Ejemplo n.º 1
0
        /// <summary>
        /// 执行远程进程上的系统函数
        /// </summary>
        /// <param name="processId">进程id</param>
        /// <param name="moduleName">系统模块名称</param>
        /// <param name="functionName">函数名称</param>
        /// <param name="param"></param>
        /// <returns></returns>
        public static bool ExcuteRemoteSystemFunction(int processId, string moduleName, string functionName, byte[] param)
        {
            var hndProc = OpenProcessWithRemoteExcute(processId);

            if (hndProc == IntPtr.Zero)
            {
                return(false);
            }
            try
            {
                //查找当前应用系统函数地址,本机上所有应用的系统函数地址都是相同的
                var lpFuncAddress = ProcessAPI.GetProcAddress(ProcessAPI.GetModuleHandle(moduleName), functionName);
                if (lpFuncAddress == IntPtr.Zero)
                {
                    return(false);
                }
                var lpAddress = CopyToRemoteMemory(hndProc, param);
                if (lpAddress == IntPtr.Zero)
                {
                    return(false);
                }
                return(ExcuteRemoteFunction(hndProc, lpFuncAddress, lpAddress));
            }
            finally
            {
                ProcessAPI.CloseHandle(hndProc);
            }
        }
Ejemplo n.º 2
0
        public static bool ExcuteRemoteSystemFunction(int processId, string moduleName, string functionName, byte[] param)
        {
            var hndProc = ProcessAPI.OpenProcess(
                ProcessAPI.ProcessAccessFlags.CreateThread | ProcessAPI.ProcessAccessFlags.VirtualMemoryOperation |
                ProcessAPI.ProcessAccessFlags.VirtualMemoryRead | ProcessAPI.ProcessAccessFlags.VirtualMemoryWrite
                | ProcessAPI.ProcessAccessFlags.QueryInformation
                , true, processId);

            if (hndProc == IntPtr.Zero)
            {
                return(false);
            }

            //查找当前应用系统函数地址,本机上所有应用的系统函数地址都是相同的
            var lpFuncAddress = ProcessAPI.GetProcAddress(ProcessAPI.GetModuleHandle(moduleName), functionName);

            ProcessAPI.CloseHandle(hndProc);

            if (lpFuncAddress == IntPtr.Zero)
            {
                return(false);
            }
            return(ExcuteRemoteFunction(processId, lpFuncAddress, param));
        }