C++ dll注入外挂写法，炫彩IDE参考适用

xuig_123

// 你的DLL主要代码入口点
extern "C" __declspec(dllexport) void InjectedFunction() {
    // 这里写入你想在目标进程执行的代码
    MessageBox(NULL, L"DLL Injected!", L"Injected", MB_OK);
}




//以下是你的------外挂部分 (Injector.cpp)



#include <Windows.h>
#include <TlHelp32.h>
#include <iostream>

DWORD FindProcessId(const wchar_t* processName) {
    DWORD processId = 0;
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 structure;
    structure.dwSize = sizeof(PROCESSENTRY32);

    if (Process32First(snapshot, &structure)) {
        do {
            if (!wcscmp(structure.szExeFile, processName)) {
                processId = structure.th32ProcessID;
                break;
            }
        } while (Process32Next(snapshot, &structure));
    }

    CloseHandle(snapshot);
    return processId;
}

BOOL InjectDLL(DWORD processId, const wchar_t* dllPath) {
    HANDLE processHandle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, processId);
    if (processHandle == NULL) {
        return FALSE;
    }

    LPVOID remoteBuf = VirtualAllocEx(processHandle, NULL, wcslen(dllPath) * 2 + 1, MEM_COMMIT, PAGE_READWRITE);
    if (remoteBuf == NULL) {
        CloseHandle(processHandle);
        return FALSE;
    }

    if (WriteProcessMemory(processHandle, remoteBuf, (LPVOID)dllPath, wcslen(dllPath) * 2 + 2, NULL) == 0) {
        VirtualFreeEx(processHandle, remoteBuf, 0, MEM_RELEASE);
        CloseHandle(processHandle);
        return FALSE;
    }

    HMODULE moduleHandle = GetModuleHandleW(L"kernel32.dll");
    PTHREAD_START_ROUTINE threadFunc = (PTHREAD_START_ROUTINE)GetProcAddress(moduleHandle, "LoadLibraryW");

    HANDLE hThread = CreateRemoteThread(processHandle, NULL, 0, threadFunc, remoteBuf, 0, NULL);
    if (hThread == NULL) {
        VirtualFreeEx(processHandle, remoteBuf, 0, MEM_RELEASE);
        CloseHandle(processHandle);
        return FALSE;
    }

    WaitForSingleObject(hThread, INFINITE);
    CloseHandle(hThread);
    VirtualFreeEx(processHandle, remoteBuf, 0, MEM_RELEASE);
    CloseHandle(processHandle);
    return TRUE;
}

int main() {
    DWORD processId = FindProcessId(L"notepad.exe"); // 目标进程名
    if (processId == 0) {
        std::cout << "Process not found!" << std::endl;
        return 1;
    }

    wchar_t dllPath[MAX_PATH];
    GetCurrentDirectoryW(MAX_PATH, dllPath);
    wcscat_s(dllPath, L"\\InjectDLL.dll"); // 假设DLL已经生成在程序目录

    if (InjectDLL(processId, dllPath)) {
        std::cout << "DLL Injected Successfully!" << std::endl;
    } else {
        std::cout << "