VS2010 线程注入 CreateRemoteThread(),出错，返回5

2012-07-29 11:05:47 456 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

shijizhishang_1 墨衍会员 · AI 创作全网分发关注 + 加入社区

【Python实战解析】从数据爬取到房价预测：一个完整的数据科学项目流程拆解本文详细拆解了一个完整的Python数据科学项目流程，从爬取长沙二手房数据到房价预测模型构建。通过实战案例，介绍了数据爬取、清洗、可视化及模型优化的关键技巧，帮助开发者掌握Python在数据分析中的应用，提升程序开发能力。阅读详情

我已经使用管理员身份运行，之前运行正确，只是一到CreateRemoteThread就出错
代码如下





#include<iostream>

#include"windows.h"

#include"tlhelp32.h"



using namespace std;

 







BOOL Prompt()

{

	HANDLE hToken;

	if(!OpenProcessToken(::GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))

	{

		cout<<"OpenProcessToken  error  the code is :"<<GetLastError()<<endl;

		return FALSE;

	}

	TOKEN_PRIVILEGES tkp;

	tkp.PrivilegeCount =1;

	if(!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tkp.Privileges [0].Luid ))

	{

		cout<<"LookPrivilegeValue  error the code is :"<<GetLastError()<<endl;

		return FALSE;

	}

	if(!AdjustTokenPrivileges(hToken,false,&tkp,sizeof(tkp),NULL,0))

	{

		cout<<"AdjustPrivileges  error the code is:"<<GetLastError()<<endl;

		return FALSE;

	}

	return true;

}

int main()

{

	//获得系统当前运行的程序,获得目标程序ID

	DWORD ProcessId=0;

	HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

	if(hSnap==NULL)

	{

		cout<<"CreateToolhelp32Snapshot  error the code is :"<<GetLastError()<<endl;

		return 0;

	}

	BOOL mark=false;

	PROCESSENTRY32 pro_info;

	pro_info.dwSize =sizeof(pro_info);

	mark=Process32First(hSnap,&pro_info);

	while(mark)

	{

		if(pro_info.szExeFile [0]=='c'&&pro_info.szExeFile [1]=='a'&&pro_info.szExeFile [2]=='l'&&pro_info.szExeFile [3]=='c')

		{

			MessageBoxA(NULL,"find it!","warning ",0);

			ProcessId=pro_info.th32ProcessID ;

			break;

		}

		mark=Process32Next(hSnap,&pro_info);

	}

	if(Prompt())

	{

		cout<<"提升权限成功。。。"<<endl;

	}

	else

		return 0;

	if(ProcessId==0)

	{

		MessageBoxA(NULL,"没有找到计算器进程",NULL,0);

		return -1;

	}

	//打开目标程序

	HANDLE hPro;

	hPro=OpenProcess(PROCESS_ALL_ACCESS,FALSE,ProcessId);

	if(hPro==NULL)

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","OpenProcess",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return -1;

	}

	

	PVOID addr;

	addr=VirtualAllocEx(hPro,NULL,1024*4,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

	if(addr==NULL)

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","VirtualAlloc 出错",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return -1;

	}

//	获得函数地址

	PVOID Func_addr;

	Func_addr=GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");

	if(Func_addr==NULL)

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","GetProcAddress出错",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return -1;

	}

	char DllName[]="en.dll";

	if(!WriteProcessMemory(hPro,addr,DllName,strlen(DllName),0))

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","WriteProcessMemory出错",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return -1;

	}

	//创建远程线程

	DWORD ID;

	HANDLE hThr;

	hThr=CreateRemoteThread(hPro,NULL,0,(PTHREAD_START_ROUTINE)Func_addr,addr,0,&ID);

	if(hThr==NULL)

	{

		int num=GetLastError();

		char warn[100];

		sprintf(warn,"%s,%d","远程进程创建失败",num);

	    MessageBoxA(NULL,warn,"warning ",0);

		return 0;

	}

	else

	{

		MessageBoxA(NULL,"远程进程创建成功!","warning ",0);

		int a;

	    cin>>a;



	}

}