注入DLL

using System;

using System.Collections.Generic;

using System.ComponentModel;

using System.Data;

using System.Drawing;

using System.Linq;

using System.Text;

using System.Windows.Forms;

using System.Runtime.InteropServices;

using System.Diagnostics;

namespace WindowsFormsApplication1

{

    public partial class Form1 : Form

    {

        public Form1()

        {

            InitializeComponent();

        }

        [DllImport("kernel32.dll")] //聲明API函數

        public static extern int VirtualAllocEx(IntPtr hwnd, int lpaddress, int size, int type, int tect);

        [DllImport("kernel32.dll")]

        public static extern int WriteProcessMemory(IntPtr hwnd, int baseaddress, string buffer, int nsize, int filewriten);

        public static extern int GetProcAddress(int hwnd, string lpname);

        public static extern int GetModuleHandleA(string name);

        public static extern int CreateRemoteThread(IntPtr hwnd, int attrib, int size, int address, int par, int flags, int threadid);

        private void button1_Click(object sender, EventArgs e)

            int ok1;

            //int ok2;

            //int hwnd;

            int baseaddress;

            int temp = 0;

            int hack;

            int yan;

            string dllname;

            dllname = "c:\\dll.dll";

            int dlllength;

            dlllength = dllname.Length + 1;

            Process[] pname = Process.GetProcesses(); //取得所有程序

            foreach (Process name in pname) //周遊程序

            {

                //MessageBox.Show(name.ProcessName.ToLower());

                if (name.ProcessName.ToLower().IndexOf("notepad") != -1) //所示記事本，那麼下面開始注入

                {

                    baseaddress = VirtualAllocEx(name.Handle, 0, dlllength, 4096, 4);   //申請記憶體空間

                    if (baseaddress == 0) //傳回0則操作失敗，下面都是

                    {

                        MessageBox.Show("申請記憶體空間失敗！！");

                        Application.Exit();

                    }

                    ok1 = WriteProcessMemory(name.Handle, baseaddress, dllname, dlllength, temp); //寫記憶體

                    if (ok1 == 0)

                        MessageBox.Show("寫記憶體失敗！！");

                    hack = GetProcAddress(GetModuleHandleA("Kernel32"), "LoadLibraryA"); //取得loadlibarary在kernek32.dll位址

                    if (hack == 0)

                        MessageBox.Show("無法取得函數的入口點！！");

                    yan = CreateRemoteThread(name.Handle, 0, 0, hack, baseaddress, 0, temp); //建立遠端線程。

                    if (yan == 0)

                        MessageBox.Show("建立遠端線程失敗！！");

                    else

                        MessageBox.Show("已成功注入dll!!");

                }

            }

    }

}