远程注入代码，编译没有错误

但是执行的时候弹出内存不能为read的错误

错误在目标进程弹出的，错误地址是目标进程里申请好的远程线程函数

代码看了两天了还是找不到错误在哪，头很痛

求大佬帮忙看看错在哪里了，谢谢大佬了

include "pch.h" //进程通信

include <iostream>

include <stdlib.h>

include <windows.h>

include <string.h>

include <Tlhelp32.h>

typedef struct gCreateFile {

LPVOID CreateFileAPIAddr;

LPCTSTR lpFileName;

DWORD dwDesiredAccess;

DWORD dwShareMode;

LPSECURITY_ATTRIBUTES lpSecurityAttributes;

DWORD dwCreationDisposition;

DWORD dwFlagsAndAttributes;

HANDLE hTemplateFile;

}GCREATEFILE; //结构体，Create File需要的一些参数

//声明函数指针，模仿CreateFile函数

typedef HANDLE (WINAPI * PCREATEFILE)(LPCTSTR lpFileName,

DWORD dwDesiredAccess,

DWORD dwShareMode,

LPSECURITY_ATTRIBUTES lpSecurityAttributes,

DWORD dwCreationDisposition,

DWORD dwFlagsAndAttributes,

HANDLE hTemplateFile);

DWORD __stdcall ThreadProc(LPVOID lpParameter) //线程函数，用来远程注入

{

printf("++++\n"); //表示远程线程启动

GCREATEFILE* gCreateFile = (GCREATEFILE*)lpParameter;

PCREATEFILE pCreateFile;//声明函数指针类型的变量

pCreateFile = (PCREATEFILE)gCreateFile->CreateFileAPIAddr; //为函数指针变量赋予CreateFile函数的地址

pCreateFile(gCreateFile->lpFileName, //开始执行函数

gCreateFile->dwDesiredAccess,

gCreateFile->dwShareMode,

gCreateFile->lpSecurityAttributes,

gCreateFile->dwCreationDisposition,

gCreateFile->dwFlagsAndAttributes,

gCreateFile->hTemplateFile);

printf("****\n"); //远程线程运行完成

return 0;

}

PROCESSENTRY32 p32 = { 0 };

HANDLE hProcess = NULL; //进程的句柄

using namespace std;

HANDLE handles()

{

HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); //快照

p32.dwSize = sizeof(p32);

Process32First(hSnap, &p32);

do {

if (strcmp(p32.szExeFile, "TEST2.exe") == 0)

{

cout << "遍历成功" << endl;

CloseHandle(hSnap);

hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, p32.th32ProcessID);

return hProcess;

}

} while (Process32Next(hSnap, &p32));

cout << "遍历失败" << endl;

return NULL;

}

using namespace std;

void main()

{

DWORD dwFunAddr; //CreateFile函数地址

DWORD LenghOfFun = 0x78; //线程函数大小

GCREATEFILE gCreateFile; //结构体变量

HMODULE hModule;

LPVOID dwLocation_FileName; //申请的文件路径地址

LPVOID dwLocation_Fun; //申请的函数地址

LPVOID dwLocation_Struct; //申请的结构体地址

char* FileName = (char*)"E://FileTest//A.txt"; //创建文件的路径

handles(); //遍历进程

if (hProcess == NULL)

{

printf("Error hProcess %d\n",GetLastError());

return;

}

//初始化结构体

gCreateFile.dwDesiredAccess = GENERIC_READ | GENERIC_WRITE;

gCreateFile.dwShareMode = 0;

gCreateFile.lpSecurityAttributes = NULL;

gCreateFile.dwCreationDisposition = OPEN_ALWAYS;

gCreateFile.dwFlagsAndAttributes = FILE_ATTRIBUTE_NORMAL;

gCreateFile.hTemplateFile = NULL;

//远程申请空间 来存储文件名，函数，结构体参数

dwLocation_FileName = VirtualAllocEx(hProcess, NULL, strlen(FileName)+1, MEM_COMMIT, PAGE_READWRITE);//文件路径

dwLocation_Fun = VirtualAllocEx(hProcess, NULL, LenghOfFun, MEM_COMMIT, PAGE_READWRITE);//函数

dwLocation_Struct = VirtualAllocEx(hProcess, NULL, sizeof(GCREATEFILE), MEM_COMMIT, PAGE_READWRITE);//结构体

if (!dwLocation_FileName || !dwLocation_Fun || !dwLocation_Struct)

{

printf("Error VirtualAllocEx %d\n", GetLastError());

return;

}

//获取CreateFile函数地址

hModule = LoadLibrary("kernel32.dll");

gCreateFile.CreateFileAPIAddr = (LPVOID)GetProcAddress(hModule, "CreateFileA");

if (!gCreateFile.CreateFileAPIAddr) printf("Error GetProcAddress %d\n",GetLastError());

gCreateFile.lpFileName = (LPCTSTR)dwLocation_FileName; //初始化CreateFile文件名

//修改线程函数起始地址

dwFunAddr = (DWORD)ThreadProc; //得到函数的起始地址

if ((BYTE)dwFunAddr == 0xE9)

{

dwFunAddr = dwFunAddr + 5 + (DWORD)(dwFunAddr + 1);

}

//开始复制

//写入结构体

BOOL bRet = WriteProcessMemory( //写入数据到指定进程的内存中

hProcess, //进程句柄

dwLocation_Struct, //指定进程内存中的指定位置

&gCreateFile, //需要写入的数据 ←LPCVOID == const void*(常量void类型指针)

sizeof(GCREATEFILE), //写多少，需要写入的长度

NULL); //填NULL就好

//写入函数

BOOL bRet2 = WriteProcessMemory( //写入数据到指定进程的内存中

hProcess, //进程句柄

dwLocation_Fun, //指定进程内存中的指定位置

ThreadProc, //需要写入的数据 ←LPCVOID == const void*(常量void类型指针)

LenghOfFun, //写多少，需要写入的长度

NULL); //填NULL就好

//写入路径

BOOL bRet3 = WriteProcessMemory( //写入数据到指定进程的内存中

hProcess, //进程句柄

dwLocation_FileName, //指定进程内存中的指定位置

FileName, //需要写入的数据 ←LPCVOID == const void*(常量void类型指针)

sizeof(GCREATEFILE), //写多少，需要写入的长度

NULL); //填NULL就好

if (!bRet2)

{

printf("Error WriteProcess %d\n", GetLastError());

return;

}

if (!bRet || !bRet2 || !bRet3)

{

printf("Error WriteProcess %d\n",GetLastError());

return;

}

//开始执行

HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)dwLocation_Fun, dwLocation_Struct, 0, NULL);

if (!hThread)

{

printf("Error CreateRemoteThread %d\n", GetLastError());

return;

}

CloseHandle(hThread);

fflush(stdin);

getchar();

return;

}