用exe控制另一个exe并调用函数
MyDll.h
#ifndef __MYDLL_H__
#define __MYDLL_H__
#include<CLIB_H\CLIB2_global.h>//包含CLIB0_print.h
//#include<transform\CLIB_transform.cpp>
#include <iostream>
using namespace std;
#include <stdio.h>
#include <Windows.h>
#include <TlHelp32.h>
#ifndef EXC
#define EXC extern"C" __declspec(dllexport) //
#define EX __declspec(dllexport) //extern"C"
#endif
/**/
//----共享节--------------------------
#pragma data_seg("MY_share")
int i共享G=-1;
//float *ΨLfG={0.0,0.0}; //Χ
float ΨLfG[]={0.0,0.0};//√
DWORD LiG[2]={0,0};//√
#pragma data_seg()
#pragma comment(linker,"/section:MY_share,rws")
volatile DWORD iG;
EXC void SetData(int temp)
{
i共享G=temp; ΨLfG[0]=0.56;PRINT1(+f,ΨLfG[0],f);
//ViG.push_back(temp);PTvector??(ViG);
//ViG[0]=temp;
LiG[0]=temp;
PRINT1(+push_back,temp,d);
}
EXC DWORD iGetData()
{
//PTvector??(ViG);
PRINT3(,i共享G,LiG[0],ΨLfG[0],d,d,f);
return i共享G;
}
////////////////////////////////////////////
typedef DWORD (WINAPI *♂Δ函数指针nt)
(
PHANDLE ThreadHandle,
ACCESS_MASK DesiredAccess,
LPVOID ObjectAttributes,
HANDLE ProcessHandle,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
BOOL CreateSuspended, //●●这个BOOL是int
DWORD dwStackSize,
DWORD dw1,
DWORD dw2,
LPVOID Unknown
);
typedef DWORD64(WINAPI *♂Δ函数指针nt64)
(
PHANDLE ThreadHandle,
ACCESS_MASK DesiredAccess,
LPVOID ObjectAttributes,
HANDLE ProcessHandle,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
BOOL CreateSuspended,
DWORD64 dwStackSize,
DWORD64 Unknown1,
DWORD64 Unknown2,
LPVOID Unknown3
);
//==============================
HANDLE hΔ打开进程(LPCTSTR lp寻找进程)//根据进程名查找进程PID
{
DWORD dw打开进程 = 0; HANDLE h打开进程 =0;
HANDLE h快照 = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); //可以通过获取进程信息为指定的进程、进程使用的堆[HEAP]、模块[MODULE]、线程建立一个快照。
if(h快照 == INVALID_HANDLE_VALUE)
{
PRINT1(★获得进程快照失败:,GetLastError(),d);
return h打开进程;
}
PROCESSENTRY32 pe入口;//声明进程入口对象
pe入口.dwSize = sizeof(PROCESSENTRY32);//填充进程入口对象大小
Process32First(h快照,&pe入口);//遍历进程列表 //process32First是一个进程获取函数，当我们利用函数CreateToolhelp32Snapshot()获得当前运行进程的快照后，我们可以利用process32First函数来获得第一个进程的句柄。
printf("lp寻找进程= %s\n",lp寻找进程);
do
{ //printf("pe入口.szExeFile= %s\n",pe入口.szExeFile);
if(!lstrcmp(pe入口.szExeFile,lp寻找进程))//查找指定进程名的PID
{
dw打开进程 = pe入口.th42ProcessID;
break;
}
}while (Process32Next(h快照,&pe入口));
h打开进程 = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dw打开进程);//|PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE
CloseHandle(h快照);
return h打开进程;//返回
}
//========================================================
typedef DWORD (__stdcall* ♂ΔPrint)(LPCTSTR,...);//__stdcall
typedef DWORD (__stdcall* ♂cΔFUNC)(LPCTSTR);
typedef DWORD (__stdcall* ♂iΔFUNC)(DWORD);
typedef DWORD (__stdcall* ♂ΔFUNC)();
//线程参数结构体定义
typedef struct sd参数
{
char c[100]; //MessageBox函数中显示的字符提示
♂ΔFUNC ΨΔ;
♂cΔFUNC ΨcΔ;
LPVOID ΨFunc;//MessageBox函数的入口地址
DWORD iFunc;//MessageBox函数的入口地址
DWORD i;
}卍参数;
//定义MessageBox类型的函数指针
//EXC DWORD __stdcall FuncTest2(卍参数 *&参数)//LPVOID LPVOID
void __stdcall FuncTest2(LPVOID 参数)
{
//参数->ΨΔ();//参数->c
/**/
卍参数* Ψ参数 = (卍参数*)参数;
//Ψ参数->ΨΔ();//ΧΧ出错return ;
//Ψ参数->ΨcΔ(Ψ参数->c);
♂cΔFUNC ΨΔfunc = (♂cΔFUNC)Ψ参数->ΨFunc;ΨΔfunc(Ψ参数->c);
//ΨΔfunc = (♂cΔFUNC)Ψ参数->iFunc;ΨΔfunc(Ψ参数->c);
//Ψ参数->ΨcΔ(Ψ参数->c);
//♂iΔFUNC ΨΔfunc = (♂iΔFUNC)Ψ参数->ΨFunc;//ΨΔfunc(Ψ参数->i);
//printf(Ψ参数->c);
return ;
}
void __stdcall FuncTest1(LPVOID 参数)
{
卍参数* Ψ参数 = (卍参数*)参数;
♂ΔFUNC ΨΔfunc = (♂ΔFUNC)Ψ参数->ΨFunc;ΨΔfunc();
}
void __stdcall FuncTest()
//EXC DWORD __stdcall FuncTest(LPVOID 参数)
{
//PRINT1(~~,FuncTest,d);
return ;
}
EXC void __stdcall MyPrint(char*ch)
{
printf("▼ ch= %s\n",ch);
}
//------------------------------
inline void c_c(const char*c,char *c2__)
{
DWORD i长=strlen(c);uint i=0;
for( i=0;i<i长;i++)
{
c2__[i]=c[i];
}
c2__[i]='\0';
}
//========================================
bool bΔvista之后()
{
OSVERSIONINFO osvi;
ZeroMemory(&osvi, sizeof(OSVERSIONINFO));
osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
GetVersionEx(&osvi);
if( osvi.dwMajorVersion >= 6 )
return TRUE;
return FALSE;
}
//提升程序权限
BOOL bΔEnableDebugPrivilege()
{
HANDLE hToken;
BOOL fOk=false;
if(OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))
{
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount=1;
if(!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid)) ;
tp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
if(!AdjustTokenPrivileges(hToken,false,&tp,sizeof(tp),NULL,NULL)) ;
else
fOk = true;
CloseHandle(hToken);
}
return fOk;
}
//====提升进程访问权限====================================
bool bΔ访问权限()
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
{
return false;
}
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))
{
CloseHandle(hToken);
return false;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
{
CloseHandle(hToken);
return false;
}
CloseHandle(hToken);
return true;
}
//========================================================
HANDLE hΔMyCreateRemoteThread1(HANDLE h打开进程, LPTHREAD_START_ROUTINE ΨΔ函数, LPVOID Ψ参数)
{
HANDLE hRemoteThread = NULL;
PRINT1(,bΔvista之后(),d);
FARPROC ΨΔNtCreateThreadEx = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtCreateThreadEx");
//if(ΨΔNtCreateThreadEx==NULL){PRINT2(★,ΨΔNtCreateThreadEx,GetLastError(),d,d);return NULL;}
((♂Δ函数指针nt64)ΨΔNtCreateThreadEx)(&hRemoteThread,0x1FFFFF,NULL,h打开进程,ΨΔ函数,Ψ参数,FALSE,NULL,NULL,NULL,NULL);
if(WAIT_FAILED==WaitForSingleObject(hRemoteThread,INFINITE)){return NULL;}
return hRemoteThread;
}
HANDLE hΔMyCreateRemoteThread(HANDLE&h打开进程, LPTHREAD_START_ROUTINE ΨΔ函数, LPVOID Ψ参数)
{
HANDLE hRemoteThread = NULL;
//---- Vista, 7, Server2008--------------------------
if(bΔvista之后())
{
//typedef DWORD (FAR WINAPI *FARPROC)()
FARPROC ΨΔNtCreateThreadEx = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtCreateThreadEx");
//if(ΨΔNtCreateThreadEx==NULL){PRINT2(★,ΨΔNtCreateThreadEx,GetLastError(),d,d);return NULL;}
((♂Δ函数指针nt64)ΨΔNtCreateThreadEx)(&hRemoteThread,0x1FFFFF,NULL,h打开进程,ΨΔ函数,Ψ参数,FALSE,NULL,NULL,NULL,NULL);
//if(hRemoteThread==NULL){PRINT2(★,hRemoteThread,GetLastError(),d,d);return NULL;}
PRINT1(√√,hRemoteThread,d);
}
//----2000, XP, Server2003--------------------------
else
{
hRemoteThread=CreateRemoteThread(h打开进程,NULL,0,ΨΔ函数,Ψ参数,0,NULL);
if( hRemoteThread == NULL )
{PRINT2(★2·,hRemoteThread,GetLastError(),d,d);
return NULL;
}
}
if(WAIT_FAILED==WaitForSingleObject(hRemoteThread,INFINITE)){return NULL;}//●●这个很重要,如果没有可能会崩溃
return hRemoteThread;
}
////////////////////////////////////////////
template<typename T>
LPVOID ΨΔ写地址到进程(HANDLE h打开进程,T*Ψ参数,DWORD iSize,BOOL b是函数=true)//●必须是指针引用,void*&Ψ参数__
{
SIZE_T dwHasWrite;LPVOID Ψ参数__ =NULL;
/**/
if(b是函数)
{Ψ参数__ = VirtualAllocEx(h打开进程,0,iSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);}
else
{Ψ参数__ = VirtualAllocEx(h打开进程,0,iSize,MEM_COMMIT,PAGE_READWRITE);}
//----将线程参数拷贝到宿主进程地址空间中--------------------------
if(WriteProcessMemory(h打开进程,Ψ参数__,Ψ参数,iSize,&dwHasWrite)) //把dll路径写入主进程
{//PRINT2(,dwHasWrite,iSize,d,d);
if(dwHasWrite != iSize)
{
VirtualFreeEx(h打开进程,Ψ参数__,iSize,MEM_COMMIT); //即为目标进程的句柄，可在其它进程中释放申请的虚拟内存空间。MEM_RELEASE
CloseHandle(h打开进程);
PRINT1(★!!!VirtualFreeEx失败:,GetLastError(),d);
return Ψ参数__;
}
}
else
{
PRINT1(★!!!写入远程进程内存空间出错:,GetLastError(),d);
CloseHandle(h打开进程);
return Ψ参数__;
}
return Ψ参数__;
}
////////////////////////////////////////////
DWORD WINAPI ΔMyThreadProc1( LPVOID pParam )
{
MessageBox( NULL, "DLL已进入线程1。", "信息", MB_ICONINFORMATION );
return 0;
}
DWORD WINAPI ΔMyThreadProc2( LPVOID pParam )
{
MessageBox( NULL, "DLL已进入线程2。", "信息", MB_ICONINFORMATION );
return 0;
}
//========================================================
bool APIENTRY DllMain( HANDLE hModule,DWORD ul_reason_for_call,LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
//MessageBox( NULL, "√√DLL已进入目标进程。", "信息", MB_ICONINFORMATION );
PRINT0(▼▼ DLL已进入目标进程。);//SetData(28);
DWORD dwThreadId;
//HANDLE myThread1 = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ΔMyThreadProc1, NULL, 0, &dwThreadId);
//HANDLE myThread2 = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ΔMyThreadProc2, NULL, 0, &dwThreadId);
//PRINT1(,iG,d);//Χ
break;
}
case DLL_PROCESS_DETACH:
{
PRINT0(▼▼ ~~DLL已从目标进程卸载。);
//MessageBox( NULL, "√√DLL已从目标进程卸载。", "信息", MB_ICONINFORMATION );
break;
}
}
return TRUE;
}
#endif
-----------------------------------------------------------------------------------
main.cpp
//#include<E:/blender/blenderLib/CLIB.cpp>
#include "MyDll.h"
void __stdcall myprint2()
{
//putchar('M');//Χ
int i=9+7;
return ;
}
////////////////////////////////////////////
int main()
{
//bΔEnableDebugPrivilege() ;
bΔ访问权限();const DWORD dwThreadSize = 4096;
SIZE_T dwHasWrite;DWORD dwWriteBytes;
const char *c参数= "B:/MyDll64在.dll";
//const char c参数= 'B';
HANDLE h打开进程 = hΔ打开进程("main_w64.exe");//●最好用英文不容易出错.
if(h打开进程 == NULL)
{
PRINT1(★ 打开进程 失败!:,GetLastError(),d);
return -1;
}
else
{
PRINT1(▼ 找到·,h打开进程,d);
}
LPVOID ΨΔ函数= NULL;
卍参数 参数;//DWORD 代表 unsigned long
ZeroMemory(&参数, sizeof(卍参数));//PRINT2(,sizeof(卍参数),sizeof(参数),d,d);//√
int iSize = strlen(c参数)+1;strcat(参数.c, "Hello_IMDJS \0");//c_c(c参数,参数.c);
//----FuncTest1--------------------------
ΨΔ函数=VirtualAllocEx(h打开进程,0,dwThreadSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);if(!ΨΔ函数){PRINT1(★新建ΨΔ函数失败!,h打开进程,d);return 0;} if(!WriteProcessMemory(h打开进程,ΨΔ函数,&FuncTest1,dwThreadSize,0)){PRINT1(★写Δ函数失败!,h打开进程,d);return 0;}
参数.ΨFunc=GetProcAddress(GetModuleHandle("msvcrt.dll"),"printf");
PRINT1(,参数.ΨFunc,d);
LPVOID Ψ参数 =ΨΔ写地址到进程(h打开进程,&参数,sizeof(卍参数),true);
//====NtCreateThreadEx====================================
HANDLE hRemoteThread=NULL;
hRemoteThread=CreateRemoteThread(h打开进程,NULL,0, (LPTHREAD_START_ROUTINE) ΨΔ函数,Ψ参数,0,&dwWriteBytes);
PRINT1(,hRemoteThread,d);
//------------------------------------------------------------
//VirtualFreeEx(h打开进程, Ψ参数, 0, MEM_RELEASE);
CloseHandle(h打开进程);
//if(WAIT_FAILED==WaitForSingleObject(hRemoteThread,INFINITE)){return NULL;}
//system("pause");
return 1;
}
main_w.cpp(宿主)
#include<CLIB_H\CLIB2_global.h>//包含CLIB0_print.h
void FuncPuls()
{
DWORD c=5;
PRINT1(a+b=, c,d);//PRINT1(main·, iG,d);
}
//------------------------------
void main()
{
//char* ch="MYPRINT";putchar('M');
FuncPuls();
system("pause");
}