请教CreateRemoteThread远程注入进程的问题

sudong1989 2015-05-10 10:40:29

我在控制台程序里用代码在宿主进程里注入一个MessageBox函数，能够成功运行，宿主进程显示对话框后一切正常，可是我用相同的代码在MFC创建的基于对话框程的序里，使用按钮来实现时，注入的对话框能够成功显示，但是一旦关闭注入的对话框，宿主进程就崩溃，我就纳闷了。我试过权限的问题，管理员权限运行也不行，在代码里改令牌也不行，请问到底什么原因导致的这种现象。以下是代码。
控制台程序



#include <windows.h>



typedef int (__stdcall * PFN_MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, DWORD);



struct RemoteParam

{

    char sShow[12];         

    DWORD dwMessageBox;     

};



DWORD WINAPI threadProc(LPVOID lpParameter)

{

    RemoteParam *rp=(RemoteParam*)lpParameter;

    PFN_MESSAGEBOX pfnMessageBox=(PFN_MESSAGEBOX)(rp->dwMessageBox);

    pfnMessageBox(NULL,rp->sShow,rp->sShow,0);

    return 0;

}



void main()

{



    DWORD proId;

    const DWORD dwThreadSize=4096;



    HWND windHandle=::FindWindow(NULL,"MyGame");

    ::GetWindowThreadProcessId(windHandle,&proId);

    HANDLE proHandle=::OpenProcess(PROCESS_ALL_ACCESS,false,proId);



    void* allcAddr=::VirtualAllocEx(proHandle,0,dwThreadSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);



    ::WriteProcessMemory(proHandle,allcAddr,&threadProc,dwThreadSize,0);



    HMODULE hUser32=::LoadLibrary("User32.dll");





    RemoteParam RemoteData;

    ZeroMemory(&RemoteData,sizeof(RemoteParam));

    RemoteData.dwMessageBox=(DWORD)::GetProcAddress(hUser32,"MessageBoxA");



    strcat(RemoteData.sShow,"Hello\0");



    RemoteParam* paramAndFunc=(RemoteParam*)::VirtualAllocEx(proHandle,0,sizeof(RemoteData),MEM_COMMIT,PAGE_READWRITE);



    ::WriteProcessMemory(proHandle,paramAndFunc,&RemoteData,sizeof(RemoteData),0);





    DWORD dwId;



    HANDLE hRemoteHandle=::CreateRemoteThread(proHandle,NULL,0,(LPTHREAD_START_ROUTINE)allcAddr,paramAndFunc,0,&dwId);



    CloseHandle(hRemoteHandle);  

    FreeLibrary(hUser32);  



}

MFC按钮消息响应函数里的代码



typedef int (__stdcall * PFN_MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, DWORD);



struct RemoteParam

{

    char sShow[12];     

    DWORD dwMessageBox;     

};



DWORD WINAPI threadProc(LPVOID lpParameter)

{

    RemoteParam *rp=(RemoteParam*)lpParameter;

    PFN_MESSAGEBOX pfnMessageBox=(PFN_MESSAGEBOX)(rp->dwMessageBox);

    pfnMessageBox(NULL,rp->sShow,rp->sShow,0);

    return 0;

}

void CMyDlg::OnButtonPourinto() 

{

    //enableDebugPriv();

    DWORD proId;

    const DWORD dwThreadSize=4096;

    HWND windHandle=::FindWindow(NULL,"MyGame");

    ::GetWindowThreadProcessId(windHandle,&proId);

    HANDLE proHandle=::OpenProcess(PROCESS_ALL_ACCESS,false,proId);



    void* allcAddr=::VirtualAllocEx(proHandle,0,dwThreadSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE

        );

    ::WriteProcessMemory(proHandle,allcAddr,&threadProc,dwThreadSize,0);

    RemoteParam RemoteData;

    ZeroMemory(&RemoteData,sizeof(RemoteParam));

    HINSTANCE hUser32 = LoadLibrary("User32.dll");

    RemoteData.dwMessageBox=(DWORD)::GetProcAddress(hUser32,"MessageBoxA");

    strcat(RemoteData.sShow,"Hello\0");

    RemoteParam* paramAndFunc=(RemoteParam*)::VirtualAllocEx(proHandle,0,sizeof(RemoteData),MEM_COMMIT,PAGE_READWRITE);



    ::WriteProcessMemory(proHandle,paramAndFunc,&RemoteData,sizeof(RemoteData),0);



    DWORD dwId;

    HANDLE hRemoteHandle=::CreateRemoteThread(proHandle,NULL,0,(LPTHREAD_START_ROUTINE)allcAddr,paramAndFunc,0,&dwId);



    CloseHandle(hRemoteHandle);  

    FreeLibrary(hUser32);  

}