예제 #1
0
        internal static bool InjectUnmanagedInternal(void *processHandle, string dllPath)
        {
            void *pLoadLibrary;
            void *pDllPath;
            void *threadHandle;
            uint  exitCode;

            pLoadLibrary = NativeModule.GetFunctionAddressInternal(processHandle, "kernel32.dll", "LoadLibraryW");
            // 获取LoadLibrary的函数地址
            pDllPath = NativeProcess.AllocMemoryInternal(processHandle, (uint)dllPath.Length * 2 + 2, MemoryProtection.ExecuteRead);
            try {
                if (pDllPath == null)
                {
                    return(false);
                }
                if (!NativeProcess.WriteStringInternal(processHandle, pDllPath, dllPath, Encoding.Unicode))
                {
                    return(false);
                }
                threadHandle = CreateRemoteThread(processHandle, null, 0, pLoadLibrary, pDllPath, 0, null);
                if (threadHandle == null)
                {
                    return(false);
                }
                WaitForSingleObject(threadHandle, INFINITE);
                // 等待线程结束
                GetExitCodeThread(threadHandle, out exitCode);
                return(exitCode != 0);
                // LoadLibrary返回值不为0则调用成功,否则失败
            }
            finally {
                NativeProcess.FreeMemoryInternal(processHandle, pDllPath);
            }
        }