private void Immit(string url, int Id)
{
IntPtr NewAdd = new IntPtr();
int leng = url.Length + 1;
IntPtr proceHandle = new IntPtr();
try
{
proceHandle = ApiFunction.OpenProcess(0x1F0FFF, false, Id);//进程句柄
//从目标分配空间
NewAdd = ApiFunction.VirtualAllocEx(proceHandle, (IntPtr)null, leng, MEMMessage.MEM_COMMIT, PAGEinfo.PAGE_READWRITE);
if (NewAdd == (IntPtr)0)
{
throw new Exception("分配空间失败");
}
//复制DLL到指定空间
bool isok = ApiFunction.WriteProcessMemory(proceHandle, NewAdd, url, leng, 0);
if (!isok)
{
throw new Exception("复制DLL到指定空间失败");
}
//得到LoadLibraryA函数地址
IntPtr add = ApiFunction.GetProcAddress(ApiFunction.GetModuleHandle("kernel32.dll"), "LoadLibraryA");
if (add == (IntPtr)0)
{
throw new Exception("取LoadLibraryA函数地址失败");
}
//创建远程线程
IntPtr result = ApiFunction.CreateRemoteThread(proceHandle, 0, 0, add,NewAdd, 0, null);
if (result == (IntPtr)0)
{
throw new Exception("创建远程线程失败");
}
ApiFunction.WaitForSingleObject(result, 0xFFFFFFFF);
//关键在这，上面已经把DLL注入到目标进程了。
Assembly assembly = Assembly.LoadFile(url);
IntPtr MethodAdd = new IntPtr();
Type[] tp = assembly.GetTypes();
for (int i = 0; i < tp.Length; i++)
{
MethodInfo[] mf = tp[i].GetMethods();
for (int j = 0; j < mf.Length; j++)
{
string n = mf[j].Name;
if (n == "tt")//这里我DLL里面有个tt方法
{
RuntimeMethodHandle rmh = mf[i].MethodHandle;
MethodAdd = rmh.Value;//得到方法句柄
//在目标进程运行方法
result = ApiFunction.CreateRemoteThread(proceHandle, 0, 0, MethodAdd ,(IntPtr)0, 0, null);
break;
}
}
}
}
catch (Exception ex)
{
MessageBox.Show(ex.Message, "提示");
}
finally
{
ApiFunction.VirtualFreeEx(proceHandle, NewAdd, leng, MEMMessage.MEM_DECOMMIT);
ApiFunction.CloseHandle(proceHandle);
}
}
运行之后，目标进程提示错误，程序崩溃。
