C# DLL如何注入explorer.exe??
现需要做把一个DLL注入到系统explorer.exe进程里面,以实现进程间的通讯,请问如何用C#代码实现注入呢?网上很难找到注入的代码
各位有没有实现的代码?不知道用C#能不能实现?
谢谢!
[解决办法]
这个,你还是用C#写shell扩展比较合适.至于注入,C#有困难
[解决办法]
api
LoadLibrary
GetProcAddress
CreateRemoteThread
[解决办法]
看一下下面的文章:
http://blog.csdn.net/hack214/archive/2008/04/11/2283599.aspx
代码如下:
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Diagnostics;
namespace TryFile
{
public partial class DllInjectForm : Form
{
public DllInjectForm()
{
InitializeComponent();
}
[DllImport("kernel32.dll")] //声明API函数
public static extern int VirtualAllocEx(IntPtr hwnd, int lpaddress, int size, int type, int tect);
[DllImport("kernel32.dll")]
public static extern int WriteProcessMemory(IntPtr hwnd, int baseaddress, string buffer, int nsize, int filewriten);
[DllImport("kernel32.dll")]
public static extern int GetProcAddress(int hwnd, string lpname);
[DllImport("kernel32.dll")]
public static extern int GetModuleHandleA(string name);
[DllImport("kernel32.dll")]
public static extern int CreateRemoteThread(IntPtr hwnd, int attrib, int size, int address, int par, int flags, int threadid);
private void button1_Click(object sender, EventArgs e)
{
int ok1;
int baseaddress;
int temp = 0;
int hack;
int yan;
string dllname;
dllname = "c:\\WinShell.dll";
int dlllength;
dlllength = dllname.Length + 1;
Process[] pname = Process.GetProcesses(); //取得所有进程
foreach (Process name in pname) //遍历进程
{
if (name.ProcessName.ToLower().IndexOf("explorer") != -1) //所示记事本，那么下面开始注入
{
baseaddress = VirtualAllocEx(name.Handle, 0, dlllength, 4096, 4); //申请内存空间
if (baseaddress == 0) //返回0则操作失败，下面都是
{
MessageBox.Show("申请内存空间失败！！");
Application.Exit();
}
ok1 = WriteProcessMemory(name.Handle, baseaddress, dllname, dlllength, temp); //写内存
if (ok1 == 0)
{
MessageBox.Show("写内存失败！！");
Application.Exit();
}
hack = GetProcAddress(GetModuleHandleA("Kernel32"), "LoadLibraryA"); //取得loadlibarary在kernek32.dll地址
if (hack == 0)
{
MessageBox.Show("无法取得函数的入口点！！");
Application.Exit();
}
yan = CreateRemoteThread(name.Handle, 0, 0, hack, baseaddress, 0, temp); //创建远程线程。
if (yan == 0)
{
MessageBox.Show("创建远程线程失败！！");
Application.Exit();
}
else
{
MessageBox.Show("已成功注入dll!!");
}
}
}
}
}
}
