简单的CreateRemoteThread例程-初学者必看

王朝other·作者佚名  2006-01-09
窄屏简体版  字體: |||超大  

简单的CreateRemoteThread例程-初学者必看

// _remotethreaddemo.cpp : Defines the entry point for the console application.

// Author:秋镇菜

#include "stdafx.h"

#include "windows.h"

// ========== 定义一个代码结构,本例为一个对话框============

struct MyData

{

char sz[64]; // 对话框显示内容

DWORD dwMessageBox; // 对话框的地址

};

// ========== 远程线程的函数 ==============================

DWORD __stdcall RMTFunc(MyData *pData)

{

typedef int(__stdcall*MMessageBox)(HWND,LPCTSTR,LPCTSTR,UINT);

MMessageBox MsgBox = (MMessageBox)pData->dwMessageBox;

MsgBox(NULL, pData->sz, NULL, MB_OK);

return 0;

}

int main(int argc, char* argv[])

{

// ===== 获得需要创建REMOTETHREAD的进程句柄 ===============================

HWND hWnd = FindWindow("notepad", NULL); // 以NOTEPAD为例

DWORD dwProcessId;

::GetWindowThreadProcessId(hWnd, &dwProcessId);

HANDLE hProcess = OpenProcess(

PROCESS_ALL_ACCESS,

FALSE,

dwProcessId);

// ========= 代码结构 ================================================

MyData data;

ZeroMemory(&data, sizeof (MyData));

strcat(data.sz, "对话框的内容.");

HINSTANCE hUser = LoadLibrary("user32.dll");

if (! hUser)

{

printf("Can not load library.\n");

return 0;

}

data.dwMessageBox = (DWORD)GetProcAddress(hUser, "MessageBoxA");

FreeLibrary(hUser);

if (! data.dwMessageBox)

return 0;

// ======= 分配空间 ===================================================

void *pRemoteThread

= VirtualAllocEx(hProcess, 0,

1024*4, MEM_COMMIT|MEM_RESERVE,

PAGE_EXECUTE_READWRITE);

if (! pRemoteThread)

return 0;

if (! WriteProcessMemory(hProcess, pRemoteThread, &RMTFunc, 1024*4, 0))

return 0;

MyData *pData

= (MyData*)VirtualAllocEx(hProcess, 0,

sizeof (MyData), MEM_COMMIT,

PAGE_READWRITE);

if (!pData)

return 0;

if (! WriteProcessMemory(hProcess, pData, &data, sizeof (MyData), 0))

return 0;

// =========== 创建远程线程 ===========================================

HANDLE hThread

= CreateRemoteThread(hProcess, 0,

0, (LPTHREAD_START_ROUTINE)pRemoteThread,

pData, 0, 0);

if (! hThread)

{

printf("远程线程创建失败");

return 0;

}

CloseHandle(hThread);

VirtualFreeEx(hProcess, pRemoteThread, 1024*3, MEM_RELEASE);

VirtualFreeEx(hProcess, pData, sizeof (MyData), MEM_RELEASE);

CloseHandle(hProcess);

printf("Hello World!\n");

return 0;

}

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航