原来在写内存挂的时候写的这个小软件,现在给大家共享出来! 本来想实现一个编写汇编代码注入的功能,结果没实现出来。哈哈……转成机器码有点小难度就没深入研究了。
项目源码:MemHelper

// MemHelperDlg.cpp : 实现文件
//
#include "stdafx.h"
#include "MemHelper.h"
#include "MemHelperDlg.h"
#include "AsmCode.h"
#ifdef _DEBUG
#define new DEBUG_NEW
#endif
#pragma hdrstop
// CMemHelperDlg 对话框
CMemHelperDlg::CMemHelperDlg(CWnd* pParent /*=NULL*/)
: CDialogEx(CMemHelperDlg::IDD, pParent)
{
m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);
m_tempHwnd = NULL;
pGT = NULL;
}
void CMemHelperDlg::DoDataExchange(CDataExchange* pDX)
{
CDialogEx::DoDataExchange(pDX);
DDX_Control(pDX, IDC_BTN_FWND, m_fwnd);
}
BEGIN_MESSAGE_MAP(CMemHelperDlg, CDialogEx)
ON_WM_PAINT()
ON_WM_QUERYDRAGICON()
ON_WM_TIMER()
ON_WM_HOTKEY()
ON_WM_CTLCOLOR()
ON_WM_CLOSE()
ON_WM_DESTROY()
ON_WM_LBUTTONDOWN()
ON_BN_CLICKED(IDC_BTN_READ, &CMemHelperDlg::OnBnClickedBtnRead)
ON_BN_CLICKED(IDC_BTN_WRITE, &CMemHelperDlg::OnBnClickedBtnWrite)
ON_EN_SETFOCUS(IDC_EDIT_HWND_VALUE, &CMemHelperDlg::OnEnSetfocusEditHwndValue)
ON_EN_SETFOCUS(IDC_EDIT_READ_VALUE, &CMemHelperDlg::OnEnSetfocusEditReadValue)
ON_EN_SETFOCUS(IDC_EDIT_TITLE, &CMemHelperDlg::OnEnSetfocusEditTitle)
ON_WM_LBUTTONUP()
ON_WM_NCLBUTTONUP()
ON_WM_SYSCOMMAND()
ON_WM_NCLBUTTONDOWN()
ON_WM_NCMOUSEMOVE()
ON_WM_LBUTTONUP()
ON_WM_NCLBUTTONUP()
ON_WM_SYSCOMMAND()
ON_WM_LBUTTONUP()
ON_WM_LBUTTONDOWN()
ON_WM_NCLBUTTONUP()
ON_WM_MOUSEMOVE()
ON_BN_CLICKED(IDC_CHK_READ_HEX, &CMemHelperDlg::OnBnClickedChkReadHex)
ON_BN_CLICKED(IDC_CHK_WRITE_HEX, &CMemHelperDlg::OnBnClickedChkWriteHex)
ON_BN_CLICKED(IDC_BTN_READS, &CMemHelperDlg::OnBnClickedBtnReads)
ON_BN_CLICKED(IDC_BTN_WRITES, &CMemHelperDlg::OnBnClickedBtnWrites)
ON_EN_SETFOCUS(IDC_EDIT_READ_VALUES, &CMemHelperDlg::OnEnSetfocusEditReadValues)
ON_EN_SETFOCUS(IDC_EDIT_PROCESS, &CMemHelperDlg::OnEnSetfocusEditProcess)
ON_BN_CLICKED(IDC_BTN_OTHER, &CMemHelperDlg::OnBnClickedBtnOther)
ON_BN_CLICKED(IDC_BTN_CAPTURE, &CMemHelperDlg::OnBnClickedBtnCapture)
END_MESSAGE_MAP()
// CMemHelperDlg 消息处理程序
BOOL CMemHelperDlg::OnInitDialog()
{
CDialogEx::OnInitDialog();
// 设置此对话框的图标。当应用程序主窗口不是对话框时,框架将自动
// 执行此操作
pGT = new CGameTool;
SetIcon(m_hIcon, TRUE); // 设置大图标
SetIcon(m_hIcon, FALSE); // 设置小图标
pressFbutton = FALSE;
readHex = FALSE;
writeHex = FALSE;
SetDlgItemText(IDC_EDIT_READ_VALUES_SIZE,"32");
// TODO: 在此添加额外的初始化代码
/*LOGFONT lf; //定义字体结构 内存即将被覆盖无须初始
lf.lfWeight=500; //字体磅数=1000粗体
lf.lfHeight=13; //字体高度(旋转后的字体宽度)=56
lf.lfWidth=7; //字体宽度(旋转后的字体高度)=20
lf.lfUnderline=FALSE; //无下划线
lf.lfStrikeOut=FALSE; //无删除线
lf.lfItalic=FALSE; //非斜体
lf.lfEscapement=0; //字体显示角度=0°
lf.lfCharSet=GB2312_CHARSET; //使用缺省字符集
strcpy_s(lf.lfFaceName,sizeof(lf.lfFaceName),"新宋体"); //字体名
m_editFont.CreateFontIndirect(&lf);*/
CRect rt;//资源窗口宽度为171
GetWindowRect(rt);
SetWindowPos(NULL,0,0,305,rt.Height(),SWP_SHOWWINDOW|SWP_NOMOVE);
CenterWindow();
return TRUE; // 除非将焦点设置到控件,否则返回 TRUE
}
// 如果向对话框添加最小化按钮,则需要下面的代码
// 来绘制该图标。对于使用文档/视图模型的 MFC 应用程序,
// 这将由框架自动完成。
void CMemHelperDlg::OnPaint()
{
if (IsIconic())
{
CPaintDC dc(this); // 用于绘制的设备上下文
SendMessage(WM_ICONERASEBKGND, reinterpret_cast(dc.GetSafeHdc()), 0);
// 使图标在工作区矩形中居中
int cxIcon = GetSystemMetrics(SM_CXICON);
int cyIcon = GetSystemMetrics(SM_CYICON);
CRect rect;
GetClientRect(&rect);
int x = (rect.Width() - cxIcon + 1) / 2;
int y = (rect.Height() - cyIcon + 1) / 2;
// 绘制图标
dc.DrawIcon(x, y, m_hIcon);
}
else
{
CDialogEx::OnPaint();
}
}
//当用户拖动最小化窗口时系统调用此函数取得光标
//显示。
HCURSOR CMemHelperDlg::OnQueryDragIcon()
{
return static_cast(m_hIcon);
}
void CMemHelperDlg::ClearFocus(int ID)
{
GetDlgItem(ID)->SetFocus();
GetDlgItem(ID)->HideCaret();
}
void CMemHelperDlg::OnTimer(UINT_PTR nIDEvent)
{
// TODO: 在此添加消息处理程序代码和/或调用默认值
CDialogEx::OnTimer(nIDEvent);
}
void CMemHelperDlg::OnHotKey(UINT nHotKeyId, UINT nKey1, UINT nKey2)
{
// TODO: 在此添加消息处理程序代码和/或调用默认值
CDialogEx::OnHotKey(nHotKeyId, nKey1, nKey2);
}
HBRUSH CMemHelperDlg::OnCtlColor(CDC* pDC, CWnd* pWnd, UINT nCtlColor)
{
HBRUSH hbr = CDialogEx::OnCtlColor(pDC, pWnd, nCtlColor);
// TODO: 在此更改 DC 的任何特性
if (pWnd->GetDlgCtrlID() == IDC_STATIC_AUT)
{
pDC->SetTextColor(RGB(0x0,0x0,0xFF)); //字体颜色
//pDC->SelectObject(&m_editFont);
}
// TODO: 如果默认的不是所需画笔,则返回另一个画笔
return hbr;
}
void CMemHelperDlg::OnClose()
{
// TODO: 在此添加消息处理程序代码和/或调用默认值
CDialogEx::OnClose();
if (pGT != NULL)
{
delete pGT;
pGT = NULL;
}
}
void CMemHelperDlg::OnDestroy()
{
CDialogEx::OnDestroy();
// TODO: 在此处添加消息处理程序代码
}
void CMemHelperDlg::OnBnClickedBtnRead()
{
// TODO: 在此添加控件通知处理程序代码
if (m_tempHwnd)
{
DWORD proID;
GetWindowThreadProcessId(m_tempHwnd,&proID);//获取进程ID
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,proID);
if (hProc)
{
CString temp;
GetDlgItemText(IDC_EDIT_READ_ADD,temp);
DWORD ads_ps = HexToDem(temp);
DWORD d_value = 0x0;
BOOL bAccess = FALSE;
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);//读取动态地址
for(int i=0; i<4; i++)
{
//读取偏移量
GetDlgItemText(IDC_EDIT_READ_OFFSET1+i,temp);
if (temp == "")continue;//没有输入跳过
DWORD offset = HexToDem(temp);
ads_ps = d_value + offset;
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);
}
if (bAccess)
{
CString outValue;
outValue.Format(readHex?"%0X":"%d",d_value);
SetDlgItemText(IDC_EDIT_READ_VALUE,outValue);
}
else
MessageBox("内存读取失败");
CloseHandle(hProc);
}
else
{
MessageBox("进程打开失败");
}
}
else
{
MessageBox("窗口柄柄未初始.");
}
}
void CMemHelperDlg::OnBnClickedBtnWrite()
{
// TODO: 在此添加控件通知处理程序代码
if (m_tempHwnd)
{
DWORD proID;
GetWindowThreadProcessId(m_tempHwnd,&proID);//获取进程ID
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,proID);
if (hProc)
{
CString temp;
GetDlgItemText(IDC_EDIT_READ_ADD,temp);
DWORD ads_ps = HexToDem(temp);
DWORD d_value = 0x0;
BOOL bAccess = FALSE;
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);//读取动态地址
for(int i=0; i<4; i++)
{
//读取偏移量
GetDlgItemText(IDC_EDIT_READ_OFFSET1+i,temp);
if (temp == "")continue;//没有输入跳过
DWORD offset = HexToDem(temp);
ads_ps = d_value + offset;
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);
}
if (bAccess)
{
CString inValue;
GetDlgItemText(IDC_EDIT_WRITE_VALUE,inValue);
if (writeHex)
d_value = HexToDem(inValue);
else
d_value = _ttoi(inValue);
bAccess = WriteProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);
if(!bAccess)
MessageBox("内存写入失败");
}
else
MessageBox("内存读取失败");
CloseHandle(hProc);
}
else
{
MessageBox("进程打开失败");
}
}
else
{
MessageBox("窗口柄柄未初始.");
}
}
void CMemHelperDlg::OnBnClickedBtnReads()
{
// TODO: 在此添加控件通知处理程序代码
if (m_tempHwnd)
{
DWORD proID;
GetWindowThreadProcessId(m_tempHwnd,&proID);//获取进程ID
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,proID);
if (hProc)
{
CString temp;
GetDlgItemText(IDC_EDIT_READ_ADD,temp);
DWORD ads_ps = HexToDem(temp);
DWORD d_value = 0x0;
BOOL bAccess = FALSE;
BOOL hasOffset = FALSE;
//读取偏移量
GetDlgItemText(IDC_EDIT_READ_OFFSET1,temp);
if(temp != "")
hasOffset = TRUE;//有偏移量
if (hasOffset)
{
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);//读取动态地址
for(int i=0; i<4; i++)
{
GetDlgItemText(IDC_EDIT_READ_OFFSET1+i,temp);
if(temp == "")
{
//结束偏移量准备读取字符串
GetDlgItemText(IDC_EDIT_READ_VALUES_SIZE,temp);
int size = _ttoi(temp);
char *pBuf = new char[size];
bAccess = ReadProcessMemory(hProc,(void*)d_value,pBuf,size,NULL);
if (bAccess)
{
temp.Format("%s",pBuf);
SetDlgItemText(IDC_EDIT_READ_VALUES,temp);
}
else
{
MessageBox("内存读取失败");
}
delete pBuf;
}
else
{
//继续读取偏移量
DWORD offset = HexToDem(temp);
ads_ps = d_value + offset;
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);
}
}
}
else
{
//直接读取字符串
//结束偏移量准备读取字符串
CString temp;
GetDlgItemText(IDC_EDIT_READ_VALUES_SIZE,temp);
int size = _ttoi(temp);
char *pBuf = new char[size];
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,pBuf,size,NULL);
if (bAccess)
{
temp.Format("%s",pBuf);
SetDlgItemText(IDC_EDIT_READ_VALUES,temp);
}
else
{
MessageBox("内存读取失败");
}
delete pBuf;
}
CloseHandle(hProc);
}
else
{
MessageBox("进程打开失败");
}
}
else
{
MessageBox("窗口柄柄未初始.");
}
}
void CMemHelperDlg::OnBnClickedBtnWrites()
{
// TODO: 在此添加控件通知处理程序代码
if (m_tempHwnd)
{
DWORD proID;
GetWindowThreadProcessId(m_tempHwnd,&proID);//获取进程ID
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,proID);
if (hProc)
{
CString temp;
GetDlgItemText(IDC_EDIT_READ_ADD,temp);
DWORD ads_ps = HexToDem(temp);
DWORD d_value = 0x0;
BOOL bAccess = FALSE;
BOOL hasOffset = FALSE;
//读取偏移量
GetDlgItemText(IDC_EDIT_READ_OFFSET1,temp);
if(temp != "")
hasOffset = TRUE;//有偏移量
if (hasOffset)
{
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);//读取动态地址
for(int i=0; i<4; i++)
{
GetDlgItemText(IDC_EDIT_READ_OFFSET1+i,temp);
if(temp == "")
{
//结束偏移量准备读取字符串
GetDlgItemText(IDC_EDIT_WRITE_VALUES,temp);
char *pBuf = temp.GetBuffer();
temp.ReleaseBuffer();
bAccess = WriteProcessMemory(hProc,(void*)d_value,pBuf,strlen(pBuf),NULL);
if (!bAccess)
MessageBox("内存写入失败");
}
else
{
//继续读取偏移量
DWORD offset = HexToDem(temp);
ads_ps = d_value + offset;
bAccess = ReadProcessMemory(hProc,(void*)ads_ps,&d_value,4,NULL);
}
}
}
else
{
//直接读取字符串
//结束偏移量准备读取字符串
CString temp;
GetDlgItemText(IDC_EDIT_WRITE_VALUES,temp);
char *pBuf = temp.GetBuffer();
temp.ReleaseBuffer();
bAccess = WriteProcessMemory(hProc,(void*)ads_ps,pBuf,strlen(pBuf),NULL);
if (!bAccess)
MessageBox("内存写入失败");
}
CloseHandle(hProc);
}
else
{
MessageBox("进程打开失败");
}
}
else
{
MessageBox("窗口柄柄未初始.");
}
}
void CMemHelperDlg::OnEnSetfocusEditHwndValue()
{
// TODO: 在此添加控件通知处理程序代码
ClearFocus(IDC_EDIT_HWND_VALUE);
}
void CMemHelperDlg::OnEnSetfocusEditReadValue()
{
// TODO: 在此添加控件通知处理程序代码
ClearFocus(IDC_EDIT_READ_VALUE);
}
void CMemHelperDlg::OnEnSetfocusEditReadValues()
{
// TODO: 在此添加控件通知处理程序代码
ClearFocus(IDC_EDIT_READ_VALUES);
}
void CMemHelperDlg::OnEnSetfocusEditProcess()
{
// TODO: 在此添加控件通知处理程序代码
ClearFocus(IDC_EDIT_PROCESS);
}
void CMemHelperDlg::OnEnSetfocusEditTitle()
{
// TODO: 在此添加控件通知处理程序代码
ClearFocus(IDC_EDIT_TITLE);
}
CString CMemHelperDlg::DecToHex(DWORD d_value)
{
CString strHec;
strHec.Format("%0X",d_value);
return strHec;
}
int CMemHelperDlg::HexToDem(LPCSTR hexStr)
{
int dem = 0;
int length = strlen(hexStr);
for (int i = 0; i < length; i++)
{
dem = dem * 16;
if ((hexStr[i] <= '9') && (hexStr[i] >= '0')) // 0~9之间的字符
dem += hexStr[i] - '0';
else if ((hexStr[i] <= 'F') && (hexStr[i] >= 'A')) // A~F之间的字符
dem += hexStr[i] - 'A' + 10;
else if ((hexStr[i] <= 'f') && (hexStr[i] >= 'a')) // a~f之间的字符
dem += hexStr[i] - 'a' + 10;
else
return -1; // 出错时返回-1
}
return dem;
}
DWORD CMemHelperDlg::RemoteCall(HWND hwnd,LPVOID mFunc, LPVOID Param, DWORD ParamSize)
{
if(hwnd == NULL)
{
AfxMessageBox("请先初始窗口句柄!");
return 0;
}
HANDLE hProcess;//远程句柄
LPVOID mFuncAddr;//申请函数内存地址
LPVOID ParamAddr;//申请参数内存地址
HANDLE hThread; //线程句柄
DWORD NumberOfByte; //辅助返回值
DWORD d_size = 10240;
BOOL HasParam = (ParamSize > 0 && Param != NULL);
//打开被注入的进程句柄
DWORD processId;
::GetWindowThreadProcessId(hwnd,&processId);
hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,processId);
if(NULL == hProcess || INVALID_HANDLE_VALUE == hProcess)
{
AfxMessageBox("进程打开失败");
return 0;
}
//申请内存 MEM_COMMIT物理内存MEM_RESERVE虚拟内存
mFuncAddr = VirtualAllocEx(hProcess,NULL,d_size,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if(NULL == mFuncAddr)
{
AfxMessageBox("代码内存申请失败");
return 0;
}
if(HasParam)
{
ParamAddr = VirtualAllocEx(hProcess,NULL,ParamSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if(NULL == ParamAddr)
{
AfxMessageBox("参数内存申请失败");
if(mFuncAddr)
VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE);
VirtualFreeEx(hProcess,ParamAddr,ParamSize,MEM_RELEASE);
return 0;
}
}
//写内存
if(!WriteProcessMemory(hProcess,mFuncAddr,mFunc,d_size, &NumberOfByte))
{
VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE);
return 0;
}
if(HasParam && !WriteProcessMemory(hProcess,ParamAddr,Param,ParamSize, &NumberOfByte))
{
VirtualFreeEx(hProcess,ParamAddr,ParamSize,MEM_RELEASE);
return 0;
}
//创建远程线程
hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)(mFuncAddr), ParamAddr, 0, &NumberOfByte);
WaitForSingleObject(hThread, INFINITE);//等待1s线程结束
//释放申请有内存
VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE);
if(HasParam)
VirtualFreeEx(hProcess,ParamAddr,ParamSize,MEM_RELEASE);
//释放远程句柄
CloseHandle(hThread);
CloseHandle(hProcess);
return NumberOfByte;
}
void CMemHelperDlg::SetFButton(BOOL b)
{
this->pressFbutton = b;
if(pressFbutton)
m_fwnd.SetIcon(::LoadIconA(AfxGetInstanceHandle(),MAKEINTRESOURCE(IDI_ICON2)));
else
m_fwnd.SetIcon(::LoadIconA(AfxGetInstanceHandle(),MAKEINTRESOURCE(IDI_ICON1)));
}
void CMemHelperDlg::OnLButtonUp(UINT nFlags, CPoint point)
{
// TODO: 在此添加消息处理程序代码和/或调用默认值
CDialogEx::OnLButtonUp(nFlags, point);
if(pressFbutton)
{
FindWindowInfo(point);
::ReleaseCapture();
SetFButton(FALSE);
}
}
void CMemHelperDlg::OnLButtonDown(UINT nFlags, CPoint point)
{
// TODO: 在此添加消息处理程序代码和/或调用默认值
CDialogEx::OnLButtonDown(nFlags, point);
::ClientToScreen(m_hWnd,&point);
CPoint *p = &point;
CRect r;
m_fwnd.GetWindowRect(&r);
if (p->x>=r.left&&p->x<=r.right&&p->y>=r.top&&p->y<=r.bottom) { ::SetCapture(m_hWnd); SetFButton(TRUE); //将鼠标光标改为靶子 HINSTANCE ins = AfxGetInstanceHandle(); HCURSOR cursor = LoadCursorA(ins,MAKEINTRESOURCE(IDC_CURSOR_CROSS)); SetCursor(cursor); } } void CMemHelperDlg::OnMouseMove(UINT nFlags, CPoint point) { // TODO: 在此添加消息处理程序代码和/或调用默认值 CDialogEx::OnMouseMove(nFlags, point); if (pressFbutton) FindWindowInfo(point); } void CMemHelperDlg::FindWindowInfo(CPoint &point) { ::ClientToScreen(m_hWnd,&point); m_tempHwnd = ::WindowFromPoint(point); if (m_tempHwnd) { char title[256]; ::GetWindowText(m_tempHwnd,title,sizeof(title)); SetDlgItemText(IDC_EDIT_TITLE,(LPCTSTR)title); CString hexStr; hexStr.Format("%08X",m_tempHwnd); SetDlgItemText(IDC_EDIT_HWND_VALUE,hexStr); DWORD dwProcessID; GetWindowThreadProcessId(m_tempHwnd,&dwProcessID); hexStr; hexStr.Format("%08X",dwProcessID); SetDlgItemText(IDC_EDIT_PROCESS,hexStr); pGT->setGameHwnd(m_tempHwnd);
}
}
void CMemHelperDlg::OnBnClickedChkReadHex()
{
// TODO: 在此添加控件通知处理程序代码
if (IsDlgButtonChecked(IDC_CHK_READ_HEX) == BST_CHECKED)
{
readHex = TRUE;
CString text;
GetDlgItemText(IDC_EDIT_READ_VALUE,text);
DWORD d_value = _ttoi(text);
SetDlgItemText(IDC_EDIT_READ_VALUE,DecToHex(d_value));
}
else
{
readHex = FALSE;
CString text;
GetDlgItemText(IDC_EDIT_READ_VALUE,text);
DWORD d_value = HexToDem(text);
text.Format("%d",d_value);
SetDlgItemText(IDC_EDIT_READ_VALUE,text);
}
}
void CMemHelperDlg::OnBnClickedChkWriteHex()
{
// TODO: 在此添加控件通知处理程序代码
if (IsDlgButtonChecked(IDC_CHK_WRITE_HEX) == BST_CHECKED)
writeHex = TRUE;
else
writeHex = FALSE;
}
void CMemHelperDlg::OnBnClickedBtnOther()
{
// TODO: 在此添加控件通知处理程序代码
CRect rt;//资源窗口宽度为171
GetWindowRect(rt);
int width = rt.Width();
if(width == 305)
{
SetWindowPos(NULL,0,0,rt.Width()+200,rt.Height(),SWP_SHOWWINDOW|SWP_NOMOVE);
SetDlgItemText(IDC_BTN_OTHER,"<"); } else { SetWindowPos(NULL,0,0,rt.Width()-200,rt.Height(),SWP_SHOWWINDOW|SWP_NOMOVE); SetDlgItemText(IDC_BTN_OTHER,">");
}
}
void CMemHelperDlg::OnBnClickedBtnCapture()
{
// TODO: 在此添加控件通知处理程序代码
if(pGT->getGameHwnd() == NULL)
{
MessageBox("窗口句柄未开始");
return;
}
pGT->captureScreen();
}
项目源码:MemHelper
收藏的用户(0) X
正在加载信息~
推荐阅读
最新回复 (2)
-
后续把汇编代码注入实现了,补充到这里来!void CMemHelperDlg::OnBnClickedBtnTest() { // TODO: 在此添加控件通知处理程序代码 CEdit* pEdit = (CEdit*)GetDlgItem(IDC_EDIT_ASM); int nCount = pEdit->GetLineCount(); BYTE buf[2018] = {0};//要写入的shell代码 int bufIndex = 0; for (int i=0;i<nCount;i++) { t_asmmodel t_asm; char szError[512] = {0}; char szLine[256] = {0}; pEdit->GetLine(i,szLine,sizeof(szLine)); Assemble(szLine,0x400000,&t_asm,0,0,szError); if (t_asm.length <= 0) { MessageBox(szError); return; } //char tmp[256] = {0}; //int tempIndex = 0; //for (int j=0;j<t_asm.length;j++) // tempIndex += sprintf_s(tmp+tempIndex,256-tempIndex,"%0X",t_asm.code[j]&0xFF); //println("%s",tmp); memcpy(buf+bufIndex,t_asm.code,t_asm.length); bufIndex += t_asm.length; } buf[bufIndex++] = 0xC3;//retn 不加目标程序自动退出 RemoteCall(m_tempHwnd,bufIndex,buf); } DWORD CMemHelperDlg::RemoteCall(HWND hwnd,LPVOID mFunc) { if(hwnd == NULL) { AfxMessageBox("请先初始窗口句柄!"); return 0; } EnableDebugPriv(); HANDLE hProcess;//远程句柄 LPVOID mFuncAddr;//申请函数内存地址 HANDLE hThread; //线程句柄 DWORD NumberOfByte; //辅助返回值 DWORD d_size = 2048; //打开被注入的进程句柄 DWORD processId; ::GetWindowThreadProcessId(hwnd,&processId); hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,processId); if(NULL == hProcess || INVALID_HANDLE_VALUE == hProcess) { AfxMessageBox("进程打开失败"); return 0; } //申请内存 MEM_COMMIT物理内存MEM_RESERVE虚拟内存 mFuncAddr = VirtualAllocEx(hProcess,NULL,d_size,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE); if(NULL == mFuncAddr) { AfxMessageBox("代码内存申请失败"); return 0; } //写内存 if(!WriteProcessMemory(hProcess,mFuncAddr,mFunc,d_size, &NumberOfByte)) { VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE); return 0; } //创建远程线程 hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)(mFuncAddr), NULL, 0, &NumberOfByte); WaitForSingleObject(hThread, INFINITE);//等待1s线程结束 //释放申请有内存 VirtualFreeEx(hProcess,mFuncAddr,d_size,MEM_RELEASE); //释放远程句柄 CloseHandle(hThread); CloseHandle(hProcess); return NumberOfByte; } -
站点信息
- 文章2313
- 用户1336
- 访客11759810
每日一句
Pride in your steps to dreams.
为追梦的每一步而自豪。
为追梦的每一步而自豪。
新会员