在VS2015中用C++向cmd的子进程输入命令

[WOYAOBIANDASHI]

用system()命令可以向cmd的系统里输入命令，但是我现在已经连接了一个程序，如下图，现在我再用system()已经不能把我的命令输入到 dz> 后面了，该怎么做才能像system()命令一样将自己的命令输入到 dz> 后面

[paschen]

SetConsoleCursorPosition 设置光标位置

[赵4老师]

仅供参考：

#pragma comment(lib,"user32")
#include <stdio.h>
#include <string.h>
#include <windows.h>
int main() {
    SECURITY_ATTRIBUTES sa          = {0};
    STARTUPINFO         si          = {0};
    PROCESS_INFORMATION pi          = {0};
    HANDLE              hPipeOutputRead  = NULL;
    HANDLE              hPipeOutputWrite = NULL;
    HANDLE              hPipeInputRead   = NULL;
    HANDLE              hPipeInputWrite  = NULL;
    BOOL                bTest = 0;
    DWORD               dwNumberOfBytesRead = 0;
    DWORD               dwNumberOfBytesWrite = 0;
    CHAR                szMsg[100];
    CHAR                szBuffer[256];

    sa.nLength = sizeof(sa);
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = NULL;

    // Create pipe for standard output redirection.
    CreatePipe(&hPipeOutputRead,  // read handle
            &hPipeOutputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Create pipe for standard input redirection.
    CreatePipe(&hPipeInputRead,  // read handle
            &hPipeInputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Make child process use hPipeOutputWrite as standard out,
    // and make sure it does not show on screen.
    si.cb = sizeof(si);
    si.dwFlags     = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    si.hStdInput   = hPipeInputRead;
    si.hStdOutput  = hPipeOutputWrite;
    si.hStdError   = hPipeOutputWrite;

    CreateProcess (
          NULL, "cmd.exe",
          NULL, NULL,
          TRUE, 0,
          NULL, NULL,
          &si, &pi);

    // Now that handles have been inherited, close it to be safe.
    // You don't want to read or write to them accidentally.
    CloseHandle(hPipeOutputWrite);
    CloseHandle(hPipeInputRead);

    // Now test to capture DOS application output by reading
    // hPipeOutputRead.  Could also write to DOS application
    // standard input by writing to hPipeInputWrite.
    sprintf(szMsg, "ver\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "chcp\nexit\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
    }

    // Wait for CONSPAWN to finish.
    WaitForSingleObject (pi.hProcess, INFINITE);

    // Close all remaining handles
    CloseHandle (pi.hProcess);
    CloseHandle (hPipeOutputRead);
    CloseHandle (hPipeInputWrite);

    return 0;
}
//C:\test>test
//Microsoft Windows [版本 5.2.3790]
//(C) 版权所有 1985-2003 Microsoft Corp.
//
//C:\test>ver
//
//Microsoft Windows [版本 5.2.3790]
//
//C:\test>chcp
//活动的代码页: 936
//
//C:\test>exit
//Error #109 reading pipe.
//C:\test>

[赵4老师]

再供参考：

#pragma comment(lib,"user32")
#include <stdio.h>
#include <string.h>
#include <windows.h>
int main() {
    SECURITY_ATTRIBUTES sa          = {0};
    STARTUPINFO         si          = {0};
    PROCESS_INFORMATION pi          = {0};
    HANDLE              hPipeOutputRead  = NULL;
    HANDLE              hPipeOutputWrite = NULL;
    HANDLE              hPipeInputRead   = NULL;
    HANDLE              hPipeInputWrite  = NULL;
    BOOL                bTest = 0;
    DWORD               dwNumberOfBytesRead = 0;
    DWORD               dwNumberOfBytesWrite = 0;
    CHAR                szMsg[100];
    CHAR                szBuffer[256];

    sa.nLength = sizeof(sa);
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = NULL;

    // Create pipe for standard output redirection.
    CreatePipe(&hPipeOutputRead,  // read handle
            &hPipeOutputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Create pipe for standard input redirection.
    CreatePipe(&hPipeInputRead,  // read handle
            &hPipeInputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Make child process use hPipeOutputWrite as standard out,
    // and make sure it does not show on screen.
    si.cb = sizeof(si);
    si.dwFlags     = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    si.hStdInput   = hPipeInputRead;
    si.hStdOutput  = hPipeOutputWrite;
    si.hStdError   = hPipeOutputWrite;

    CreateProcess (
          NULL, "cmd.exe",
          NULL, NULL,
          TRUE, 0,
          NULL, NULL,
          &si, &pi);

    // Now that handles have been inherited, close it to be safe.
    // You don't want to read or write to them accidentally.
    CloseHandle(hPipeOutputWrite);
    CloseHandle(hPipeInputRead);

    // Now test to capture DOS application output by reading
    // hPipeOutputRead.  Could also write to DOS application
    // standard input by writing to hPipeInputWrite.
    sprintf(szMsg, "cd /d c:\\user\\lsw\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "adb forward tcp:31415 tcp:31415\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "drozer console connect\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "help\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "quit\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "exit\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }
    // Wait for CONSPAWN to finish.
    WaitForSingleObject (pi.hProcess, INFINITE);

    // Close all remaining handles
    CloseHandle (pi.hProcess);
    CloseHandle (hPipeOutputRead);
    CloseHandle (hPipeInputWrite);

    return 0;
}

[WOYAOBIANDASHI]

引用 1 楼 zhao4zhong1 的回复:

仅供参考：

#pragma comment(lib,"user32")
#include <stdio.h>
#include <string.h>
#include <windows.h>
int main() {
    SECURITY_ATTRIBUTES sa          = {0};
    STARTUPINFO         si          = {0};
    PROCESS_INFORMATION pi          = {0};
    HANDLE              hPipeOutputRead  = NULL;
    HANDLE              hPipeOutputWrite = NULL;
    HANDLE              hPipeInputRead   = NULL;
    HANDLE              hPipeInputWrite  = NULL;
    BOOL                bTest = 0;
    DWORD               dwNumberOfBytesRead = 0;
    DWORD               dwNumberOfBytesWrite = 0;
    CHAR                szMsg[100];
    CHAR                szBuffer[256];

    sa.nLength = sizeof(sa);
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = NULL;

    // Create pipe for standard output redirection.
    CreatePipe(&hPipeOutputRead,  // read handle
            &hPipeOutputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Create pipe for standard input redirection.
    CreatePipe(&hPipeInputRead,  // read handle
            &hPipeInputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Make child process use hPipeOutputWrite as standard out,
    // and make sure it does not show on screen.
    si.cb = sizeof(si);
    si.dwFlags     = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    si.hStdInput   = hPipeInputRead;
    si.hStdOutput  = hPipeOutputWrite;
    si.hStdError   = hPipeOutputWrite;

    CreateProcess (
          NULL, "cmd.exe",
          NULL, NULL,
          TRUE, 0,
          NULL, NULL,
          &si, &pi);

    // Now that handles have been inherited, close it to be safe.
    // You don't want to read or write to them accidentally.
    CloseHandle(hPipeOutputWrite);
    CloseHandle(hPipeInputRead);

    // Now test to capture DOS application output by reading
    // hPipeOutputRead.  Could also write to DOS application
    // standard input by writing to hPipeInputWrite.
    sprintf(szMsg, "ver\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "chcp\nexit\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
    }

    // Wait for CONSPAWN to finish.
    WaitForSingleObject (pi.hProcess, INFINITE);

    // Close all remaining handles
    CloseHandle (pi.hProcess);
    CloseHandle (hPipeOutputRead);
    CloseHandle (hPipeInputWrite);

    return 0;
}
//C:\test>test
//Microsoft Windows [版本 5.2.3790]
//(C) 版权所有 1985-2003 Microsoft Corp.
//
//C:\test>ver
//
//Microsoft Windows [版本 5.2.3790]
//
//C:\test>chcp
//活动的代码页: 936
//
//C:\test>exit
//Error #109 reading pipe.
//C:\test>

赵老师，这和您第一次发的代码好像改动挺大，有什么区别吗（这个更加复杂看不懂了）

[WOYAOBIANDASHI]

引用 3 楼 WOYAOBIANDASHI 的回复:

[quote=引用 1 楼 zhao4zhong1 的回复:] 仅供参考：

#pragma comment(lib,"user32")
#include <stdio.h>
#include <string.h>
#include <windows.h>
int main() {
    SECURITY_ATTRIBUTES sa          = {0};
    STARTUPINFO         si          = {0};
    PROCESS_INFORMATION pi          = {0};
    HANDLE              hPipeOutputRead  = NULL;
    HANDLE              hPipeOutputWrite = NULL;
    HANDLE              hPipeInputRead   = NULL;
    HANDLE              hPipeInputWrite  = NULL;
    BOOL                bTest = 0;
    DWORD               dwNumberOfBytesRead = 0;
    DWORD               dwNumberOfBytesWrite = 0;
    CHAR                szMsg[100];
    CHAR                szBuffer[256];

    sa.nLength = sizeof(sa);
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = NULL;

    // Create pipe for standard output redirection.
    CreatePipe(&hPipeOutputRead,  // read handle
            &hPipeOutputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Create pipe for standard input redirection.
    CreatePipe(&hPipeInputRead,  // read handle
            &hPipeInputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Make child process use hPipeOutputWrite as standard out,
    // and make sure it does not show on screen.
    si.cb = sizeof(si);
    si.dwFlags     = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    si.hStdInput   = hPipeInputRead;
    si.hStdOutput  = hPipeOutputWrite;
    si.hStdError   = hPipeOutputWrite;

    CreateProcess (
          NULL, "cmd.exe",
          NULL, NULL,
          TRUE, 0,
          NULL, NULL,
          &si, &pi);

    // Now that handles have been inherited, close it to be safe.
    // You don't want to read or write to them accidentally.
    CloseHandle(hPipeOutputWrite);
    CloseHandle(hPipeInputRead);

    // Now test to capture DOS application output by reading
    // hPipeOutputRead.  Could also write to DOS application
    // standard input by writing to hPipeInputWrite.
    sprintf(szMsg, "ver\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "chcp\nexit\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
    }

    // Wait for CONSPAWN to finish.
    WaitForSingleObject (pi.hProcess, INFINITE);

    // Close all remaining handles
    CloseHandle (pi.hProcess);
    CloseHandle (hPipeOutputRead);
    CloseHandle (hPipeInputWrite);

    return 0;
}
//C:\test>test
//Microsoft Windows [版本 5.2.3790]
//(C) 版权所有 1985-2003 Microsoft Corp.
//
//C:\test>ver
//
//Microsoft Windows [版本 5.2.3790]
//
//C:\test>chcp
//活动的代码页: 936
//
//C:\test>exit
//Error #109 reading pipe.
//C:\test>

赵老师，这和您第一次发的代码好像改动挺大，有什么区别吗（这个更加复杂看不懂了）[/quote] 是CSDN网站的显示问题，尴尬，我正在调试

[WOYAOBIANDASHI]

引用 5 楼 zhao4zhong1 的回复:

再供参考：

#pragma comment(lib,"user32")
#include <stdio.h>
#include <string.h>
#include <windows.h>
int main() {
    SECURITY_ATTRIBUTES sa          = {0};
    STARTUPINFO         si          = {0};
    PROCESS_INFORMATION pi          = {0};
    HANDLE              hPipeOutputRead  = NULL;
    HANDLE              hPipeOutputWrite = NULL;
    HANDLE              hPipeInputRead   = NULL;
    HANDLE              hPipeInputWrite  = NULL;
    BOOL                bTest = 0;
    DWORD               dwNumberOfBytesRead = 0;
    DWORD               dwNumberOfBytesWrite = 0;
    CHAR                szMsg[100];
    CHAR                szBuffer[256];

    sa.nLength = sizeof(sa);
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = NULL;

    // Create pipe for standard output redirection.
    CreatePipe(&hPipeOutputRead,  // read handle
            &hPipeOutputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Create pipe for standard input redirection.
    CreatePipe(&hPipeInputRead,  // read handle
            &hPipeInputWrite, // write handle
            &sa,      // security attributes
            0      // number of bytes reserved for pipe - 0 default
            );

    // Make child process use hPipeOutputWrite as standard out,
    // and make sure it does not show on screen.
    si.cb = sizeof(si);
    si.dwFlags     = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    si.hStdInput   = hPipeInputRead;
    si.hStdOutput  = hPipeOutputWrite;
    si.hStdError   = hPipeOutputWrite;

    CreateProcess (
          NULL, "cmd.exe",
          NULL, NULL,
          TRUE, 0,
          NULL, NULL,
          &si, &pi);

    // Now that handles have been inherited, close it to be safe.
    // You don't want to read or write to them accidentally.
    CloseHandle(hPipeOutputWrite);
    CloseHandle(hPipeInputRead);

    // Now test to capture DOS application output by reading
    // hPipeOutputRead.  Could also write to DOS application
    // standard input by writing to hPipeInputWrite.
    sprintf(szMsg, "cd /d c:\\user\\lsw\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "adb forward tcp:31415 tcp:31415\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "drozer console connect\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "help\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "quit\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }

    sprintf(szMsg, "exit\n");
    WriteFile(
          hPipeInputWrite,      // handle of the write end of our pipe
          &szMsg,               // address of buffer that send data
          strlen(szMsg),        // number of bytes to write
          &dwNumberOfBytesWrite,// address of number of bytes read
          NULL                  // non-overlapped.
          );

    while(TRUE)
    {
       bTest=ReadFile(
          hPipeOutputRead,      // handle of the read end of our pipe
          &szBuffer,            // address of buffer that receives data
          256,                  // number of bytes to read
          &dwNumberOfBytesRead, // address of number of bytes read
          NULL                  // non-overlapped.
          );

      if (!bTest){
          sprintf(szMsg, "Error #%d reading pipe.",GetLastError());
          printf("%s",szMsg);
          break;
      }

      // do something with data.
      szBuffer[dwNumberOfBytesRead] = 0;  // null terminate
      printf("%s",szBuffer);
      if ('>'==szBuffer[dwNumberOfBytesRead-1]) break;
    }
    // Wait for CONSPAWN to finish.
    WaitForSingleObject (pi.hProcess, INFINITE);

    // Close all remaining handles
    CloseHandle (pi.hProcess);
    CloseHandle (hPipeOutputRead);
    CloseHandle (hPipeInputWrite);

    return 0;
}

非常感谢赵老师的回答，后面我发现直接写个脚本就可以满足我的需求，但是您的代码很好的助我理解管道，对我很有帮助，谢谢！