hidefunc.cpp

隐藏函数vc控制台代码

#include <windows.h>

typedef struct _RemotePara{
	char pMessageBox[12];
	DWORD dwMessageBox;
}RemotePara;

DWORD __stdcall ThreadProc (RemotePara *IpPara){
	typedef int(WINAPI *MMessageBoxA)(HWND,LPCTSTR,LPCTSTR,DWORD);
	MMessageBoxA myMessageBoxA;
	myMessageBoxA=(MMessageBoxA)IpPara->dwMessageBox;
	myMessageBoxA(NULL,IpPara->pMessageBox,IpPara->pMessageBox,0);
	return 0;
}
void main()
{
	const DWORD THREADSIZE=1024;
	DWORD byte_write;
	HWND hWnd=FindWindow("SciCalc","计算器");
	if(!hWnd) return;
	DWORD dwProcessId=0;
	GetWindowThreadProcessId(hWnd,&dwProcessId);
	HANDLE hRemoteProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessId);
	if(!hRemoteProcess) return;
	void *pRemoteThread=VirtualAllocEx(hRemoteProcess,0,THREADSIZE,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
	if(!pRemoteThread)return;
	if(!WriteProcessMemory(hRemoteProcess,pRemoteThread,&ThreadProc,THREADSIZE,0))return;
	RemotePara myRemotePara;
	ZeroMemory(&myRemotePara,sizeof(RemotePara));
	HINSTANCE hUser32=LoadLibrary("user32.dll");
	myRemotePara.dwMessageBox=(DWORD)
		GetProcAddress(hUser32,"MessageBoxA");
	strcat(myRemotePara.pMessageBox,"hello\0");
	RemotePara *pRemotePara=(RemotePara *) VirtualAllocEx(hRemoteProcess,0,sizeof(RemotePara),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	if(!pRemotePara) return;
	if(!WriteProcessMemory(hRemoteProcess,pRemotePara,&myRemotePara,sizeof myRemotePara,0)) return;
	HANDLE hThread=CreateRemoteThread(hRemoteProcess,0,0,(LPTHREAD_START_ROUTINE)pRemoteThread,pRemotePara,0,&byte_write);
}