#include <Windows.h>

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:    
        MessageBox(NULL, TEXT("DLL_PROCESS_ATTACH"), TEXT("成功了"), NULL);
        break;
    case DLL_THREAD_ATTACH:
		MessageBox(NULL, TEXT("DLL_THREAD_ATTACH"), TEXT("成功了"), NULL);
		break;
    case DLL_THREAD_DETACH:
		MessageBox(NULL, TEXT("DLL_THREAD_DETACH"), TEXT("成功了"), NULL);
		break;
    case DLL_PROCESS_DETACH:
		MessageBox(NULL, TEXT("DLL_PROCESS_DETACH"), TEXT("成功了"), NULL);
        break;
    }
    return TRUE;
}

#include <Windows.h>
#include <stdio.h>

//根据进程ID获取进程句柄
HANDLE GetProcessHandle(DWORD deProcessID)
{
    HANDLE hProcess = OpenProcess(
        PROCESS_QUERY_INFORMATION  //查询进程句柄
        | PROCESS_VM_OPERATION     //PROCESS_VM_WRITE + PROCESS_VM_READ + x 
        | PROCESS_CREATE_THREAD    //创建线程
        | PROCESS_VM_WRITE,        //WriteProcessMemory
        FALSE,                     //不继承
        deProcessID                //进程句柄
        ); 

    return hProcess;
}

int main(int argc, TCHAR * argv[])
{
    DWORD dwErrCode = 0;


	// 进程PID
    DWORD dwProcessID = 1712;
    
    HANDLE hDestProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessID);
    if(NULL == hDestProcess) 
    {
        printf("open process error \n");
        return 0;
    }


    //获取KERNER32.DLL 模块句柄
    HMODULE hModule = GetModuleHandle(TEXT("kernel32.dll")); 
    if(NULL == hModule) 
    {
        printf("kernel32.dll \n");
        return -1;
    }

    //线程函数，kernerl32.dll被映射到所有进程内相同的地址
    LPTHREAD_START_ROUTINE lpThreadStartRoutine = 
                         (LPTHREAD_START_ROUTINE)GetProcAddress(hModule, "LoadLibraryW");

    if(NULL == lpThreadStartRoutine) 
    {
		printf("LoadLibraryW Error \n");
       
        return -2; 
    }

    //从目标进程内申请堆内存
    LPVOID lpMemory = VirtualAllocEx(
                     hDestProcess, NULL, MAX_PATH, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);  
    if(NULL == lpMemory) 
    {
		printf("VirtualAllocEx Error\n");
        return -3;
    }

    //注入DLL
    LPCTSTR lpDLLName = TEXT("C:\\Users\\Rvn0xsy\\Project1.dll");

    //把DLL名字写入目标进程
    BOOL bWriteMemory = WriteProcessMemory(
        hDestProcess, lpMemory, lpDLLName, (lstrlenW(lpDLLName) + 1) * sizeof(lpDLLName[0]), NULL);
	//wprintf((LPWSTR)lpMemory);
    if(FALSE == bWriteMemory) 
    {
       
		printf("WriteProcessMemory Error \n");
        dwErrCode = GetLastError();
        VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT);
        return -4;
    }
 

    //创建远程线程
    HANDLE hThread = CreateRemoteThread(
        hDestProcess, 
        NULL,
        0,
        lpThreadStartRoutine,
        lpMemory,
        0,
        NULL);
    if (NULL == hThread || INVALID_HANDLE_VALUE == hThread)
    {
		printf("CreateRomoteThread Error %d \n",GetLastError());
        VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT);
        return -5;
    }



    VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT);  

    return 0;
}