当前位置: 主页 > 编程知识 > net编程 > 如何实现.net程序的进程注入

如何实现.net程序的进程注入

时间:2009-10-15来源:站长资讯网 点击:

Invoke反射出的MethodInfo对象, 我们的methodA得到了执行。

下面这个图可能会帮助你理解上面的话:

如果还没明白的话,那就看代码吧(这需要一点点C++/CLI知识,但我已经为每句加上了注释,应该蛮好懂的,关于C++/CLI可以点击这里了解更多。关于ManagedInjector可以点击这里了解更多)

以下为引用的内容:

#include "stdafx.h"
#include "Injector.h"
#include <vcclr.h>
using namespace ManagedInjector;
//defines a new window message that is guaranteed to be unique throughout the system.
//The message value can be used when sending or posting messages.
static unsigned int WM_GOBABYGO = ::RegisterWindowMessage(L"Injector_GOBABYGO!");
static HHOOK _messageHookHandle;
//-----------------------------------------------------------------------------
//Spying Process functions follow
//-----------------------------------------------------------------------------
void Injector::Launch(System::IntPtr windowHandle, System::Reflection::Assembly^ assembly, System::String^ className, System::String^ methodName) {
    System::String^ assemblyClassAndMethod = assembly->Location + "$" + className + "$" + methodName;
    //convert String to local wchar_t* or char*
    pin_ptr<const wchar_t> acmLocal = PtrToStringChars(assemblyClassAndMethod);
    //Maps the specified executable module into the address space of the calling process.
    HINSTANCE hinstDLL = ::LoadLibrary((LPCTSTR) _T("ManagedInjector.dll"));
    if (hinstDLL)
    {
        DWORD processID = 0;
        //get the process id and thread id
        DWORD threadID = ::GetWindowThreadProcessId((HWND)windowHandle.ToPointer(), &processID);
        if (processID)
        {
            //get the target process object (handle)
            HANDLE hProcess = ::OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
            if (hProcess)
            {
                int buffLen = (assemblyClassAndMethod->Length + 1) * sizeof(wchar_t);
                //Allocates physical storage in memory or in the paging file on disk for the specified reserved memory pages.
                //The function initializes the memory to zero.
                //The return value is the base address of the allocated region of pages.
                void* acmRemote = ::VirtualAllocEx(hProcess, NULL, buffLen, MEM_COMMIT, PAGE_READWRITE);
                if (acmRemote)
                {
                    //copies the data(the assemblyClassAndMethod string)
                    //from the specified buffer in the current process
                    //to the address range of the target process
                    ::WriteProcessMemory(hProcess, acmRemote, acmLocal, buffLen, NULL);
               
                    //Retrieves the address of MessageHookProc method from the hintsDLL
                    HOOKPROC procAddress = (HOOKPROC)GetProcAddress(hinstDLL, "MessageHookProc");
                    //install a hook procedure to the target thread(before the system sends the messages to the destination window procedure)
                    _messageHookHandle = ::SetWindowsHookEx(WH_CALLWNDPROC, procAddress, hinstDLL, threadID);
                    if (_messageHookHandle)
                    {
                        //send our custom message to the target window of the target process
                        ::SendMessage((HWND)windowHandle.ToPointer(), WM_GOBABYGO, (WPARAM)acmRemote, 0);
                        //removes the hook procedure installed in a hook chain by the SetWindowsHookEx function.
                        ::UnhookWindowsHookEx(_messageHookHandle);
                    }
                    //removes a hook procedure installed in a hook chain by the SetWindowsHookEx function.
                    ::VirtualFreeEx(hProcess, acmRemote, buffLen, MEM_RELEASE);
                }
                ::CloseHandle(hProcess);
            }
        }
        //Decrements the reference count of the loaded DLL
        ::FreeLibrary(hinstDLL);
    }
}
__declspec( dllexport )
// The procedure for hooking, this will be called back after hooked
int __stdcall MessageHookProc(int nCode, WPARAM wparam, LPARAM lparam) {
    //HC_ACTION: indicate that there are argments in wparam and lparam
    if (nCode == HC_ACTION)
    {
        CWPSTRUCT* msg = (CWPSTRUCT*)lparam;
        //when the target window received our custom message
        if (msg != NULL && msg->message == WM_GOBABYGO)
        {
            //get the argument passed by the message
            //actually, the argument is the base address (a pointer)
            //of the assemblyClassAndMethod string in the target process memory
            wchar_t* acmRemote = (wchar_t*)msg->wParam;
            //gcnew: creates an instance of a managed type (reference or value type) on the garbage collected heap
            System::String^ acmLocal = gcnew System::String(acmRemote);
            //split the string into substring array with $. Under this context:
            //acmSplit[0]:the assembly‘s location
            //acmSplit[1]:className;
            //acmSplit[2]:methodName
            //we use these infomation to reflect the method in the source assembly, and invoke it in the target process
            cli::array<System::String^>^ acmSplit = acmLocal->Split(‘$‘);
            //refect the method, and invoke it
            System::Reflection::Assembly^ assembly = System::Reflection::Assembly::LoadFile(acmSplit[0]);
            if (assembly != nullptr)
            {
                System::Type^ type = assembly->GetType(acmSplit[1]);
                if (type != nullptr)
                {
                    System::Reflection::MethodInfo^ methodInfo =
                        type->GetMethod(acmSplit[2], System::Reflection::BindingFlags::Static | System::Reflection::BindingFlags::Public);
                    if (methodInfo != nullptr)
                    {
                        methodInfo->Invoke(nullptr, nullptr);
                    }
                }
            }
        }
    }
    return CallNextHookEx(_messageHookHandle, nCode, wparam, lparam);
}

 

站长资讯网
.
分页: [1] [2] [3]
TAG: NET 进程 程序
推荐内容最近更新人气排行
关于我们 | 友情链接 | 网址推荐 | 常用资讯 | 网站地图 | RSS | 留言