DLL注入可用於編寫外掛和病毒不易發現。

void CInjectDllToolDlg::StartInject(char *path, int pid)
{
	int pathLen = strlen(path)+sizeof(char);//獲取dll目錄大小
	HANDLE hPro = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
	if (!hPro)
	{
		MessageBox("開啟程序失敗", "警告", 0);
		return;
	}
	//在該程序申請記憶體，用來存放path資料
	LPVOID dllAddr = VirtualAllocEx(hPro, NULL, pathLen, MEM_COMMIT, PAGE_READWRITE);
	if (!dllAddr)
	{
		MessageBox("獲取地址失敗", "警告", 0);
		CloseHandle(hPro);
		return;
	}
	//在申請的記憶體中寫入path
	DWORD wNum = 0;
	if (!WriteProcessMemory(hPro, dllAddr, path, pathLen, &wNum))
	{
		MessageBox("寫入失敗", "警告", 0);
		VirtualFreeEx(hPro, dllAddr, pathLen, MEM_DECOMMIT);
		CloseHandle(hPro);
		return;
	}
	//獲取loadlibrary函式地址
	FARPROC pFun = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

	if (!pFun)
	{
		MessageBox("獲取函式失敗", "警告", 0);
		VirtualFreeEx(hPro, dllAddr, pathLen, MEM_DECOMMIT);
		CloseHandle(hPro);
		return;
	}
	DWORD dwPid;
	HANDLE hThread = CreateRemoteThread(hPro, NULL, 0, (LPTHREAD_START_ROUTINE)pFun, dllAddr, 0, &dwPid);
	if (!hThread)
	{
		MessageBox("注入失敗", "警告", 0);
		VirtualFreeEx(hPro, dllAddr, pathLen, MEM_DECOMMIT);
		CloseHandle(hPro);
		return;
	}
	DWORD errorNum = GetLastError();
	WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hThread);
	CloseHandle(hPro);
}
 

Dll解除安裝與注入流程大體相同，先建立 程序快照找到相應的執行緒模組，獲取FreeLibrary地址，再建立遠端執行緒解除安裝

void UnInjectDll(char *szDllName, DWORD dwPid)
{
	if(dwPid==0 || strlen(szDllName)==0)
	{
		AfxMessageBox("輸入資訊不全");
		return;
	}
	//建立程序快照
	HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,dwPid);
	MODULEENTRY32 ME32 = {0};
	ME32.dwSize = sizeof(MODULEENTRY32);
	BOOL isNext = Module32First(hSnap,&ME32);
	BOOL flag = FALSE;
	while(isNext)
	{
		if(strcmp(ME32.szModule,szDllName)==0)
		{
			flag = TRUE;
			break;
		}
		isNext = Module32Next(hSnap,&ME32);
	}
	if(flag == FALSE)
	{
		AfxMessageBox("找不到目標模組");
		return;
	}
	CloseHandle(hSnap);
	HANDLE hPro = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);
	FARPROC pFun = GetProcAddress(GetModuleHandle("kernel32.dll"),"FreeLibrary");
	HANDLE hThread = CreateRemoteThread(hPro,NULL,0,(LPTHREAD_START_ROUTINE)pFun,ME32.szModule,0,NULL);
	if(!hThread)
	{
		AfxMessageBox("建立遠端執行緒失敗");
		return ;
	}
	AfxMessageBox("解除安裝成功");
	WaitForSingleObject(hThread,INFINITE);
	CloseHandle(hThread);
	CloseHandle(hPro);
}