пытаюсь загрузить библиотеку в определенные процессы в цикле...т.е. идет цикл...в нем проверяется некое условие и если процесс удовлетворяет этому условию, то к нему подгружается библиотечка...но столкнулся с такой проблеммой к процессам кот запущены до запуска цикла библиотека подгружается нормально, а те кот запущены после запуска цикла вылетают в ошибку... что-то вроде приложение вызвала инструкцию по такому-то адресу кот обратилась к такому-то адресу память не может быть рид....кто знает в чем проблема?
сама dll:
#define WINVER 0x0500
#include "..\CmnHdr.h"
#include <WindowsX.h>
#include <tchar.h>
#include <stdio.h>
#include "APIHook.h"
#include <wininet.h>
#include "apiprot.h"
#define DT2LIBAPI extern "C" __declspec(dllexport)
#include "DT2lib.h"
///////////////////////////////////////////////////////////////////////////////
// Since we do DLL injection with Windows' hooks, we need to save the hook
// handle in a shared memory block (Windows 2000 actually doesn't need this)
#pragma data_seg("Shared")
HHOOK g_hhook = NULL;
#pragma data_seg()
#pragma comment(linker, "/Section:Shared,rws")
///////////////////////////////////////////////////////////////////////////////
static LRESULT WINAPI GetMsgProc(int code, WPARAM wParam, LPARAM lParam) {
// NOTE: On Windows 2000, the 1st parameter to CallNextHookEx can
// be NULL. On Windows 98, it must be the hook handle.
return(CallNextHookEx(g_hhook, code, wParam, lParam));
}
///////////////////////////////////////////////////////////////////////////////
// Returns the HMODULE that contains the specified memory address
static HMODULE ModuleFromAddress(PVOID pv) {
MEMORY_BASIC_INFORMATION mbi;
return((VirtualQuery(pv, &mbi, sizeof(mbi)) != 0)
? (HMODULE) mbi.AllocationBase : NULL);
}
///////////////////////////////////////////////////////////////////////////////
BOOL WINAPI DllMain(BOOL fInstall, DWORD dwThreadId) {
//BOOL WINAPI DllMain(BOOL fInstall, DWORD dwThreadId) {
BOOL fOk;
//if (fInstall) {
chASSERT(g_hhook == NULL); // Illegal to install twice in a row
// Install the Windows' hook
MessageBox(0,(LPCSTR)dwThreadId,0,0);
g_hhook = SetWindowsHookEx(WH_GETMESSAGE, GetMsgProc,
ModuleFromAddress(DllMain), dwThreadId);
fOk = (g_hhook != NULL);
/*} else {
chASSERT(g_hhook != NULL); // Can't uninstall if not installed
fOk = UnhookWindowsHookEx(g_hhook);
g_hhook = NULL;
}*/
return(fOk);
}
//////////////////////////////// End of File //////////////////////////////////
функция которая ее подгружает:
#pragma pack(push, 1)
typedef struct
{
BYTE pushopc;
DWORD pushaddr;
BYTE callopc;
DWORD calladdr;
BYTE retopc;
WORD retvalue;
TCHAR lib_path[MAX_PATH];
} forceStruct_t;
#pragma pack(pop)
BOOL Inject(DWORD ProcessID, PTCHAR szLibName)
{
forceStruct_t code;
code.pushopc = 0x68;
code.callopc = 0xE8;
code.retopc = 0xC2;
code.retvalue= 0x04;
HANDLE hProcess;
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);
if (!hProcess)
return FALSE;
#ifdef _UNICODE
DWORD lpLoadLibrary = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryW");
#else
DWORD lpLoadLibrary = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
#endif
LPVOID lpCodeStart = VirtualAllocEx(hProcess, NULL, sizeof(code),
MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (lpCodeStart == NULL)
{
return FALSE;
}
DWORD dwCodeStart = (DWORD)lpCodeStart;
// String offset
code.pushaddr = dwCodeStart + 13;
// Call address
code.calladdr = lpLoadLibrary - dwCodeStart - 10;
// Copy dll name
strcpy(code.lib_path, szLibName);
DWORD dwBytesWritten = 0;
if (!WriteProcessMemory(hProcess, lpCodeStart, &code, sizeof(code),
&dwBytesWritten))
{
VirtualFreeEx(hProcess, lpCodeStart, sizeof(code), MEM_DECOMMIT);
CloseHandle(hProcess);
return FALSE;
}
DWORD dwRemoteThreadID;
HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE)lpCodeStart, NULL, 0, &dwRemoteThreadID);
if (hRemoteThread == 0)
{
VirtualFreeEx(hProcess, lpCodeStart, sizeof(code), MEM_DECOMMIT);
CloseHandle(hProcess);
return FALSE;
}
WaitForSingleObject(hRemoteThread, INFINITE);
DWORD dwLibBase;
if (!GetExitCodeThread(hRemoteThread, &dwLibBase))
{
VirtualFreeEx(hProcess, lpCodeStart, sizeof(code), MEM_DECOMMIT);
CloseHandle(hProcess);
return FALSE;
}
VirtualFreeEx(hProcess, lpCodeStart, sizeof(code), MEM_DECOMMIT);
CloseHandle(hRemoteThread);
CloseHandle(hProcess);
return dwLibBase != 0;
}