public static bool ExcuteRemoteFunction(int processId, IntPtr lpFuncAddress, byte[] param) { var hndProc = ProcessAPI.OpenProcess( ProcessAPI.ProcessAccessFlags.CreateThread | ProcessAPI.ProcessAccessFlags.VirtualMemoryOperation | ProcessAPI.ProcessAccessFlags.VirtualMemoryRead | ProcessAPI.ProcessAccessFlags.VirtualMemoryWrite | ProcessAPI.ProcessAccessFlags.QueryInformation , true, processId); if (hndProc == IntPtr.Zero) { return(false); } var lpAddress = MemoryAPI.VirtualAllocEx(hndProc, (IntPtr)null, (IntPtr)param.Length, (0x1000 | 0x2000), 0X40); if (lpAddress == IntPtr.Zero) { ProcessAPI.CloseHandle(hndProc); return(false); } if (MemoryAPI.WriteProcessMemory(hndProc, lpAddress, param, (uint)param.Length, 0) == 0) { ProcessAPI.CloseHandle(hndProc); return(false); } if (ProcessAPI.CreateRemoteThread(hndProc, (IntPtr)null, IntPtr.Zero, lpFuncAddress, lpAddress, 0, (IntPtr)null) == IntPtr.Zero) { ProcessAPI.CloseHandle(hndProc); return(false); } return(true); }
public static IntPtr OpenProcessWithRemoteExcute(int processId) { return(ProcessAPI.OpenProcess( ProcessAPI.ProcessAccessFlags.CreateThread | ProcessAPI.ProcessAccessFlags.VirtualMemoryOperation | ProcessAPI.ProcessAccessFlags.VirtualMemoryRead | ProcessAPI.ProcessAccessFlags.VirtualMemoryWrite | ProcessAPI.ProcessAccessFlags.QueryInformation , true, processId)); }
public static bool ExcuteRemoteSystemFunction(int processId, string moduleName, string functionName, byte[] param) { var hndProc = ProcessAPI.OpenProcess( ProcessAPI.ProcessAccessFlags.CreateThread | ProcessAPI.ProcessAccessFlags.VirtualMemoryOperation | ProcessAPI.ProcessAccessFlags.VirtualMemoryRead | ProcessAPI.ProcessAccessFlags.VirtualMemoryWrite | ProcessAPI.ProcessAccessFlags.QueryInformation , true, processId); if (hndProc == IntPtr.Zero) { return(false); } //查找当前应用系统函数地址,本机上所有应用的系统函数地址都是相同的 var lpFuncAddress = ProcessAPI.GetProcAddress(ProcessAPI.GetModuleHandle(moduleName), functionName); ProcessAPI.CloseHandle(hndProc); if (lpFuncAddress == IntPtr.Zero) { return(false); } return(ExcuteRemoteFunction(processId, lpFuncAddress, param)); }