代码人生的小狗窝

一行行枯燥的代码,却描绘出人生的点点滴滴

您现在的位置是:首页>_C#

C# DLL怎么注入explorer.exe?

发布时间:2019-12-09浏览(1336)

    C# DLL如何注入explorer.exe??
    现需要做把一个DLL注入到系统explorer.exe进程里面,以实现进程间的通讯,请问如何用C#代码实现注入呢?网上很难找到注入的代码
    各位有没有实现的代码?不知道用C#能不能实现?

    谢谢!

    ------解决方案--------------------
    这个,你还是用C#写shell扩展比较合适.至于注入,C#有困难
    ------解决方案--------------------
    api
    LoadLibrary
    GetProcAddress 
    CreateRemoteThread
    ------解决方案--------------------
    看一下下面的文章:
    http://blog.csdn.net/hack214/archive/2008/04/11/2283599.aspx

    代码如下:
    using System;
    using System.Collections.Generic;
    using System.ComponentModel;
    using System.Data;
    using System.Drawing;
    using System.Text;
    using System.Windows.Forms;
    using System.Runtime.InteropServices;
    using System.Diagnostics;
    namespace TryFile
    {
    public partial class DllInjectForm : Form
    {
    public DllInjectForm()
    {
    InitializeComponent();
    }
    [DllImport("kernel32.dll")] //声明API函数
    public static extern int VirtualAllocEx(IntPtr hwnd, int lpaddress, int size, int type, int tect);
    [DllImport("kernel32.dll")]
    public static extern int WriteProcessMemory(IntPtr hwnd, int baseaddress, string buffer, int nsize, int filewriten);
    [DllImport("kernel32.dll")]
    public static extern int GetProcAddress(int hwnd, string lpname);
    [DllImport("kernel32.dll")]
    public static extern int GetModuleHandleA(string name);
    [DllImport("kernel32.dll")]
    public static extern int CreateRemoteThread(IntPtr hwnd, int attrib, int size, int address, int par, int flags, int threadid);

    private void button1_Click(object sender, EventArgs e)
    {
    int ok1;
    int baseaddress;
    int temp = 0;
    int hack;
    int yan;
    string dllname;
    dllname = "c:\\WinShell.dll";
    int dlllength;
    dlllength = dllname.Length + 1;
    Process[] pname = Process.GetProcesses(); //取得所有进程
    foreach (Process name in pname) //遍历进程
    {
    if (name.ProcessName.ToLower().IndexOf("explorer") != -1) //所示记事本,那么下面开始注入
    {
    baseaddress = VirtualAllocEx(name.Handle, 0, dlllength, 4096, 4); //申请内存空间
    if (baseaddress == 0) //返回0则操作失败,下面都是
    {
    MessageBox.Show("申请内存空间失败!!");
    Application.Exit();
    }
    ok1 = WriteProcessMemory(name.Handle, baseaddress, dllname, dlllength, temp); //写内存
    if (ok1 == 0)
    {
    MessageBox.Show("写内存失败!!");
    Application.Exit();
    }
    hack = GetProcAddress(GetModuleHandleA("Kernel32"), "LoadLibraryA"); //取得loadlibarary在kernek32.dll地址
    if (hack == 0)
    {
    MessageBox.Show("无法取得函数的入口点!!");
    Application.Exit();
    }
    yan = CreateRemoteThread(name.Handle, 0, 0, hack, baseaddress, 0, temp); //创建远程线程。
    if (yan == 0)
    {
    MessageBox.Show("创建远程线程失败!!");
    Application.Exit();
    }
    else
    {
    MessageBox.Show("已成功注入dll!!");
    }
    }
    }