读书人

VS2010 线程流入 CreateRemoteThread(

发布时间: 2012-09-14 11:53:44 作者: rapoo

VS2010 线程注入 CreateRemoteThread(),出错,返回5
我已经使用管理员身份运行,之前运行正确,只是一到CreateRemoteThread就出错
代码如下

C/C++ code
#include<iostream>#include"windows.h"#include"tlhelp32.h"using namespace std; BOOL Prompt(){    HANDLE hToken;    if(!OpenProcessToken(::GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))    {        cout<<"OpenProcessToken  error  the code is :"<<GetLastError()<<endl;        return FALSE;    }    TOKEN_PRIVILEGES tkp;    tkp.PrivilegeCount =1;    if(!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tkp.Privileges [0].Luid ))    {        cout<<"LookPrivilegeValue  error the code is :"<<GetLastError()<<endl;        return FALSE;    }    if(!AdjustTokenPrivileges(hToken,false,&tkp,sizeof(tkp),NULL,0))    {        cout<<"AdjustPrivileges  error the code is:"<<GetLastError()<<endl;        return FALSE;    }    return true;}int main(){    //获得系统当前运行的程序,获得目标程序ID    DWORD ProcessId=0;    HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);    if(hSnap==NULL)    {        cout<<"CreateToolhelp32Snapshot  error the code is :"<<GetLastError()<<endl;        return 0;    }    BOOL mark=false;    PROCESSENTRY32 pro_info;    pro_info.dwSize =sizeof(pro_info);    mark=Process32First(hSnap,&pro_info);    while(mark)    {        if(pro_info.szExeFile [0]=='c'&&pro_info.szExeFile [1]=='a'&&pro_info.szExeFile [2]=='l'&&pro_info.szExeFile [3]=='c')        {            MessageBoxA(NULL,"find it!","warning ",0);            ProcessId=pro_info.th32ProcessID ;            break;        }        mark=Process32Next(hSnap,&pro_info);    }    if(Prompt())    {        cout<<"提升权限成功。。。"<<endl;    }    else        return 0;    if(ProcessId==0)    {        MessageBoxA(NULL,"没有找到计算器进程",NULL,0);        return -1;    }    //打开目标程序    HANDLE hPro;    hPro=OpenProcess(PROCESS_ALL_ACCESS,FALSE,ProcessId);    if(hPro==NULL)    {        int num=GetLastError();        char warn[100];        sprintf(warn,"%s,%d","OpenProcess",num);        MessageBoxA(NULL,warn,"warning ",0);        return -1;    }        PVOID addr;    addr=VirtualAllocEx(hPro,NULL,1024*4,MEM_COMMIT,PAGE_EXECUTE_READWRITE);    if(addr==NULL)    {        int num=GetLastError();        char warn[100];        sprintf(warn,"%s,%d","VirtualAlloc 出错",num);        MessageBoxA(NULL,warn,"warning ",0);        return -1;    }//    获得函数地址    PVOID Func_addr;    Func_addr=GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");    if(Func_addr==NULL)    {        int num=GetLastError();        char warn[100];        sprintf(warn,"%s,%d","GetProcAddress出错",num);        MessageBoxA(NULL,warn,"warning ",0);        return -1;    }    char DllName[]="en.dll";    if(!WriteProcessMemory(hPro,addr,DllName,strlen(DllName),0))    {        int num=GetLastError();        char warn[100];        sprintf(warn,"%s,%d","WriteProcessMemory出错",num);        MessageBoxA(NULL,warn,"warning ",0);        return -1;    }    //创建远程线程    DWORD ID;    HANDLE hThr;    hThr=CreateRemoteThread(hPro,NULL,0,(PTHREAD_START_ROUTINE)Func_addr,addr,0,&ID);    if(hThr==NULL)    {        int num=GetLastError();        char warn[100];        sprintf(warn,"%s,%d","远程进程创建失败",num);        MessageBoxA(NULL,warn,"warning ",0);        return 0;    }    else    {        MessageBoxA(NULL,"远程进程创建成功!","warning ",0);        int a;        cin>>a;    }}


------解决方案--------------------


char DllName[]="en.dll";的路径改成绝对路径实时啊。
[解决办法]

探讨
char DllName[]="en.dll";的路径改成绝对路径实时啊。

[解决办法]
errlookup: 5 拒绝访问

电脑上有没有装杀毒软件或者HIPS
[解决办法]
恭喜

读书人网 >C语言

热点推荐