偶写了一个VC 控制台应用程序,用于远程线程插入的测试
/////////////////////////////////////////////
// MainFile.cpp //
/////////////////////////////////////////////#include <windows.h>
#include <iostream.h>
#include <tlhelp32.h>DWORD WINAPI NewThread(
LPVOID lpParameter // thread data
);
DWORD __stdcall RemoteThreadProc(
LPVOID lpParameter // thread data
);DWORD GetProcessID(HANDLE hProc,char * szFileName);char szString[1024]="";HANDLE hMutex;void main()
{
HANDLE hThread=CreateThread(NULL,0,NewThread,NULL,TRUE,NULL);
if(hThread!=NULL)
{
hMutex=CreateMutex(NULL,TRUE,NULL);
}
cout<<"szString 值:"<<szString<<endl;
cout<<"This is Main Thread!!"<<endl;
strcpy(szString,"MainThread: 第一次赋值!");
cout<<"szString 值:"<<szString<<endl;
strcpy(szString,"MainThread: 第二次赋值!");
cout<<"szString 值:"<<szString<<endl;
//暂定线程体大小为4K,实际上没这么大,稍后我将会介绍
const DWORD THREADSIZE=1024*4;
DWORD byte_write;
//获得指定进程ID句柄,并设其权限为PROCESS_ALL_ACCESS,992是宿进程的ID号,获取ID号的方法这里我就不多讲了
HANDLE hWnd = ::OpenProcess ( PROCESS_ALL_ACCESS,
FALSE,
GetProcessID(NULL,"Explorer.EXE"));
if(!hWnd)
return ;
//申请
void *pRemoteThread =::VirtualAllocEx( hWnd,
0,
THREADSIZE,
MEM_COMMIT| MEM_RESERVE,
PAGE_EXECUTE_READWRITE);
if(!pRemoteThread)
return ;
if(!::WriteProcessMemory(hWnd,
pRemoteThread,
&RemoteThreadProc,
THREADSIZE,0))//写入进程
return ;
//启动线程
HANDLE hRemoteThread = ::CreateRemoteThread( hWnd ,
0,
0,
(DWORD (__stdcall *)(void *))pRemoteThread ,
NULL,
0,
&byte_write);
if(!hRemoteThread)
{ //还有内存分配未释放
return ;
}
strcpy(szString,"MainThread: 第三次赋值!");
cout<<"szString 值:"<<szString<<endl;
ReleaseMutex(hMutex);
return ; }
DWORD GetProcessID(HANDLE hProc,char * szFileName)
{
HANDLE hmyProc;
//创建一个进程快照
HANDLE SnapShot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(SnapShot==NULL)
return 0;
char *sztmp=new char[512];
DWORD dwProcID=0;
strcpy(sztmp,szFileName); SHFILEINFO shFileInfo;
int nIndex=0;
PROCESSENTRY32 ProcessInfo; //声明进程信息变量
ProcessInfo.dwSize=sizeof(ProcessInfo); //设置ProcessInfo的大小
//返回系统中第一个进程的信息
BOOL Status=Process32First(SnapShot,&ProcessInfo);
while(Status)
{
//得到文件信息
SHGetFileInfo( ProcessInfo.szExeFile,0,&shFileInfo,
sizeof(shFileInfo),SHGFI_ICON|SHGFI_SMALLICON);
if(strcmp(sztmp,ProcessInfo.szExeFile))
{
dwProcID=ProcessInfo.th32ProcessID;
//用 OpenProcess() 函数来得到已知ID的进程句柄
hmyProc = OpenProcess( PROCESS_ALL_ACCESS,
true, //true为句柄可继承
ProcessInfo.th32ProcessID );
if(hProc!=NULL)
hProc = hmyProc;
//关闭进程句柄
CloseHandle(hmyProc);
}
//得到下一个进程快照的信息,并保存返回进程状态
Status=Process32Next(SnapShot,&ProcessInfo);
}
//返回枚举到的进程ID
return dwProcID;}DWORD WINAPI NewThread(
LPVOID lpParameter // thread data
)
{
if(WaitForSingleObject(hMutex,INFINITE)!=WAIT_ABANDONED)
{
cout<<"This is a Local NewThread!!"<<endl;
strcpy(szString,"NewThread: 第一次赋值!");
cout<<"szString 值:"<<szString<<endl;
strcpy(szString,"NewThread: 第二次赋值!");
cout<<"szString 值:"<<szString<<endl;
strcpy(szString,"NewThread: 第三次赋值!");
cout<<"szString 值:"<<szString<<endl;
}
ReleaseMutex(hMutex);
return 0;
}DWORD __stdcall RemoteThreadProc(
LPVOID lpParameter // thread data
)
{
if(WaitForSingleObject(hMutex,INFINITE)!=WAIT_ABANDONED)
{
//cout<<"This is a Local Process!!"<<endl;
strcpy(szString,"This is RemoteThread in Explorer.EXE!!");
//cout<<"NewThread 值:"<<NewThread<<endl;
MessageBox(NULL,szString,"RemoteThread",MB_OK);
}
ReleaseMutex(hMutex);
return 0;
}
运行后,本地线程正常,远程线程没反应,看不到 MessageBox() 对话框。
大家指点一下,究竟该如何作才能保证正确的插入到指定进程中并正确运行呢?
有没有什么工具可以查看远程线程是否正确插入呢?
/////////////////////////////////////////////
// MainFile.cpp //
/////////////////////////////////////////////#include <windows.h>
#include <iostream.h>
#include <tlhelp32.h>DWORD WINAPI NewThread(
LPVOID lpParameter // thread data
);
DWORD __stdcall RemoteThreadProc(
LPVOID lpParameter // thread data
);DWORD GetProcessID(HANDLE hProc,char * szFileName);char szString[1024]="";HANDLE hMutex;void main()
{
HANDLE hThread=CreateThread(NULL,0,NewThread,NULL,TRUE,NULL);
if(hThread!=NULL)
{
hMutex=CreateMutex(NULL,TRUE,NULL);
}
cout<<"szString 值:"<<szString<<endl;
cout<<"This is Main Thread!!"<<endl;
strcpy(szString,"MainThread: 第一次赋值!");
cout<<"szString 值:"<<szString<<endl;
strcpy(szString,"MainThread: 第二次赋值!");
cout<<"szString 值:"<<szString<<endl;
//暂定线程体大小为4K,实际上没这么大,稍后我将会介绍
const DWORD THREADSIZE=1024*4;
DWORD byte_write;
//获得指定进程ID句柄,并设其权限为PROCESS_ALL_ACCESS,992是宿进程的ID号,获取ID号的方法这里我就不多讲了
HANDLE hWnd = ::OpenProcess ( PROCESS_ALL_ACCESS,
FALSE,
GetProcessID(NULL,"Explorer.EXE"));
if(!hWnd)
return ;
//申请
void *pRemoteThread =::VirtualAllocEx( hWnd,
0,
THREADSIZE,
MEM_COMMIT| MEM_RESERVE,
PAGE_EXECUTE_READWRITE);
if(!pRemoteThread)
return ;
if(!::WriteProcessMemory(hWnd,
pRemoteThread,
&RemoteThreadProc,
THREADSIZE,0))//写入进程
return ;
//启动线程
HANDLE hRemoteThread = ::CreateRemoteThread( hWnd ,
0,
0,
(DWORD (__stdcall *)(void *))pRemoteThread ,
NULL,
0,
&byte_write);
if(!hRemoteThread)
{ //还有内存分配未释放
return ;
}
strcpy(szString,"MainThread: 第三次赋值!");
cout<<"szString 值:"<<szString<<endl;
ReleaseMutex(hMutex);
return ; }
DWORD GetProcessID(HANDLE hProc,char * szFileName)
{
HANDLE hmyProc;
//创建一个进程快照
HANDLE SnapShot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(SnapShot==NULL)
return 0;
char *sztmp=new char[512];
DWORD dwProcID=0;
strcpy(sztmp,szFileName); SHFILEINFO shFileInfo;
int nIndex=0;
PROCESSENTRY32 ProcessInfo; //声明进程信息变量
ProcessInfo.dwSize=sizeof(ProcessInfo); //设置ProcessInfo的大小
//返回系统中第一个进程的信息
BOOL Status=Process32First(SnapShot,&ProcessInfo);
while(Status)
{
//得到文件信息
SHGetFileInfo( ProcessInfo.szExeFile,0,&shFileInfo,
sizeof(shFileInfo),SHGFI_ICON|SHGFI_SMALLICON);
if(strcmp(sztmp,ProcessInfo.szExeFile))
{
dwProcID=ProcessInfo.th32ProcessID;
//用 OpenProcess() 函数来得到已知ID的进程句柄
hmyProc = OpenProcess( PROCESS_ALL_ACCESS,
true, //true为句柄可继承
ProcessInfo.th32ProcessID );
if(hProc!=NULL)
hProc = hmyProc;
//关闭进程句柄
CloseHandle(hmyProc);
}
//得到下一个进程快照的信息,并保存返回进程状态
Status=Process32Next(SnapShot,&ProcessInfo);
}
//返回枚举到的进程ID
return dwProcID;}DWORD WINAPI NewThread(
LPVOID lpParameter // thread data
)
{
if(WaitForSingleObject(hMutex,INFINITE)!=WAIT_ABANDONED)
{
cout<<"This is a Local NewThread!!"<<endl;
strcpy(szString,"NewThread: 第一次赋值!");
cout<<"szString 值:"<<szString<<endl;
strcpy(szString,"NewThread: 第二次赋值!");
cout<<"szString 值:"<<szString<<endl;
strcpy(szString,"NewThread: 第三次赋值!");
cout<<"szString 值:"<<szString<<endl;
}
ReleaseMutex(hMutex);
return 0;
}DWORD __stdcall RemoteThreadProc(
LPVOID lpParameter // thread data
)
{
if(WaitForSingleObject(hMutex,INFINITE)!=WAIT_ABANDONED)
{
//cout<<"This is a Local Process!!"<<endl;
strcpy(szString,"This is RemoteThread in Explorer.EXE!!");
//cout<<"NewThread 值:"<<NewThread<<endl;
MessageBox(NULL,szString,"RemoteThread",MB_OK);
}
ReleaseMutex(hMutex);
return 0;
}
运行后,本地线程正常,远程线程没反应,看不到 MessageBox() 对话框。
大家指点一下,究竟该如何作才能保证正确的插入到指定进程中并正确运行呢?
有没有什么工具可以查看远程线程是否正确插入呢?
解决方案 »
- 急求CVI中的的Graph 控件的用法。。
- 两个窗口各有一个窗口,怎样实现将它们整合成看起来是一个窗口
- ondraw函数与onpaint有何区别哦。
- 请教高人。关于HOOK,截获封包的问题~100分相送
- CToolTipCtrl中文乱码问题.
- 急切送高分!在视图中用ado的getcollect取出的数据赋给文档变量出错!
- 请大家推荐几个VC技术资源站点,谢谢!
- 推荐一下介绍win32 static library的书
- (CFile file,fname.txt与程序在同一文件夹中)为什么用file.open("fname.txt",CFile::ModeRead),在集成开发环境中点那红色的感叹号或Ctr
- 大家想一想以后的出路吧!
- vs2003,vc7.1编译器下,_variant_t 存放__int64数据,程序编译通过,执行时异常
- 图像旋转的问题,大家帮帮忙
苍天哪~!为什么没人帮偶呀~!主啊,保佑偶吧~!