// Injector.cpp文件.
//
#include "stdafx.h"
#include <windows.h>
#include <tlhelp32.h>

//-----------------------------------------------------------------------------------------
// 在進程空間注入的DLL.
BOOL WINAPI LoadLib(DWORD dwProcessId, LPTSTR lpszLibName)
{
	BOOL   bResult          = FALSE; 
	HANDLE hProcess         = NULL;
	HANDLE hThread          = NULL;
	PSTR   pszLibFileRemote = NULL;

	__try 
	{
		// 獲得想要注入代碼的進程的句柄.
		hProcess = OpenProcess(
			PROCESS_ALL_ACCESS, 
			FALSE, 
			dwProcessId
			);

		if (hProcess == NULL) 
			__leave;
		
	    // 計算DLL路徑名需要的字節數.
		int cch = 1 + strlen(lpszLibName);

		// 在遠程線程中為路徑名分配空間.
		pszLibFileRemote = (PSTR)VirtualAllocEx(
			hProcess, 
			NULL, 
			cch, 
			MEM_COMMIT, 
			PAGE_READWRITE
			);

		if (pszLibFileRemote == NULL) 
			__leave;
	    
		// 將DLL的路徑名復制到遠程進程的內存空間.
		if (!WriteProcessMemory(
			hProcess, 
			(PVOID)pszLibFileRemote, 
			(PVOID)lpszLibName, 
			cch, 
			NULL)) 
			__leave;
		
	
	   // 獲得LoadLibraryA在Kernel32.dll中的真正地址. 
		PTHREAD_START_ROUTINE pfnThreadRtn = 
			(PTHREAD_START_ROUTINE)GetProcAddress(
			GetModuleHandle("Kernel32"), "LoadLibraryA");

		if (pfnThreadRtn == NULL) 
			__leave;

	    // 創建遠程線程，并通過遠程線程調用用戶的DLL文件. 
		hThread = CreateRemoteThread(
			hProcess, 
			NULL, 
			0, 
			pfnThreadRtn, 
			(PVOID)pszLibFileRemote, 
			0, 
			NULL
			);
		if (hThread == NULL) 
			__leave;

		// 等待遠程線程終止.
		WaitForSingleObject(hThread, INFINITE);

		bResult = TRUE; 
	}
	__finally 
	{ 
		// 關閉句柄. 
		if (pszLibFileRemote != NULL) 
			VirtualFreeEx(hProcess, (PVOID)pszLibFileRemote, 0, MEM_RELEASE);

		if (hThread  != NULL) 
			CloseHandle(hThread);

		if (hProcess != NULL) 
			CloseHandle(hProcess);
	}
	return bResult;
}

//-----------------------------------------------------------------------------------------
// 在進程空間釋放注入的DLL.
BOOL WINAPI FreeLib(DWORD dwProcessId, LPTSTR lpszLibName) 
{ 
	BOOL   bResult     = FALSE; 
	HANDLE hProcess    = NULL; 
	HANDLE hThread     = NULL; 
	HANDLE hthSnapshot = NULL; 
	MODULEENTRY32 hMod = {sizeof(hMod)}; 
	
	__try 
	{
		// 打開進程. 
		hProcess = OpenProcess(
			PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION, 
			FALSE, 
			dwProcessId
			); 
		
		if (hProcess == NULL) 
			__leave;
	

		// 取得FreeLibrary函數在Kernel32.dll中的地址. 
		PTHREAD_START_ROUTINE pfnThreadRtn = 
			(PTHREAD_START_ROUTINE)GetProcAddress( 
			GetModuleHandle("Kernel32.dll"), "FreeLibrary"); 

		if (pfnThreadRtn == NULL) 
			__leave;

		// 取得指定進程的所有模塊映象. 
		hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId); 
		if (hthSnapshot == NULL) 
			__leave;
		
		// 取得所有模塊列表中的指定的模塊. 
		BOOL bMoreMods = Module32First(hthSnapshot, &hMod); 
		if (bMoreMods == FALSE) 
			__leave;
		
		// 循環取得想要的模塊. 
		for (;bMoreMods; bMoreMods = Module32Next(hthSnapshot, &hMod)) 
		{ 
			if ((strcmp(hMod.szExePath, lpszLibName) == 0) ||
				(strcmp(hMod.szModule, lpszLibName) == 0)){
				break; 
			}
		} 
		
		// 創建遠程線程來執行FreeLibrary函數. 
		hThread = CreateRemoteThread(hProcess, 
			NULL, 
			0, 
			pfnThreadRtn, 
			hMod.modBaseAddr, 
			0, 
			NULL); 
		if (hThread == NULL) 
			__leave;
		
		// 等待遠程線程終止.
		WaitForSingleObject(hThread, INFINITE); 
		
		bResult=TRUE;
		
	}
	__finally 
	{ 
		// 關閉句柄. 
		if (hThread != NULL) 
			CloseHandle(hThread); 

		if (hthSnapshot  != NULL) 
			CloseHandle(hthSnapshot); 
		
		if (hProcess  != NULL) 
			CloseHandle(hProcess); 
	}
	
	return bResult; 
}