微信远程注入-收发信息

【实例简介】

远程注入，截获信息，自定义发送信息。包含了dll

【实例截图】

【核心代码】

//注入DLL
BOOL InjectDLL()
{
//char cPath[100] = "F:\\Hook\\DLL\\Project1\\build\\Write_ReadDLL.dll";
//char cPath[100] = "G:\\C \\Hook\\project\\WeChatHook2019-12-27\\Project1\\build\\Write_ReadDLL.dll";

LPCSTR a = "a";
LPCWSTR b = L"a";


TCHAR cPath[MAX_PATH 1] = { 0 };
GetModuleFileName(NULL, cPath, MAX_PATH);
(_tcsrchr(cPath, _T('\\')))[1] = 0; // 删除文件名，只获得路径字串
//CString str_url = szFilePath;  // 例如str_url==e:\program\Debug
sprintf_s(cPath, "%s\\%s", cPath, "Write_ReadDLL.dll");
DWORD spid = GetSpid(WECHAT_NAME);
if (spid == -1)
{
MessageBox(NULL, "没有找到微信的进程ID，请先打开微信", "Error", 0);
return FALSE;
}
//打开微信进程
HANDLE wechatProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, spid);
if (wechatProcess == 0)
{
MessageBox(NULL, "无法打开进程", "Error", 0);
return FALSE;
}

//申请内存
LPVOID dllAddress = VirtualAllocEx(wechatProcess, NULL, strlen(cPath), MEM_COMMIT, PAGE_READWRITE);

if (dllAddress == NULL)
{
MessageBox(NULL, "内存申请失败", "Error", 0);
return FALSE;
}

//写入dll路径到这个地址
BOOL suc = WriteProcessMemory(wechatProcess, dllAddress, cPath, strlen(cPath), NULL);
if (!suc)
{
MessageBox(NULL, "路径写入失败", "Error", 0);
return FALSE;
}

char resultAddress[100] = { 0 };
sprintf_s(resultAddress, "写入地址为：%p", dllAddress);
OutputDebugString(resultAddress);

HMODULE kernelModule = GetModuleHandle("Kernel32");
if (kernelModule == NULL)
{
MessageBox(NULL, "获取不到模块句柄 Kernel32.dll ", "Error", 0);
return FALSE;
}
LPVOID loadAddress = GetProcAddress(kernelModule, "LoadLibraryA");

//远程注入 在其他进程中创建线程
HANDLE rThread = CreateRemoteThread(wechatProcess, NULL, 0, (LPTHREAD_START_ROUTINE)loadAddress, dllAddress, 0, NULL);
if (rThread == NULL)
{
MessageBox(NULL, "远程注入失败 ", "Error", 0);
return FALSE;
}


if (!rThread) {
MessageBox(NULL, "Thread opening failed, no injection ", "Error", 0);

return FALSE;
}

if (WaitForSingleObject(rThread, INFINITE)) {
MessageBox(NULL, "Thread never returned, no injection ", "Error", 0);

return FALSE;
}
DWORD rDLL;

if (!GetExitCodeThread(rThread, &rDLL)) {
MessageBox(NULL, "Couldn't get return value", "Error", 0);

return FALSE;
}

if (rDLL == 0x0) {
DWORD err = GetLastError();
MessageBox(NULL, "Injection failed, CreateThread returned 0 ", "Error", 0);


system("pause");
return FALSE;
}

CloseHandle(rThread);
VirtualFreeEx(wechatProcess, dllAddress, 0, MEM_RELEASE);
CloseHandle(wechatProcess);


return TRUE;
}