遠程線程技術嵌入進程的模型

附錄：利用遠程線程技術嵌入進程的模型源碼：
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// //
// Remote DLL For Win2K by Shotgun //
// This Program can inject a DLL into Remote Process //
// //
// Released: [2001.4] //
// Author: [Shotgun] //
// Email: [Shotgun@Xici.Net] //
// Homepage: //
// [http://IT.Xici.Net] //
// [http://WWW.Patching.Net] //
// //
// USAGE: //
// RmtDLL.exe PID[|ProcessName] DLLFullPathName //
// Example: //
// RmtDLL.exe 1024 C:/WINNT/System32/MyDLL.dll //
// RmtDLL.exe Explorer.exe C:/MyDLL.dll //
// //
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
#include<windows.h>
#include<stdlib.h>
#include<stdio.h>
#include<psapi.h>

DWORD ProcessToPID( char *); //將進程名轉換為PID的函數
void CheckError ( int, int, char *); //出錯處理函數
void usage ( char *); //使用說明函數

PDWORD pdwThreadId;
HANDLE hRemoteThread, hRemoteProcess;
DWORD fdwCreate, dwStackSize, dwRemoteProcessId;
PWSTR pszLibFileRemote=NULL;

void main(int argc,char **argv)
{
int iReturnCode;
char lpDllFullPathName[MAX_PATH];
WCHAR pszLibFileName[MAX_PATH]={0};
//處理命令列參數
if (argc!=3) usage("Parametes number incorrect!");
else{
//如果輸入的是進程名，則轉化為PID
if(isdigit(*argv[1])) dwRemoteProcessId = atoi(argv[1]);
else dwRemoteProcessId = ProcessToPID(argv[1]);
//判斷輸入的DLL檔案名稱是否是絕對路徑
if(strstr(argv[2],"://")!=NULL)
strncpy(argv[2], lpDllFullPathName, MAX_PATH);
else
{ //取得目前的目錄，將相對路徑轉換成絕對路徑
iReturnCode = GetCurrentDirectory(MAX_PATH, lpDllFullPathName);
CheckError(iReturnCode, 0, "GetCurrentDirectory");
strcat(lpDllFullPathName, "//");
strcat(lpDllFullPathName, argv[2]);
printf("Convert DLL filename to FullPathName:/n/t%s/n/n",
lpDllFullPathName);
}
//判斷DLL檔案是否存在
iReturnCode=(int)_lopen(lpDllFullPathName, OF_READ);
CheckError(iReturnCode, HFILE_ERROR, "DLL File not Exist");
//將DLL檔案全路徑的ANSI碼轉換成UNICODE碼
iReturnCode = MultiByteToWideChar(CP_ACP, MB_ERR_INVALID_CHARS,
lpDllFullPathName, strlen(lpDllFullPathName),
pszLibFileName, MAX_PATH);
CheckError(iReturnCode, 0, "MultByteToWideChar");
//輸出最後的巨集指令引數
wprintf(L"Will inject %s", pszLibFileName);
printf(" into process:%s PID=%d/n", argv[1], dwRemoteProcessId);
}

//開啟遠程進程
hRemoteProcess = OpenProcess(PROCESS_CREATE_THREAD | //允許建立線程
PROCESS_VM_OPERATION | //允許VM操作
PROCESS_VM_WRITE, //允許VM寫
FALSE, dwRemoteProcessId );
CheckError( (int) hRemoteProcess, NULL,
"Remote Process not Exist or Access Denied!");
//計算DLL路徑名需要的記憶體空間
int cb = (1 + lstrlenW(pszLibFileName)) * sizeof(WCHAR);
pszLibFileRemote = (PWSTR) VirtualAllocEx( hRemoteProcess, NULL, cb,
MEM_COMMIT, PAGE_READWRITE);
CheckError((int)pszLibFileRemote, NULL, "VirtualAllocEx");
//將DLL的路徑名複製到遠程進程的記憶體空間
iReturnCode = WriteProcessMemory(hRemoteProcess,
pszLibFileRemote, (PVOID) pszLibFileName, cb, NULL);
CheckError(iReturnCode, false, "WriteProcessMemory");
//計算LoadLibraryW的入口地址
PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)
GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW");
CheckError((int)pfnStartAddr, NULL, "GetProcAddress");
//啟動遠程線程，通過遠程線程調用使用者的DLL檔案
hRemoteThread = CreateRemoteThread( hRemoteProcess, NULL, 0, pfnStartAddr, pszLibFileRemote, 0, NULL);
CheckError((int)hRemoteThread, NULL, "Create Remote Thread");
//等待遠程線程退出
WaitForSingleObject(hRemoteThread, INFINITE);
//清場處理
if (pszLibFileRemote != NULL)
VirtualFreeEx(hRemoteProcess, pszLibFileRemote, 0, MEM_RELEASE);
if (hRemoteThread != NULL) CloseHandle(hRemoteThread );
if (hRemoteProcess!= NULL) CloseHandle(hRemoteProcess);
}//end of main()

//將進程名轉換為PID的函數
DWORD ProcessToPID(char *InputProcessName)
{
DWORD aProcesses[1024], cbNeeded, cProcesses;
unsigned int i;
HANDLE hProcess;
HMODULE hMod;
char szProcessName[MAX_PATH] = "UnknownProcess";

// 計算目前有多少進程, aProcesses[]用來存放有效進程PIDs
if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) ) return 0;
cProcesses = cbNeeded / sizeof(DWORD);
// 按有效PID遍曆所有的進程
for ( i = 0; i < cProcesses; i++ )
{
// 開啟特定PID的進程
hProcess = OpenProcess( PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,
FALSE, aProcesses[i]);
// 取得特定PID的進程名
if ( hProcess )
{
if ( EnumProcessModules( hProcess, &hMod, sizeof(hMod), &cbNeeded) )
{
GetModuleBaseName( hProcess, hMod,
szProcessName, sizeof(szProcessName) );
//將取得的進程名與輸入的進程名比較，如相同則返回進程PID
if(!_stricmp(szProcessName, InputProcessName)){
CloseHandle( hProcess );
return aProcesses[i];
}
}
}//end of if ( hProcess )
}//end of for
//沒有找到相應的進程名，返回0
CloseHandle( hProcess );
return 0;
}//end of ProcessToPID

//錯誤處理函數CheckError()
//如果iReturnCode等於iErrorCode,則輸出pErrorMsg並退出
void CheckError(int iReturnCode, int iErrorCode, char *pErrorMsg)
{
if(iReturnCode==iErrorCode) {
printf("%s Error:%d/n/n", pErrorMsg, GetLastError());
//清場處理
if (pszLibFileRemote != NULL)
VirtualFreeEx(hRemoteProcess, pszLibFileRemote, 0, MEM_RELEASE);
if (hRemoteThread != NULL) CloseHandle(hRemoteThread );
if (hRemoteProcess!= NULL) CloseHandle(hRemoteProcess);
exit(0);
}
}//end of CheckError()

//使用方法說明函數usage()
void usage(char * pErrorMsg)
{
printf("%s/n/n",pErrorMsg);
printf("/t/tRemote Process DLL by Shotgun/n");
printf("/tThis program can inject a DLL into remote process/n");
printf("Email:/n");
printf("/tShotgun@Xici.Net/n");
printf("HomePage:/n");
printf("/thttp://It.Xici.Net/n");
printf("/thttp://www.Patching.Net/n");
printf("USAGE:/n");
printf("/tRmtDLL.exe PID[|ProcessName] DLLFullPathName/n");
printf("Example:/n");
printf("/tRmtDLL.exe 1024 C://WINNT//System32//MyDLL.dll/n");
printf("/tRmtDLL.exe Explorer.exe C://MyDLL.dll/n");
exit(0);
}//end of usage() --------------------------------------------------------------------------------------