#include <Windows.h>
#include <tlhelp32.h>
#include "resource.h"

BOOL CALLBACK _ProcWinMain(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow)
{
	MSG		stMsg;
	HWND	hWinMain;
	hWinMain = CreateDialogParam(hInstance, MAKEINTRESOURCE(IDD_DIALOG1),NULL, _ProcWinMain, NULL);
	while(1)
	{
		if(0 == GetMessage(&stMsg, NULL,0,0))
			break;
		TranslateMessage(&stMsg);
		DispatchMessage(&stMsg);
	}
	return stMsg.wParam;

}

BOOL _stdcall _RemoteThread(HWND hDlg)
{

	HANDLE hSnapShot;
	TCHAR szExeName[256] = {0};
	TCHAR szDllName[256] = {0};
	PROCESSENTRY32	stProcess;
	RtlZeroMemory(&stProcess, sizeof(stProcess));
	stProcess.dwSize = sizeof(stProcess);
	WIN32_FIND_DATA stFindFile;
	HANDLE	hFile;
	HANDLE	hProcess;
	LPVOID	lpDllName;
	LPTHREAD_START_ROUTINE lpProcLoadLibrary;
	int	   dwPID;

	GetDlgItemText(hDlg, IDC_EDIT1, szExeName, sizeof(szExeName));
	
	hSnapShot		= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);			//建立进程列表快照
	if(Process32First(hSnapShot, &stProcess))
	{
		while(1)
		{
			if(wcscmp(szExeName, stProcess.szExeFile) == 0)							//如过遍历到的进程的可执行文件名称和我们输入的一样
			{

				GetDlgItemText(hDlg, IDC_EDIT2, szDllName, sizeof(szDllName));
				hFile			= FindFirstFile(szDllName, &stFindFile);			//在当前路径搜索DLL文件
				if(hFile != INVALID_HANDLE_VALUE)						
				{
							FindClose(hFile);
							//打开目标进程并获得权限
							hProcess	= OpenProcess(PROCESS_ALL_ACCESS, FALSE, stProcess.th32ProcessID);
							//在目标进程地址空间中申请内存
							lpDllName	= VirtualAllocEx(hProcess, NULL, wcslen(szDllName) + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
							if(GetLastError() != 0)
							{
								MessageBox(NULL, TEXT("申请内存错误！"), NULL, MB_OK | MB_ICONEXCLAMATION);
								CloseHandle(hProcess);
								return FALSE;
							}
							//向目标地址空间申请的内存处写入数据
							char a[256] ={0};			//把宽字符变成窄字符
							for(int i = 0;;i++)
							{
								if(szDllName[i] == 0)
									break;
								a[i] = szDllName[i];
							}
							int u =  WriteProcessMemory(hProcess, lpDllName, a, strlen(a) + 1, NULL);
							if(GetLastError() != 0)
							{
								MessageBox(NULL, TEXT("写入进程错误！"), NULL, MB_OK | MB_ICONEXCLAMATION);
								CloseHandle(hProcess);
								return FALSE;
							}
							//获得LoadLibraryW函数的地址
							lpProcLoadLibrary = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryA");
							if(GetLastError() != 0)
							{
								MessageBox(NULL, TEXT("获得LoadLibraryA地址错误！"), NULL, MB_OK | MB_ICONEXCLAMATION);
								CloseHandle(hProcess);
								return FALSE;
							}
							//创建远程线程
							HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, lpProcLoadLibrary, lpDllName, 0, NULL);
							if(GetLastError() != 0)
							{
								MessageBox(NULL, TEXT("创建远程线程错误！"), NULL, MB_OK | MB_ICONEXCLAMATION);
								CloseHandle(hProcess);
								return FALSE;
							}
							WaitForSingleObject(hThread, INFINITE);						//如果远程线程创建成功，则等线程结束后关闭线程
							CloseHandle(hThread);
							CloseHandle(hProcess);
							return TRUE;		
				}
				else
				{
					MessageBox(NULL, TEXT("没用找到DLL文件！"), NULL, MB_OK | MB_ICONEXCLAMATION);
					return FALSE;
				}
				
			}
			if(Process32Next(hSnapShot, &stProcess) == FALSE)
			{
				MessageBox(NULL, TEXT("没有找到目标进程！"), NULL, MB_OK | MB_ICONEXCLAMATION);
				CloseHandle(hSnapShot);
				return FALSE;
			}
		}
	}
}


BOOL CALLBACK _ProcWinMain(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
	HICON	hIcon;
	switch(message)
	{
	
	case WM_COMMAND:
		switch(short int(wParam))
		{
		case IDCANCEL:
			SendMessage(hDlg, WM_CLOSE, NULL, NULL);
			break;
		case IDOK:
			if(TRUE == _RemoteThread(hDlg))
				MessageBox(NULL, TEXT("成功注入DLL！"), TEXT("ReDll"), MB_OK | MB_ICONEXCLAMATION);
			break;
		}
		break;
	case WM_CLOSE:
		DestroyWindow(hDlg);
		break;
	case WM_DESTROY:
		PostQuitMessage(NULL);
		break;
	case WM_INITDIALOG:
		hIcon	= LoadIcon(GetModuleHandle(NULL), MAKEINTRESOURCE(IDI_ICON1));
		SendMessage(hDlg, WM_SETICON, ICON_BIG, LPARAM(hIcon));
		break;
	default:
		return FALSE;

	}
	return TRUE;

}