gusucode.com > VC++ 实现在其它程序窗口上创建按钮并控制-源码程序 > VC++ 实现在其它程序窗口上创建按钮并控制-源码程序\code\Rt_Ctrl\main.cpp

    //Download by http://www.NewXing.com
//注入程序代码
#include "main.h"

BOOL WINAPI DllMain(HANDLE hInstance, ULONG Command, LPVOID Reserved)
{
	return TRUE;
}

#pragma check_stack(off)
static DWORD WINAPI RemoteControlThread(LPVOID lpvoid)
{
	try{
		LPINJECT_DLL lpInject = (LPINJECT_DLL)lpvoid;

		if (!lpInject){
			return 0xffffffff;
		}
		
		HMODULE hMod	= lpInject->prcLoadLib(lpInject->szLibPath);
		if (!hMod){
			return 0xfffffffe;
		}
	
//		#ifdef _UNICODE
//			LPINIT_BTN	Init_Btn = (LPINIT_BTN)lpInject->prcGetProcAddr(hMod, TEXT("RC_InitBtnW"));
//		#else
			LPINIT_BTN	Init_Btn = (LPINIT_BTN)lpInject->prcGetProcAddr(hMod, MAKEINTRESOURCE(1));//TEXT("RC_InitBtnA"));
//		#endif

		if (!Init_Btn){
			lpInject->prcFreeLib(hMod);
			return 0xfffffffd;
		}
		

		if (!Init_Btn(lpInject->dwIDBtn, lpInject->szCaptionBtn, lpInject->rtBtn, lpInject->hWnd)){
			lpInject->prcFreeLib(hMod);
			return 0xfffffffc;
		}
		
/*		while (TRUE){
			TCHAR szName[128];

			wsprintf(szName, TEXT("%08d_%s_zy"), lpInject->hWnd, lpInject->szCaptionBtn);

			HANDLE hMutex = z_OpenMutex(MUTEX_ALL_ACCESS, FALSE, szName);
			if (hMutex){
				CloseHandle(hMutex);
				lpInject->prcFreeLib(hMod);
				lpInject->prcFreeLib(hKernel32);
				return 0;
			}
			Sleep(1000);
		}
*/
			lpInject->prcFreeLib(hMod);
//				lpInject->prcFreeLib(hKernel32);
//				return 0;
	}
	catch (...){
		return 0xfffffffb;
	}
	return 0;
}
#pragma check_stack

BOOL InjectDLL_Info(LPINJECT_DLL lpInject, LPCSTR lpszLibFile, HWND hWnd, DWORD dwID, LPRECT pRtBtn, LPCTSTR szCaptionBtn)
{
	try	{
		HMODULE hMod = ::GetModuleHandle(TEXT("kernel32"));
		#ifdef _UNICODE
			lpInject->prcLoadLib = (LPLOADLIBRARY)::GetProcAddress(hMod,TEXT("LoadLibraryW"));
		#else
			lpInject->prcLoadLib = (LPLOADLIBRARY)::GetProcAddress(hMod,TEXT("LoadLibraryA"));
		#endif

		lpInject->prcFreeLib = (LPFREELIBRARY)::GetProcAddress(hMod,TEXT("FreeLibrary"));
		lpInject->prcGetProcAddr = (LPGETPROCADDRESS)::GetProcAddress(hMod,TEXT("GetProcAddress"));

		strcpy(lpInject->szLibPath,lpszLibFile);
		lpInject->dwIDBtn = dwID;
		lpInject->hWnd = hWnd;
		memcpy(&lpInject->rtBtn, pRtBtn, sizeof(RECT));
		strcpy(lpInject->szCaptionBtn, szCaptionBtn);
	}
	catch (...){
		return FALSE;
	}
	return TRUE;
}

BOOL WINAPI RT_CTRL_BTN(LPCSTR lpszLibFile, HWND hWnd, DWORD dwID, LPRECT pRtBtn, LPCTSTR szCaptionBtn)
{
	try {
		DWORD dwProcessID;
		GetWindowThreadProcessId(hWnd, &dwProcessID);
		HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION |
				PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessID );
		if (!hProcess){
			return FALSE;
		}

		INJECT_DLL InjectInfo;
		InjectDLL_Info(&InjectInfo, lpszLibFile, hWnd, dwID, pRtBtn, szCaptionBtn);

		LPBYTE lpThreadAddr=(LPBYTE)::VirtualAllocEx(hProcess, NULL, MAXINJECTSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

		LPINJECT_DLL param = (LPINJECT_DLL) VirtualAllocEx( hProcess, 0, sizeof(INJECT_DLL), MEM_COMMIT, PAGE_READWRITE );

		WriteProcessMemory(hProcess, lpThreadAddr,&RemoteControlThread,	MAXINJECTSIZE, 0);
		WriteProcessMemory( hProcess, param, &InjectInfo, sizeof(InjectInfo), 0 );

		DWORD dwThreadId;
		HANDLE hThread = ::CreateRemoteThread(hProcess,NULL,0,
			(unsigned long (__stdcall *)(void *))lpThreadAddr,
			param, 0, &dwThreadId);


		if (!hThread){
			CloseHandle(hProcess);
			VirtualFreeEx( hProcess, lpThreadAddr, 0, MEM_RELEASE );
			VirtualFreeEx( hProcess, param, 0, MEM_RELEASE );
			return FALSE;
		}
		else {
			CloseHandle(hThread);
			CloseHandle(hProcess);
			VirtualFreeEx( hProcess, lpThreadAddr, 0, MEM_RELEASE );
			VirtualFreeEx( hProcess, param, 0, MEM_RELEASE );
		}
	
	}
	catch (...){
		return FALSE;
	}
	return TRUE;
}