Hier der Code:

int main()
{
HANDLE hThread;
DWORD procId;

void* pLibRemote;
char DLL[]="aHook.dll";

HWND hWnd=FindWindow(NULL,"Unbenannt - Editor");

GetWindowThreadProcessId(hWnd,&procId);

HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,procId);

pLibRemote= VirtualAllocEx(hProcess,NULL,sizeof(DLL),MEM_COMMIT,PAGE_READWRITE);

WriteProcessMemory(hProcess,pLibRemote,(void*)DLL,sizeof(DLL),NULL);

hThread=CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32"),"LoadLibraryA"),pLibRemote,0,NULL);

WaitForSingleObject(hThread,INFINITE);

MessageBox(NULL,"Target Application closed","END",MB_OK);
return 0;
}

Die MessageBox öffnet sich direkt obwohl sie erst nach dem beenden des Zielprocesses kommen sollte. Und die DLL wird auch nicht eingebunden. Kann jemand helfen?

[code]
int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
{
HANDLE hThread;

DWORD procId;

HWND hWnd=FindWindow(NULL,"Unbenannt - Editor");
if(!hWnd)
MessageBox(NULL,"Fenster konnte nicht gefunden werden","ERROR",MB_ICONERROR|MB_OK);

if(!GetWindowThreadProcessId(hWnd,&procId))
MessageBox(NULL,"Process Id konnte nicht ermittelt werden","ERROR",MB_ICONERROR|MB_OK);

HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,procId);
if(!hProcess)
MessageBox(NULL,"Process konnte nicht geöffnet werden","ERROR",MB_ICONERROR|MB_OK);

void* pLibRemote;

char DLL[]="aHook.dll";

pLibRemote= VirtualAllocEx(hProcess,NULL,sizeof(DLL),MEM_COMMIT,PAGE_READWRITE);

if(!pLibRemote)
MessageBox(NULL,"Platz für dll konnte nicht allokiert werden","ERROR",MB_ICONERROR|MB_OK);

if(!WriteProcessMemory(hProcess,pLibRemote,(void*)DLL,sizeof(DLL),NULL))
MessageBox(NULL,"Das schreiben in den Process ist fehlgeschlagen","ERROR",MB_ICONERROR|MB_OK);

hThread=CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32.dll"),"LoadLibraryA"),pLibRemote,0,NULL);
if(!hThread)
MessageBox(NULL,"Remote Thread konnte nicht erstellt werden","ERROR",MB_ICONERROR|MB_OK);

WaitForSingleObject(hThread,INFINITE);
MessageBox(NULL,"Target Application closed","END",MB_OK);

return TRUE;
}

Bin verzweifelt :(.

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
	STARTUPINFO si;
	PROCESS_INFORMATION pi;
	PSTR pszLibFileRemote;
	PTHREAD_START_ROUTINE pfnThreadRtn;
	HANDLE hRemoteThread;

	PSTR pszLibFile = "ep2Inject.dll";
	int nSize;

	memset( &si, 0, sizeof(si) );
	memset( &pi, 0, sizeof(pi) );
	si.cb = sizeof(si);

	if( !CreateProcess( "editplus.exe", lpCmdLine, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi ) )
	{
		MessageBox( NULL, "CreateProcess failed", "Error", MB_OK );
		return 1;
	}

	// wait until EditPlus2 is ready
	// make sure all windows have been initialized before we
	// attempt to inject our dll.
	WaitForInputIdle( pi.hProcess, INFINITE );

	// allocate memory in target process address space
	nSize = lstrlen(pszLibFile) + 1;
	pszLibFileRemote = (PSTR) VirtualAllocEx( pi.hProcess, NULL, nSize, MEM_COMMIT, PAGE_READWRITE );

	if( pszLibFileRemote == NULL )
	{
		MessageBox( NULL, "VirtualAllocEx failed", "Error", MB_ICONERROR );
		CloseHandle( pi.hProcess );
		CloseHandle( pi.hThread );
		return 1;
	}

	// copy DLL name into address space of target process
	if( !WriteProcessMemory( pi.hProcess, pszLibFileRemote, pszLibFile, nSize, NULL ) )
	{
		MessageBox( NULL, "WriteProcessMemory failed", "Error", MB_ICONERROR );
		VirtualFreeEx( pi.hProcess, pszLibFileRemote, 0, MEM_RELEASE );
		CloseHandle( pi.hProcess );
		CloseHandle( pi.hThread );
		return 1;
	}

	// figure out real address of LoadLibraryA.
	// this assumes Kernel32.dll has the same base address in every process.
	pfnThreadRtn = (PTHREAD_START_ROUTINE) GetProcAddress( GetModuleHandle("Kernel32"), "LoadLibraryA" );
	if( pfnThreadRtn == NULL )
	{
		MessageBox( NULL, "GetProcAddress failed", "Error", MB_ICONERROR );
		VirtualFreeEx( pi.hProcess, pszLibFileRemote, 0, MEM_RELEASE );
		CloseHandle( pi.hProcess );
		CloseHandle( pi.hThread );
		return 1;
	}

	// create the remote thread
	// this triggers a DLL_PROCESS_ATTACH in the injected dll
	hRemoteThread = CreateRemoteThread( pi.hProcess, NULL, 0, pfnThreadRtn, pszLibFileRemote, 0, NULL );
	if( hRemoteThread == NULL )
	{
		MessageBox( NULL, "CreateRemoteThread failed", "Error", MB_ICONERROR );
		VirtualFreeEx( pi.hProcess, pszLibFileRemote, 0, MEM_RELEASE );
		CloseHandle( pi.hProcess );
		CloseHandle( pi.hThread );
		return 1;
	}

	// wait for remote thread to finish
	WaitForSingleObject( hRemoteThread, INFINITE );

	// free allocated memory
	if( pszLibFileRemote != NULL )
		VirtualFreeEx( pi.hProcess, pszLibFileRemote, 0, MEM_RELEASE );

	// wait for Editplus2 to finish
//	WaitForSingleObject( pi.hProcess, INFINITE );
	CloseHandle( pi.hProcess );
	CloseHandle( pi.hThread );

	return 0;
}

Im Zweifelsfall bitte auch folgende Hinweise beachten:
C/C++ Forum :: FAQ - Sonstiges :: Wohin mit meiner Frage?

Dieses Posting wurde automatisch erzeugt.