C++ DLL注入工具(完整源码)

#include "Inject_Main.h"
#include "resource.h"
#include <windows.h>
#include <TlHelp32.h>
#include <string>
#include <TCHAR.H>

using namespace std;


/// <summary>
/// 通过进程名称获取该进程句柄
/// </summary>
/// <param name="processName"></param>
/// <returns>成功返回 DWord，失败返回 0</returns>
DWORD GetProcessByName(CONST TCHAR* processName) {
    // 获取到整个系统的进程
    HANDLE processALL = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);

    // 定义一个容器，该容器用来接收，进程信息
    PROCESSENTRY32W processInfo = { 0 };
    processInfo.dwSize = sizeof(PROCESSENTRY32W);

    // 根据进程名称，循环判断是否是指定的进程
    do
    {
        if (_tcscmp(processInfo.szExeFile, processName) == 0)
        {
            // 释放进程快照，防止内存泄露
            CloseHandle(processALL);
            // 如果是返回指定进程句柄
            return processInfo.th32ProcessID;
        }
        // 一个迭代函数
    } while (Process32Next(processALL, &processInfo));
    // 释放进程快照，防止内存泄露
    CloseHandle(processALL);
    return 0;
}

/// <summary>
/// 获取指定 DLL 的内存地址
/// </summary>
/// <param name="pid"></param>
/// <param name="moduleName"></param>
/// <returns></returns>
HMODULE GetProceSSModuleHandle(DWORD pid, CONST TCHAR* moduleName) {
    MODULEENTRY32 moduleEntry;
    HANDLE handle = NULL;
    handle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid);
    if (!handle) {
        CloseHandle(handle);
        return NULL;
    }
    ZeroMemory(&moduleEntry, sizeof(MODULEENTRY32));
    moduleEntry.dwSize = sizeof(MODULEENTRY32);
    if (!Module32First(handle, &moduleEntry)) {
        CloseHandle(handle);
        return NULL;
    }
    do {
        if (_tcscmp(moduleEntry.szModule, moduleName) == 0) {
            // 释放进程快照，防止内存泄露
            CloseHandle(handle);
            return moduleEntry.hModule;
        }
    } while (Module32Next(handle, &moduleEntry));
    CloseHandle(handle);
    return 0;
}

/// <summary>
/// 把指定DLL注入到指定进程中
/// </summary>
/// <param name="processName">processName 进程名称</param>
/// <param name="dllPath">dllPath dll路径</param>
void InjectDll(const wchar_t* processName, const char* dllPath) {
    // 获取指定进程的句柄
    DWORD dword = GetProcessByName(processName);
    if (dword == 0)
    {
        MessageBox(NULL, TEXT("没有找到指定进程"), TEXT("错误"), 0);
        return;
    }
    // 打开指定进程
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dword);
    if (hProcess == NULL)
    {
        MessageBox(NULL, TEXT("指定进程打开失败"), TEXT("错误"), 0);
        return;
    }
    
    LPVOID DLLAddress = VirtualAllocEx(hProcess, NULL, strlen(dllPath), MEM_COMMIT, PAGE_READWRITE);
    

    if (WriteProcessMemory(hProcess, DLLAddress, dllPath, strlen(dllPath), NULL) == 0)
    {
        MessageBox(NULL, TEXT("路径写入失败"), TEXT("错误"), 0);
        return;
    }

    // 获取 Kernel32.dll 这个模块
    HMODULE k32 = GetModuleHandle(TEXT("Kernel32.dll"));
    // 在 Kernel32.dll 模块中找到 LoadLibrary 这个函数的内存地址
    LPVOID loadADD = GetProcAddress(k32, "LoadLibraryA");
    
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)loadADD, DLLAddress, 0, NULL);


    // 释放指定的模块
    CloseHandle(hThread);
    CloseHandle(hProcess);

}

/// <summary>
/// 把指定进程中的DLL卸载掉
/// </summary>
/// <param name="processName"></param>
/// <param name="dllPath"></param>
void UnInjectDll(const wchar_t* processName) {
    // 通过进程名称获取该进程句柄
    DWORD dword = GetProcessByName(processName);
    if (dword == 0)
    {
        MessageBox(NULL, TEXT("没有找到指定进程"), TEXT("错误"), 0);
        return;
    }
    // 获取指定进程中指定模块的内存地址
    HMODULE hmodule = GetProcessModuleHandle(dword, L"WX_Read_Write.dll");

    // 打开指定进程
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dword);
    if (hProcess == NULL)
    {
        MessageBox(NULL, TEXT("指定进程打开失败"), TEXT("错误"), 0);
        return;
    }

    // 获取 Kernel32.dll 这个模块
    HMODULE k32 = GetModuleHandle(TEXT("Kernel32.dll"));
    // 在 Kernel32.dll 模块中找到 LoadLibrary 这个函数的内存地址
    LPVOID loadADD = GetProcAddress(k32, "FreeLibrary");

    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)loadADD, (LPVOID)hmodule, 0, NULL);

    // 释放指定的模块
    CloseHandle(hThread);
    CloseHandle(hProcess);
}


/// <summary>
/// 
/// </summary>
/// <param name="hwndDlg"></param>
/// <param name="uMsg"></param>
/// <param name="wParam"></param>
/// <param name="lParam"></param>
/// <returns></returns>
INT_PTR CALLBACK dialogProc(_In_ HWND hwndDlg, _In_ UINT uMsg, _In_ WPARAM wParam, _In_ LPARAM lParam)
{
    wchar_t processName[100] = L"WeChat.exe";
    char dllPath[400] = { "C://Users//qiaoas//documents//visual studio 2015//Projects//ConsoleApplication1//Debug//WX_Read_Write.dll" };
    switch (uMsg)
    {
    case WM_INITDIALOG:
        break;
    case WM_CLOSE:
        EndDialog(hwndDlg, 0); // 关闭窗体
        break;
    case WM_COMMAND:
        

        if (wParam == Btn_Inject_DLL)
        {
            if (sizeof(processName) == 0)
            {
                MessageBox(NULL, TEXT("进程名称不能为空"), TEXT("错误"), 0);
            }
            if (sizeof(dllPath) == 0)
            {
                MessageBox(NULL, TEXT("DLL路径不能为空"), TEXT("错误"), 0);
            }
            InjectDll(processName, dllPath); // 注入DLL
        }
        if (wParam == Btn_unInject_DLL)
        {
            UnInjectDll(processName); // 卸载DLL
        }
        break;
    default:
        break;
    }
    return FALSE;
}


/// <summary>
/// 初始化
/// </summary>
/// <param name="hInstance"></param>
/// <param name="hPrevInstance"></param>
/// <param name="lpCmdLine"></param>
/// <param name="nCmdShow"></param>
/// <returns></returns>
int apiENTRY wWinMain(_In_ HINSTANCE hInstance,
    _In_opt_ HINSTANCE hPrevInstance,
    _In_ LPWSTR    lpCmdLine,
    _In_ int       nCmdShow)
{
    DialogBox(hInstance, MAKEINTRESOURCE(IDD_DIALOG1), NULL, &dialogProc);
    return 0;
}

WINBASEAPI
_Ret_maybenull_
HMODULE
WINAPI
LoadLibraryA(
    _In_ LPCSTR lpLibFileName
    );

WINBASEAPI
_Ret_maybenull_
HMODULE
WINAPI
LoadLibraryW(
    _In_ LPCWSTR lpLibFileName
    );

#ifdef UNICODE
#define LoadLibrary  LoadLibraryW
#else
#define LoadLibrary  LoadLibraryA
#endif // !UNICODE