{"id":83,"date":"2025-07-03T16:04:56","date_gmt":"2025-07-03T08:04:56","guid":{"rendered":"https:\/\/www.taotao01.fun\/?p=83"},"modified":"2025-07-03T16:04:56","modified_gmt":"2025-07-03T08:04:56","slug":"dll-injection-for-notepad","status":"publish","type":"post","link":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/2025\/07\/03\/dll-injection-for-notepad\/","title":{"rendered":"DLL Injection for Notepad"},"content":{"rendered":"\n<p>\u5148\u505a\u4e2a\u6ce8\u5165\u5668<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ Injector.cpp\n#include &lt;windows.h&gt;\n#include &lt;tlhelp32.h&gt;\n#include &lt;tchar.h&gt;\n#include &lt;iostream&gt;\n\nBOOL InjectDLL(DWORD dwPID, const wchar_t* dllPath)\n{\n    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);\n    if (!hProcess) {\n        std::wcout &lt;&lt; L\"\u6253\u5f00\u8fdb\u7a0b\u5931\u8d25\" &lt;&lt; std::endl;\n        return FALSE;\n    }\n\n    LPVOID pRemoteBuf = VirtualAllocEx(hProcess, NULL, (wcslen(dllPath) + 1) * sizeof(wchar_t),\n        MEM_COMMIT, PAGE_READWRITE);\n    if (!pRemoteBuf) {\n        CloseHandle(hProcess);\n        return FALSE;\n    }\n\n    WriteProcessMemory(hProcess, pRemoteBuf, dllPath,\n        (wcslen(dllPath) + 1) * sizeof(wchar_t), NULL);\n\n    HMODULE hKernel32 = GetModuleHandle(L\"kernel32.dll\");\n    LPTHREAD_START_ROUTINE pLoadLibraryW =\n        (LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32, \"LoadLibraryW\");\n\n    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,\n        pLoadLibraryW, pRemoteBuf, 0, NULL);\n\n    WaitForSingleObject(hThread, INFINITE);\n\n    VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE);\n    CloseHandle(hThread);\n    CloseHandle(hProcess);\n\n    return TRUE;\n}\n\nint wmain(int argc, wchar_t* argv&#91;])\n{\n    if (argc &lt; 3) {\n        std::wcout &lt;&lt; L\"\u7528\u6cd5: Injector.exe &lt;PID&gt; &lt;DLL\u8def\u5f84&gt;\" &lt;&lt; std::endl;\n        return -1;\n    }\n\n    DWORD pid = _wtoi(argv&#91;1]);\n    const wchar_t* dllPath = argv&#91;2];\n\n    if (InjectDLL(pid, dllPath)) {\n        std::wcout &lt;&lt; L\"\u6ce8\u5165\u6210\u529f\uff01\" &lt;&lt; std::endl;\n    }\n    else {\n        std::wcout &lt;&lt; L\"\u6ce8\u5165\u5931\u8d25\u3002\" &lt;&lt; std::endl;\n    }\n\n    return 0;\n}\n<\/code><\/pre>\n\n\n\n<p>\u518d\u6765\u4e2a\u6d4b\u8bd5\u7684DLL<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#include &lt;windows.h&gt;\n#include &lt;tchar.h&gt;\n\nDWORD WINAPI InjectThread(LPVOID)\n{\n    Sleep(1000); \/\/ \u7b49\u5f85\u7a97\u53e3\u521d\u59cb\u5316\n\n    DWORD myPID = GetCurrentProcessId();\n\n    HWND hwnd = GetTopWindow(NULL);\n    while (hwnd)\n    {\n        DWORD pid = 0;\n        GetWindowThreadProcessId(hwnd, &amp;pid);\n        if (pid == myPID)\n        {\n            \/\/ \u627e\u5b50\u7a97\u53e3\uff1aEdit \u63a7\u4ef6\n            HWND hEdit = FindWindowEx(hwnd, NULL, L\"Edit\", NULL);\n            if (hEdit)\n            {\n                const wchar_t* text = L\"Hello from Injected DLL!\\r\\n\";\n                SendMessage(hEdit, WM_SETTEXT, 0, (LPARAM)text);\n                return 0;\n            }\n        }\n        hwnd = GetNextWindow(hwnd, GW_HWNDNEXT);\n    }\n\n    MessageBox(NULL, L\"\u274c \u627e\u4e0d\u5230 Notepad \u7f16\u8f91\u6846\", L\"DLL \u6ce8\u5165\u5931\u8d25\", MB_OK);\n    return 0;\n}\n\nBOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)\n{\n    if (ul_reason_for_call == DLL_PROCESS_ATTACH)\n    {\n        DisableThreadLibraryCalls(hModule); \/\/ \u907f\u514d\u989d\u5916 DLL_THREAD_ATTACH \u56de\u8c03\n        CreateThread(NULL, 0, InjectThread, NULL, 0, NULL); \/\/ \u2705 \u5728\u65b0\u7ebf\u7a0b\u4e2d\u6267\u884c\u903b\u8f91\n    }\n    return TRUE;\n}\n<\/code><\/pre>\n\n\n\n<p>\u627e\u5b50\u7a97\u53e3 \u67e5\u770b\u63a7\u4ef6\u7c7b \u7528Visual Studio 2022\u7684Tool => spy++  show window \u62d6\u52a8 \u72d9\u51fb\u955c \u5230notepad window <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\"   class=\"lazyload\" data-src=\"https:\/\/www.taotao01.fun\/wordpress\/wp-content\/uploads\/2025\/07\/image-3.png\" src=\"https:\/\/cdn.jsdelivr.net\/gh\/moezx\/cdn@3.0.2\/img\/svg\/loader\/trans.ajax-spinner-preloader.svg\" onerror=\"imgError(this)\"  alt=\"\" class=\"wp-image-89\"\/><\/figure >\n<noscript><img decoding=\"async\" src=\"https:\/\/www.taotao01.fun\/wordpress\/wp-content\/uploads\/2025\/07\/image-3.png\" alt=\"\" class=\"wp-image-89\"\/><\/figure><\/noscript>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5148\u505a\u4e2a\u6ce8\u5165\u5668 \u518d\u6765\u4e2a\u6d4b\u8bd5\u7684DLL \u627e\u5b50\u7a97\u53e3 \u67e5\u770b\u63a7\u4ef6\u7c7b \u7528Visual Studio 2022\u7684Tool => spy++ sho &#8230;<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-83","post","type-post","status-publish","format-standard","hentry","category-haware"],"_links":{"self":[{"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/83","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/comments?post=83"}],"version-history":[{"count":0,"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/83\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/media?parent=83"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/categories?post=83"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.taotao01.fun\/wordpress\/index.php\/wp-json\/wp\/v2\/tags?post=83"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}