibAFilename, memSize, WriteSize) and (WriteSize = memSize) then
begin
lpThreadId := 0;
// 计算LoadLibraryW的入口地址
pfnStartAddr := GetProcAddress(LoadLibrary('Kernel32.dll'),
'LoadLibraryW');
// 启动远程线程LoadLbraryW,通过远程线程调用创建新的线程
hRemoteThread := CreateRemoteThread(hRemoteProcess, nil,
0, pfnStartAddr, pszLibFileRemote, 0, lpThreadId); // 如果执行成功返回 True;
if (hRemoteThread <> 0) then
Result := true; // 释放句柄
CloseHandle(hRemoteThread);
end;
end;
finally
// 释放句柄
CloseHandle(hRemoteProcess);
end;
end;
end;
var
hd: HWND;
MyPid: DWORD;
begin
hd := findwindow(nil, '我的电脑');
GetWindowThreadprocessID(hd, MyPid);
//ShowMessage(IntToStr(MyPid));//找到Pid是没错的
InjectDll('testDll.dll', MyHwnd);
end;
为什么不成功啊?PS:同样的代码换成注入Dll到记事本中就成功~真是晕啊请高手指点一下,哪里出问题啦?以下是调用:
——————————————————————————————————————
function EnableDebugPriv: Boolean;
var
hToken: THandle;
tp: TTokenPrivileges;
rl: Cardinal;
begin
Result := false; //打开进程令牌环
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY,
hToken); //获得进程本地唯一ID
if LookupPrivilegeValue(nil, 'SeDebugPrivilege', tp.Privileges[0].Luid) then
begin
tp.PrivilegeCount := 1;
tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
//调整权限
Result := AdjustTokenPrivileges(hToken, false, tp, SizeOf(tp), nil, rl);
end;
end;function InjectDll(const DllFullPath: string; const dwRemoteProcessId:
Cardinal): Boolean;
var
hRemoteProcess, hRemoteThread: THandle;
pszLibFileRemote: Pointer;
pszLibAFilename: PwideChar;
pfnStartAddr: TFNThreadStartRoutine;
memSize, WriteSize, lpThreadId: Cardinal;
begin
Result := false;
// 调整权限,使程序可以访问其他进程的内存空间
if EnableDebugPriv then
begin
//打开远程线程 PROCESS_ALL_ACCESS 参数表示打开所有的权限
hRemoteProcess := OpenProcess(PROCESS_ALL_ACCESS, false, dwRemoteProcessId); try // 为注入的dll文件路径分配内存大小,由于为WideChar,故要乘2
GetMem(pszLibAFilename, Length(DllFullPath) * 2 + 1);
// 之所以要转换成 WideChar, 是因为当DLL位于有中文字符的路径下时不会出错
StringToWideChar(DllFullPath, pszLibAFilename, Length(DllFullPath) * 2 +
1);
// 计算 pszLibAFilename 的长度,注意,是以字节为单元的长度
memSize := (1 + lstrlenW(pszLibAFilename)) * SizeOf(WCHAR); //使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名空间
pszLibFileRemote := VirtualAllocEx(hRemoteProcess, nil,
memSize, MEM_COMMIT, PAGE_READWRITE); if Assigned(pszLibFileRemote) then
begin
//使用WriteProcessMemory函数将DLL的路径名写入到远程进程的内存空间
if WriteProcessMemory(hRemoteProcess, pszLibFileRemote,
pszLibAFilename, memSize, WriteSize) and (WriteSize = memSize) then
begin
lpThreadId := 0;
// 计算LoadLibraryW的入口地址
pfnStartAddr := GetProcAddress(LoadLibrary('Kernel32.dll'),
'LoadLibraryW');
// 启动远程线程LoadLbraryW,通过远程线程调用创建新的线程
hRemoteThread := CreateRemoteThread(hRemoteProcess, nil,
0, pfnStartAddr, pszLibFileRemote, 0, lpThreadId); // 如果执行成功返回 True;
if (hRemoteThread <> 0) then
Result := true; // 释放句柄
CloseHandle(hRemoteThread);
end;
end;
finally
// 释放句柄
CloseHandle(hRemoteProcess);
end;
end;
end;
解决方案 »
免费领取超大流量手机卡,每月29元包185G流量+100分钟通话, 中国电信官方发货