创建远程线程(转)

创建远程线程

// _remotethreaddemo.cpp : Defines the entry point for the console application.

// Author:秋镇菜

#include "stdafx.h"

#include "windows.h"

// ========== 定义一个代码结构,本例为一个对话框============

struct MyData

{

char sz[64]; // 对话框显示内容

DWORD dwMessageBox; // 对话框的地址

};

// ========== 远程线程的函数 ==============================

DWORD __stdcall RMTFunc(MyData *pData)

{

typedef int(__stdcall*MMessageBox)(HWND,LPCTSTR,LPCTSTR,UINT);

MMessageBox MsgBox = (MMessageBox)pData->dwMessageBox;

MsgBox(NULL, pData->sz, NULL, MB_OK);

return 0;

}

int main(int argc, char* argv[])

{

// ===== 获得需要创建REMOTETHREAD的进程句柄 ===============================

HWND hWnd = FindWindow("notepad", NULL); // 以NOTEPAD为例

DWORD dwProcessId;

::GetWindowThreadProcessId(hWnd, &dwProcessId);

HANDLE hProcess = OpenProcess(

PROCESS_ALL_ACCESS,

FALSE,

dwProcessId);

// ========= 代码结构 ================================================

MyData data;

ZeroMemory(&data, sizeof (MyData));

strcat(data.sz, "对话框的内容.");

HINSTANCE hUser = LoadLibrary("user32.dll");

if (! hUser)

{

printf("Can not load library.\n");

return 0;

}

data.dwMessageBox = (DWORD)GetProcAddress(hUser, "MessageBoxA");

FreeLibrary(hUser);

if (! data.dwMessageBox)

return 0;

// ======= 分配空间 ===================================================

void *pRemoteThread

= VirtualAllocEx(hProcess, 0,

1024*4, MEM_COMMIT|MEM_RESERVE,

PAGE_EXECUTE_READWRITE);

if (! pRemoteThread)

return 0;

if (! WriteProcessMemory(hProcess, pRemoteThread, &RMTFunc, 1024*4, 0))

return 0;

MyData *pData

= (MyData*)VirtualAllocEx(hProcess, 0,

sizeof (MyData), MEM_COMMIT,

PAGE_READWRITE);

if (!pData)

return 0;

if (! WriteProcessMemory(hProcess, pData, &data, sizeof (MyData), 0))

return 0;

// =========== 创建远程线程 ===========================================

HANDLE hThread

= CreateRemoteThread(hProcess, 0,

0, (LPTHREAD_START_ROUTINE)pRemoteThread,

pData, 0, 0);

if (! hThread)

{

printf("远程线程创建失败");

return 0;

}

CloseHandle(hThread);

VirtualFreeEx(hProcess, pRemoteThread, 1024*3, MEM_RELEASE);

VirtualFreeEx(hProcess, pData, sizeof (MyData), MEM_RELEASE);

CloseHandle(hProcess);

printf("Hello World!\n");

return 0;

}