C#x64内存注入咋写

MCGYA

求一个C#x64内存注入例子

HAO641019045

看着不错

yinxixi

66666666666666666666666666666666666666

木木的树

支持开源~！感谢分享

Kendall

Kendall 发表于 2022-8-24 12:55
[mw_shl_code=csharp,true]using System;
using System.Runtime.InteropServices;
using System.Text;

可注入x64进程

Kendall

[C#] 纯文本查看 复制代码

using System;
using System.Runtime.InteropServices;
using System.Text;

namespace PatchApp
{
    internal class ProcessShapr_fix
    {
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int
        processId);
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint
        dwSize, uint flAllocationType, uint flProtect);
        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress,
        byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten);
        [DllImport("kernel32.dll")]
        static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr
        lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint
        dwCreationFlags, IntPtr lpThreadId);
        [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true,
        SetLastError = true)]
        static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern IntPtr GetModuleHandle(string lpModuleName);
        public void InjectDLL(int PcoessID, string DllPath)
        {
            String dir =
            Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments);
            String dllName = DllPath;
            int pid = PcoessID;
            IntPtr hProcess = OpenProcess(0x001F0FFF, false, pid);
            IntPtr addr = VirtualAllocEx(hProcess, IntPtr.Zero, 0x1000, 0x3000, 0x40);
            IntPtr outSize;
            Boolean res = WriteProcessMemory(hProcess, addr,
            Encoding.Default.GetBytes(dllName), dllName.Length, out outSize);
            IntPtr loadLib = GetProcAddress(GetModuleHandle("kernel32.dll"),
            "LoadLibraryA");
            IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, loadLib,
            addr, 0, IntPtr.Zero);
        }
    }
}

爱编程的小作家

有e的内存注入x64

737820030

用大漠就可以