下面的程序实现:把DLL注入到Explorer 供参考.
uses
SysUtils,TLHelp32, Windows;
procedure GetProcessID(FileName:String;var PID
WORD);
var
ProcessHandle:THandle;
lppe:TProcessEntry32;
Find:Boolean;
begin
PID:=0;
ProcessHandle:=CreateToolHelp32SnapShot(TH32CS_SNAPPROCESS,0);
lppe.dwSize:=Sizeof(lppe);
Find:=Process32First(ProcessHandle,lppe);
While Find do
begin
if AnsiStrComp(Pchar(FileName),Pchar(ExtractFileName(Lppe.szExeFile)))=0 then
begin
PID:=lppe.th32ProcessID;
Break;
end;
Process32Next(ProcessHandle,lppe);
end;
CloseHandle(ProcessHandle);
end;
function EnabledDebugPrivilege(Const Enable:Boolean):Boolean;
var
hToken:THandle;
tp:Token_Privileges;
a
WORD;
begin
Result:=false;
if OpenProcessToken(GetCurrentProcess,TOKEN_ADJUST_PRIVILEGES,hToken) then
begin
LookUpPrivilegeValue(nil,'SeDebugPrivilege',tp.Privileges[0].Luid);
tp.PrivilegeCount:=1;
tp.Privileges[0].Attributes:=SE_PRIVILEGE_ENABLED;
a:=0;
AdjustTokenPrivileges(hToken,false,tp,Sizeof(tp),nil,a);
Result:=GetLastError=ERROR_SUCCESS;
CloseHandle(hToken);
end;
end;
function AttachToProcess(Const HostFile,Guest:String;Const PID
WORD=0)
WORD;
var
hRemoteProcess:THandle;
dwRemoteProcess
WORD;
cb
WORD;
PLFileRemote
ointer;
RCode:Boolean;
TempVar
WORD;
PStartAddr:TFNThreadStartRoutine;
PFilename
WideChar;
begin
Result:=0;
EnabledDebugPrivilege(true);
GetMem(PFileName,Length(Guest)*2+1);
StringToWideChar(Guest,PFileName,Length(Guest)*2+1);
if PID>0 then
dwRemoteProcess:=PID
else
GetProcessID(HostFile,dwRemoteProcess);
hRemoteProcess:=OpenProcess(PROCESS_CREATE_THREAD+PROCESS_VM_OPERATION+PROCESS_VM_WRITE,
false,dwRemoteProcess);
cb:=(1+lStrLenW(PFileName))*Sizeof(WCHAR);
PLFileRemote:=PWideString(VirtualAllocEX(hRemoteProcess,nil,cb,MEM_COMMIT,PAGE_READWRITE));
TempVar:=0;
RCode:=WriteProcessMemory(hRemoteProcess,PLFileRemote,PFileName,cb,TempVar);
if RCode then
begin
PStartAddr:=GetProcAddress(GetModuleHandle('kernel32'),'LoadLibraryW');
TempVar:=0;
Result:=CreateRemoteThread(hRemoteProcess,nil,0,PStartAddr,PLFileRemote,0,TempVar);
end;
FreeMem(PFileName);
end;
begin
AttachToProcess('explorer.exe',ExtractFilePath(paramstr(0))+'RunWWW.dll');
end.
