64位系统和32位系统,DLL注入一样吗?

[zixing]

提供测试代码如下:
Public Class Form1

Public Const PROCESS_VM_READ = &H10
Public Const TH32CS_SNAPPROCESS = &H2
Public Const MEM_COMMIT = 4096
Public Const PAGE_READWRITE = 4
Public Const PROCESS_CREATE_THREAD = (&H2)
Public Const PROCESS_VM_OPERATION = (&H8)
Public Const PROCESS_VM_WRITE = (&H20)

Public Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByVal lpBuffer As String, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
Public Declare Function GetLastError Lib "kernel32" () As Integer
Public Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Integer
Public Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Integer, ByVal lpAddress As Integer, ByVal dwSize As Integer, ByVal flAllocationType As Integer, ByVal flProtect As Integer) As Integer
Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByVal lpBuffer As String, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Integer, ByVal lpProcName As String) As Integer
Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Integer
Public Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Integer, ByVal lpThreadAttributes As Integer, ByVal dwStackSize As Integer, ByVal lpStartAddress As Integer, ByVal lpParameter As Integer, ByVal dwCreationFlags As Integer, ByRef lpThreadId As Integer) As Integer
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As Integer

Private TargetProcessHandle As Integer
Private TargetWindowHandle As Integer
Private TargetProcessID As Integer
Private pfnStartAddr As Integer
Private pszLibFileRemote As String
Private TargetBufferSize As Integer

Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Integer
Private Declare Function GetWindowThreadProcessId Lib "user32" Alias "GetWindowThreadProcessId" (ByVal hwnd As Integer, ByRef lpdwProcessId As Integer) As Integer

Public Sub Inject() REM 对记事本插入一个线程
TargetWindowHandle = FindWindow(Nothing, "无标题.txt 记事本") '这个需要改的和标题一样
If TargetWindowHandle = 0 Then MsgBox("NotePad Not Found。Exit") : Me.Close() : Exit Sub

GetWindowThreadProcessId(TargetWindowHandle, TargetProcessID)
TargetProcessHandle = OpenProcess(PROCESS_CREATE_THREAD Or PROCESS_VM_OPERATION Or PROCESS_VM_WRITE, False, TargetProcessID)
MsgBox(TargetProcessHandle.ToString)
pszLibFileRemote = Application.StartupPath & "\testdll.dll"
pfnStartAddr = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA")
MsgBox(pfnStartAddr.ToString)
TargetBufferSize = 1 + Len(pszLibFileRemote)
Dim Rtn As Integer
Dim LoadLibParamAdr As Integer
LoadLibParamAdr = VirtualAllocEx(TargetProcessHandle, 0, TargetBufferSize, MEM_COMMIT, PAGE_READWRITE)

Rtn = WriteProcessMemory(TargetProcessHandle, LoadLibParamAdr, pszLibFileRemote, TargetBufferSize, 0)
MsgBox(Rtn.ToString, MsgBoxStyle.OkOnly, "WriteProcessMemory")

CreateRemoteThread(TargetProcessHandle, 0, 0, pfnStartAddr, LoadLibParamAdr, 0, 0)

Me.Close()
End Sub

Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Inject()
End Sub
End Class
---------------------------------
在64位系统下测试失败,我用win7 64位和vb 2005...高手帮忙测试一下是为什么,我用360扫描的,DLL没有注入进去.

[CloneCenter]

如果牵涉到地址的问题，那么64位和32位应该是不同的。这个没有测试过，但是理论上应该是不同的。

[zixing]

有没有高手测试过这个问题,并说明一下原理.这个代码是在32位系统上边拷贝过来的.

[vrhero]

API声明全都不对...Integer是32位，64位系统的句柄都是64位Long...

[zixing]

恩.我测试一下,是这样的
但是在64位系统上写的程序在32位系统上是可以运行的.
----------------------------------------------
另外问个问题
vb.net写的DLL注入到别的程序以后,怎么执行DLL中的代码?
我用模块查看工具查看了一下,DLL是成功注入的,但是并没有运行其中的代码
问题就是,怎么让DLL注入成功以后,运行其中代码?
如果可以,采用什么方式和主程序(不是宿主程序)通讯呢?

[zixing]

我自己顶一下..没人来看了...

[zixing]

..来个人给顶一下也好啊.

[c_cwh]

还是没有高手出来说一下64位DLL注入吗？