将动态链接库注入到EXE中

1. 引入头文件

 #include<Windows.h>

2. 获取窗口句柄

char testTitle[]="XXXXXXXX.exe";
char testClass[]="XXXXXXXClass";
HWND windowHandle= FindWindowA(testClass, testTitle);

FindWindowA()中的参数

3. 获取目标进程的PID

 DWORD processID;
 GetWindowThreadProcessId(windowHandle,&processID);

GetWindowThreadProcessId()的参数

4. 获取目标进程的相应权限的进程句柄

 HANDLE threadHandle = OpenProcess(PROCESS_ALL_ACCESS, 0, processID);

OpenProcess()的参数

5. 在目标进程分配内存空间

void* 目标内存空间 = VirtualAllocEx(threadHandle, NULL, 4 * 1024, MEM_COMMIT, 0x40/*PAGE_EXECUTE_READWRITE 内存属性*/);

VirtualAllocEx()的参数

6. 在目标进程写入代码

char DLLPath[]="XXXXXXXXXXXXX.dll"
WriteProcessMemory(threadHandle, 目标内存空间, DLLPath, 0x300, 0);

WriteProcessMemory()的参数

7. 在目标进程调用写入的代码

CreateRemoteThread(threadHandle, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, 目标内存空间/*要注入的DLL*/, 0, 0);

CreateRemoteThread()的参数

LoadLibraryA //将DLL加载到调用进程，并获取模块的基址

8. 全部代码

```c++
#include <iostream>
#include <Windows.h>

char 要注入的DLL路径[] = R"(X:\XXXXXX\XXXX\XXXXXX\XXXX\XXXXXXXX\XXXXXXX.dll)";

int main()
{
    char testTitle[] = R"(XXXXXXXXXXX.exe)";//R"()" 忽略括号内的转义字符
    char testClass[] = "XXXXXXXXXXClass";
    //在目标进程分配内存
    //获取目标窗口的句柄
    HWND windowHandle = FindWindowA(testClass, testTitle);
    //获取目标进程的PID
    DWORD processID = 0;
    GetWindowThreadProcessId(windowHandle, &processID);
    //获取目标进程的相应权限的进程句柄
    HANDLE threadHandle = OpenProcess(PROCESS_ALL_ACCESS, 0, processID);
    //在目标进程分配内存空间
    void* 目标内存空间 = VirtualAllocEx(threadHandle, NULL, 4 * 1024, MEM_COMMIT, 0x40/*PAGE_EXECUTE_READWRITE 内存属性*/);
    printf("目标内存空间 DLL路径=%p \n", 目标内存空间);
    //在目标进程写入代码
    bool 写入结果 = WriteProcessMemory(threadHandle, 目标内存空间, 要注入的DLL路径, 0x300, 0);
    printf("写入结果=%d\n", 写入结果);
    //在目标进程调用写入的代码
    CreateRemoteThread(threadHandle, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, 目标内存空间/*要注入的DLL*/, 0, 0);
    getchar();//等待键盘输入，可以暂停在这里等待
}
```

将动态链接库注入到EXE中

原文：https://www.cnblogs.com/FstBlog/p/15019360.html