|
|
Posted on 2008-08-14 19:05 Jerson Ju 阅读(80) 评论(0) 编辑 收藏 网摘 所属分类: c/c++
/****************************************************************
*功能描叙：QQ2007II显示物理IP辅助程序之Loader，负责注入MyDll.dll
主程序
*作者：朱剑
*创建日期：2007年12月23号
*说明：此程序只能用于QQ原理研究，不得用于商业用途,否则后果自负。
* 本程序是基于黑盒原理分析，符合计算机法规定。并且是基于插件式
* 的方式编写的，没有修改QQ原程序.
*语言：采用C语言+嵌入汇编的方式
*****************************************************************/
#include "stdafx.h"
#include <Tlhelp32.h>
#include<string>
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
STARTUPINFO sinfo;
PROCESS_INFORMATION processInfo;
GetStartupInfo(&sinfo);
bool b = CreateProcess("../qq.exe",lpCmdLine,NULL,NULL,false,CREATE_SUSPENDED,NULL,NULL,&sinfo,&processInfo);
const DWORD THREADSIZE=1024*4;
HANDLE pRemoteThread,hRemoteProcess;
PTHREAD_START_ROUTINE pfnAddr;
DWORD pId;
void *pFileRemote;
PROCESSENTRY32 processEntry={0};
HANDLE hProcessSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(hProcessSnap==INVALID_HANDLE_VALUE)
return 0;
processEntry.dwSize=sizeof(PROCESSENTRY32);
BOOL bRet=Process32First(hProcessSnap,&processEntry);
DWORD qqprocessId = 0 ;
while(bRet)
{
if(lstrcmpiA(processEntry.szExeFile,"QQ.EXE")== 0)
{
qqprocessId = processEntry.th32ProcessID;
}
bRet=Process32Next(hProcessSnap,&processEntry);
}
CloseHandle(hProcessSnap);
if(!qqprocessId)
{
MessageBox(NULL,"不能找QQ!","提示",MB_OK);
return 0;
}
else
{
hRemoteProcess=::OpenProcess(PROCESS_ALL_ACCESS,false,qqprocessId);
pFileRemote=::VirtualAllocEx(hRemoteProcess,0,THREADSIZE, MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
char szFilePath[MAX_PATH + 1];
GetModuleFileName(NULL,szFilePath,MAX_PATH);
char * flatAddr=strrchr(szFilePath,'\\');
char strFile[255]={0};
memcpy(strFile,szFilePath,flatAddr - szFilePath);
strcat(strFile,"\\myDll.dll");
char *pchar;
pchar=strFile;
if(!::WriteProcessMemory(hRemoteProcess,pFileRemote,pchar,THREADSIZE,NULL))
{
MessageBox(NULL,"写内存失败","提示",MB_OK);
return 0;
}
pfnAddr=(PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");
pRemoteThread=::CreateRemoteThread(hRemoteProcess,NULL,0,pfnAddr,pFileRemote,0,NULL);
ResumeThread(processInfo.hThread);
}
return 0;
}
|