Windows 7 DLL注入

Question

我正在尝试将dll注入到现有进程中。我正在尝试使用CreateRemoteThread LoadLibrary的方式。我知道它是如何工作的，但是我不明白为什么CreateRemoteThread会返回null (失败)……我使用的是Windows7，所以这可能是原因，但我不确定是不是。也许我需要设置权限？我的代码如下：

#define DLL_NAME "message.dll"

void main()
{
    InjectDLL(1288, DLL_NAME);
}

BOOL InjectDLL(DWORD dwProcessId, LPCSTR lpszDLLPath)
{

    HANDLE  hProcess, hThread;
    LPVOID  lpBaseAddr, lpFuncAddr;
    DWORD   dwMemSize, dwExitCode;
    BOOL    bSuccess = FALSE;
    HMODULE hUserDLL;

    if((hProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_QUERY_INFORMATION|PROCESS_VM_OPERATION
        |PROCESS_VM_WRITE|PROCESS_VM_READ, FALSE, dwProcessId)))
    {
        dwMemSize = lstrlen(lpszDLLPath) + 1;
        if(lpBaseAddr = VirtualAllocEx(hProcess, NULL, dwMemSize, MEM_COMMIT, PAGE_READWRITE))
        {
            if(WriteProcessMemory(hProcess, lpBaseAddr, lpszDLLPath, dwMemSize, NULL))
            {
                if(hUserDLL = LoadLibrary(TEXT("kernel32.dll")))
                {
                    if(lpFuncAddr = GetProcAddress(hUserDLL, TEXT("LoadLibraryA")))
                    {
                        if(hThread = CreateRemoteThread(hProcess, NULL, 0, lpFuncAddr, lpBaseAddr, 0, NULL))
                        {
                            WaitForSingleObject(hThread, INFINITE);
                            if(GetExitCodeThread(hThread, &dwExitCode)) {
                                bSuccess = (dwExitCode != 0) ? TRUE : FALSE;
                            }
                            CloseHandle(hThread);
                        }
                    }
                    FreeLibrary(hUserDLL);
                }
            }
            VirtualFreeEx(hProcess, lpBaseAddr, 0, MEM_RELEASE);
        }
        CloseHandle(hProcess);
    }

    return bSuccess;
}

Answer 1

是的，在你打开进程之前，你需要特权，下面是代码：

 int GimmePrivileges(){ 
HANDLE Token;  
TOKEN_PRIVILEGES tp;      
if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &Token)    
{ 
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);     
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL);    
}      
}   

另一件事..。此代码令人困惑！你需要合成！