VS2010 线程注入 CreateRemoteThread(),出错，返回5

shijizhishang_1 2012-07-29 11:05:47

我已经使用管理员身份运行，之前运行正确，只是一到CreateRemoteThread就出错
代码如下





#include<iostream>

#include"windows.h"

#include"tlhelp32.h"



using namespace std;

 







BOOL Prompt()

{

	HANDLE hToken;

	if(!OpenProcessToken(::GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))

	{

		cout<<"OpenProcessToken  error  the code is :"<<GetLastError()<<endl;

		return FALSE;

	}

	TOKEN_PRIVILEGES tkp;

	tkp.PrivilegeCount =1;

	if(!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tkp.Privileges [0].Luid ))

	{

		cout<<"LookPrivilegeValue  error the code is :"<<GetLastError()<<endl;

		return FALSE;

	}

	if(!AdjustTokenPrivileges(hToken,false,&tkp,sizeof(tkp),NULL,0))

	{

		cout<<"AdjustPrivileges  error the code is:"<<GetLastError()<<endl;

		return FALSE;

	}

	return true;

}

int main()

{

	//获得系统当前运行的程序,获得目标程序ID

	DWORD ProcessId=0;

	HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

	if(hSnap==NULL)

	{

		cout<<"CreateToolhelp32Snapshot  error the code is :"<<GetLastError()<<endl;

		return 0;

	}

	BOOL mark=false;

	PROCESSENTRY32 pro_info;

	pro_info.dwSize =sizeof(pro_info);

	mark=Process32First(hSnap,&pro_info);

	while(mark)

	{

		if(pro_info.szExeFile [0]=='c'&&pro_info.szExeFile [1]=='a'&&pro_info.szExeFile [2]=='l'&&pro_info.szExeFile [3]=='c')

		{

			MessageBoxA(NULL,"find it!","warning ",0);

			ProcessId=pro_info.th32ProcessID ;

			break;

		}

		mark=Process32Next(hSnap,&pro_info);

	}

	if(Prompt())

	{

		cout<<"提升权限成功。。。"<<endl;

	}

	else

		return 0;

	if(ProcessId==0)

	{

		MessageBoxA(NULL,"没有找到计算器进程",NULL,0);

		return -1;

	}

	//打开目标程序

	HANDLE hPro;

	hPro=OpenProcess(PROCESS_ALL_ACCESS,FALSE,ProcessId);

	if(hPro==NULL)

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","OpenProcess",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return -1;

	}

	

	PVOID addr;

	addr=VirtualAllocEx(hPro,NULL,1024*4,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

	if(addr==NULL)

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","VirtualAlloc 出错",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return -1;

	}

//	获得函数地址

	PVOID Func_addr;

	Func_addr=GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");

	if(Func_addr==NULL)

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","GetProcAddress出错",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return -1;

	}

	char DllName[]="en.dll";

	if(!WriteProcessMemory(hPro,addr,DllName,strlen(DllName),0))

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","WriteProcessMemory出错",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return -1;

	}

	//创建远程线程

	DWORD ID;

	HANDLE hThr;

	hThr=CreateRemoteThread(hPro,NULL,0,(PTHREAD_START_ROUTINE)Func_addr,addr,0,&ID);

	if(hThr==NULL)

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","远程进程创建失败",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return 0;

	}

	else

	{

		MessageBoxA(NULL,"远程进程创建成功!","warning ",0);

		int a;

	    cin>>a;



	}

}