获取目标程序的HMODULE

要获取目标程序的 HMODULE，可以使用 Win32 API 函数 LoadLibrary 或 GetModuleHandle。其中，LoadLibrary 函数可以用来加载一个动态链接库（DLL），并返回该 DLL 的 HMODULE；而 GetModuleHandle 函数可以用来获取一个已经加载的 DLL 的 HMODULE，或者获取当前进程中某个模块的 HMODULE。如果需要获取当前进程的 HMODULE，则可以使用 GetModuleHandle(NULL)。需要注意的是，HMODULE 不同于进程的句柄（HANDLE），它只是一个标识符，用来标识一个已经加载的 DLL 或者进程中的某个模块。

相关问题

写一个DLL注入监控目标程序TCP通信的程序

以下是一个简单的DLL注入程序，可以监控目标程序的TCP通信：

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <tchar.h>
#include <tlhelp32.h>
#include <winsock2.h>

#define DLL_PATH _T("path_to_your_dll")
#define TARGET_PROCESS _T("target_process.exe")

BOOL InjectDll(DWORD pid, LPCTSTR dllPath);
BOOL IsProcessRunning(LPCTSTR processName);
void MonitorTcpTraffic();

int _tmain(int argc, _TCHAR* argv[])
{
    // 检查目标进程是否正在运行
    if (!IsProcessRunning(TARGET_PROCESS))
    {
        printf("Target process is not running.\n");
        return 1;
    }

    // 获取目标进程ID
    DWORD pid = 0;
    PROCESSENTRY32 pe32 = { 0 };
    pe32.dwSize = sizeof(PROCESSENTRY32);
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot != INVALID_HANDLE_VALUE)
    {
        if (Process32First(hSnapshot, &pe32))
        {
            do
            {
                if (_tcscmp(pe32.szExeFile, TARGET_PROCESS) == 0)
                {
                    pid = pe32.th32ProcessID;
                    break;
                }
            } while (Process32Next(hSnapshot, &pe32));
        }
        CloseHandle(hSnapshot);
    }

    if (pid == 0)
    {
        printf("Failed to get target process ID.\n");
        return 1;
    }

    // 注入DLL
    if (!InjectDll(pid, DLL_PATH))
    {
        printf("Failed to inject DLL.\n");
        return 1;
    }

    // 监控TCP通信
    MonitorTcpTraffic();

    return 0;
}

BOOL InjectDll(DWORD pid, LPCTSTR dllPath)
{
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (hProcess == NULL)
    {
        printf("Failed to open target process.\n");
        return FALSE;
    }

    LPVOID pRemoteBuf = VirtualAllocEx(hProcess, NULL, (_tcslen(dllPath) + 1) * sizeof(TCHAR), MEM_COMMIT, PAGE_READWRITE);
    if (pRemoteBuf == NULL)
    {
        printf("Failed to allocate memory in target process.\n");
        CloseHandle(hProcess);
        return FALSE;
    }

    if (!WriteProcessMemory(hProcess, pRemoteBuf, (LPVOID)dllPath, (_tcslen(dllPath) + 1) * sizeof(TCHAR), NULL))
    {
        printf("Failed to write DLL path to target process.\n");
        VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }

    HMODULE hKernel32 = GetModuleHandle(_T("Kernel32"));
    if (hKernel32 == NULL)
    {
        printf("Failed to get handle of Kernel32.dll.\n");
        VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }

    LPVOID pLoadLibrary = (LPVOID)GetProcAddress(hKernel32, "LoadLibraryW");
    if (pLoadLibrary == NULL)
    {
        printf("Failed to get address of LoadLibraryW.\n");
        VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }

    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pLoadLibrary, pRemoteBuf, 0, NULL);
    if (hThread == NULL)
    {
        printf("Failed to create remote thread.\n");
        VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }

    WaitForSingleObject(hThread, INFINITE);

    DWORD exitCode = 0;
    GetExitCodeThread(hThread, &exitCode);

    VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE);
    CloseHandle(hThread);
    CloseHandle(hProcess);

    return exitCode != 0;
}

BOOL IsProcessRunning(LPCTSTR processName)
{
    PROCESSENTRY32 pe32 = { 0 };
    pe32.dwSize = sizeof(PROCESSENTRY32);
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot != INVALID_HANDLE_VALUE)
    {
        if (Process32First(hSnapshot, &pe32))
        {
            do
            {
                if (_tcscmp(pe32.szExeFile, processName) == 0)
                {
                    CloseHandle(hSnapshot);
                    return TRUE;
                }
            } while (Process32Next(hSnapshot, &pe32));
        }
        CloseHandle(hSnapshot);
    }
    return FALSE;
}

void MonitorTcpTraffic()
{
    WSADATA wsaData;
    if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0)
    {
        printf("Failed to initialize Winsock.\n");
        return;
    }

    SOCKET s = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
    if (s == INVALID_SOCKET)
    {
        printf("Failed to create raw socket.\n");
        WSACleanup();
        return;
    }

    char buffer[4096];
    int recvSize = 0;
    SOCKADDR_IN local, remote;
    int remoteLen = sizeof(remote);
    while ((recvSize = recvfrom(s, buffer, sizeof(buffer), 0, (SOCKADDR*)&remote, &remoteLen)) != SOCKET_ERROR)
    {
        getsockname(s, (SOCKADDR*)&local, &remoteLen);
        if (remote.sin_addr.S_un.S_addr == local.sin_addr.S_un.S_addr)
        {
            continue; // ignore loopback traffic
        }

        printf("Received %d bytes from %s:%d to %s:%d.\n",
            recvSize,
            inet_ntoa(remote.sin_addr),
            ntohs(remote.sin_port),
            inet_ntoa(local.sin_addr),
            ntohs(local.sin_port));
    }

    closesocket(s);
    WSACleanup();
}

其中，`InjectDll`函数用于注入DLL，并调用其中的入口函数；`IsProcessRunning`函数用于检查目标进程是否正在运行；`MonitorTcpTraffic`函数用于监控TCP通信。在`MonitorTcpTraffic`函数中，我们使用了一个原始套接字来接收所有的IP数据包，并打印出源IP、目标IP、源端口和目标端口。

你可以将你的DLL注入程序编译为32位或64位，并在调试器中运行目标程序，然后启动该DLL注入程序。如果一切正常，你应该能看到目标程序的TCP通信信息被打印出来。注意，这个程序只是一个简单的示例，可能无法满足你的需求，你需要根据你的实际情况进行修改和扩展。

用C#写一个DLL注入程序

以下是一个使用C#实现DLL注入的示例程序：

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace DLLInjector
{
    class Program
    {
        // 定义常量
        const uint PROCESS_CREATE_THREAD = 0x0002;
        const uint PROCESS_QUERY_INFORMATION = 0x0400;
        const uint PROCESS_VM_OPERATION = 0x0008;
        const uint PROCESS_VM_WRITE = 0x0020;
        const uint PROCESS_VM_READ = 0x0010;
        const uint MEM_COMMIT = 0x1000;
        const uint MEM_RELEASE = 0x8000;
        const uint PAGE_READWRITE = 0x04;

        // 导入Win32 API函数
        [DllImport("kernel32.dll")]
        static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out IntPtr lpNumberOfBytesWritten);

        [DllImport("kernel32.dll")]
        static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttribute, uint dwStackSize, IntPtr lpStartAddress,
        IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

        [DllImport("kernel32.dll")]
        static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint dwFreeType);

        [DllImport("kernel32.dll")]
        static extern bool CloseHandle(IntPtr hObject);

        static void Main(string[] args)
        {
            // 获取目标进程ID
            Console.Write("请输入目标进程ID：");
            int pid = int.Parse(Console.ReadLine());

            // 获取DLL路径
            Console.Write("请输入DLL路径：");
            string dllPath = Console.ReadLine();

            // 打开目标进程
            IntPtr hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, pid);
            if (hProcess == IntPtr.Zero)
            {
                Console.WriteLine("打开进程失败！");
                return;
            }

            // 在目标进程中分配内存
            IntPtr lpBaseAddress = VirtualAllocEx(hProcess, IntPtr.Zero, (uint)(dllPath.Length + 1), MEM_COMMIT, PAGE_READWRITE);
            if (lpBaseAddress == IntPtr.Zero)
            {
                Console.WriteLine("分配内存失败！");
                CloseHandle(hProcess);
                return;
            }

            // 将DLL路径写入目标进程中
            IntPtr lpNumberOfBytesWritten;
            byte[] bytes = System.Text.Encoding.Default.GetBytes(dllPath);
            if (!WriteProcessMemory(hProcess, lpBaseAddress, bytes, (uint)bytes.Length, out lpNumberOfBytesWritten))
            {
                Console.WriteLine("写入进程内存失败！");
                VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
                CloseHandle(hProcess);
                return;
            }

            // 获取LoadLibrary函数地址
            IntPtr hModule = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
            if (hModule == IntPtr.Zero)
            {
                Console.WriteLine("获取LoadLibrary函数地址失败！");
                VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
                CloseHandle(hProcess);
                return;
            }

            // 在目标进程中创建远程线程
            IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, hModule, lpBaseAddress, 0, IntPtr.Zero);
            if (hThread == IntPtr.Zero)
            {
                Console.WriteLine("创建远程线程失败！");
                VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
                CloseHandle(hProcess);
                return;
            }

            Console.WriteLine("DLL注入成功！");
            VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
            CloseHandle(hThread);
            CloseHandle(hProcess);
        }

        // 获取模块句柄
        [DllImport("kernel32.dll")]
        static extern IntPtr GetModuleHandle(string lpModuleName);
    }
}

使用方法：

1. 编译上述代码生成DLLInjector.exe文件；
2. 将需要注入的DLL文件放到DLLInjector.exe文件所在目录下；
3. 打开CMD命令行窗口，切换到DLLInjector.exe文件所在目录；
4. 运行DLLInjector.exe，按照提示输入目标进程ID和DLL路径；
5. 如果DLL注入成功，程序会输出“DLL注入成功！”。

需要注意的是，DLL注入本身是一种非常危险的操作，如果使用不当可能会导致系统崩溃或程序运行异常。因此，建议仅在测试环境中使用该程序。