用C#写一个汇编代码注入的程序

以下是一个使用C#编写的简单汇编代码注入程序的示例：

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace AssemblyInjection
{
    class Program
    {
        static void Main(string[] args)
        {
            // 获取目标进程句柄
            Process targetProcess = Process.GetProcessesByName("targetProcessName")[0];
            IntPtr processHandle = OpenProcess(ProcessAccessFlags.All, false, targetProcess.Id);

            // 分配内存空间并将汇编代码写入其中
            byte[] assemblyCode = new byte[] { 0xB8, 0x03, 0x00, 0x00, 0x00, 0xC3 }; // mov eax, 3; ret;
            IntPtr codeAddress = VirtualAllocEx(processHandle, IntPtr.Zero, assemblyCode.Length, AllocationType.Commit, MemoryProtection.ExecuteReadWrite);
            WriteProcessMemory(processHandle, codeAddress, assemblyCode, assemblyCode.Length, out IntPtr bytesWritten);

            // 创建远程线程并运行注入的汇编代码
            IntPtr threadId;
            IntPtr threadHandle = CreateRemoteThread(processHandle, IntPtr.Zero, 0, codeAddress, IntPtr.Zero, 0, out threadId);
            WaitForSingleObject(threadHandle, 0xFFFFFFFF);

            // 清理资源
            CloseHandle(threadHandle);
            VirtualFreeEx(processHandle, codeAddress, 0, FreeType.Release);
            CloseHandle(processHandle);
        }

        [DllImport("kernel32.dll")]
        static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        [DllImport("kernel32.dll")]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, AllocationType flAllocationType, MemoryProtection flProtect);

        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out IntPtr lpNumberOfBytesWritten);

        [DllImport("kernel32.dll")]
        static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId);

        [DllImport("kernel32.dll")]
        static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);

        [DllImport("kernel32.dll")]
        static extern bool CloseHandle(IntPtr hObject);

        [DllImport("kernel32.dll")]
        static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, FreeType dwFreeType);

        [Flags]
        enum ProcessAccessFlags : uint
        {
            All = 0x001F0FFF,
            Terminate = 0x00000001,
            CreateThread = 0x00000002,
            VirtualMemoryOperation = 0x00000008,
            VirtualMemoryRead = 0x00000010,
            VirtualMemoryWrite = 0x00000020,
            DuplicateHandle = 0x00000040,
            CreateProcess = 0x000000080,
            SetQuota = 0x00000100,
            SetInformation = 0x00000200,
            QueryInformation = 0x00000400,
            SuspendResume = 0x00000800,
            QueryLimitedInformation = 0x00001000,
            SetLimitedInformation = 0x00002000,
            AllAccess = 0x001F0FFF
        }

        [Flags]
        enum AllocationType
        {
            Commit = 0x1000,
            Reserve = 0x2000,
            Decommit = 0x4000,
            Release = 0x8000,
            Reset = 0x80000,
            TopDown = 0x100000,
            WriteWatch = 0x200000,
            Physical = 0x400000,
            LargePages = 0x20000000
        }

        [Flags]
        enum MemoryProtection
        {
            Execute = 0x10,
            ExecuteRead = 0x20,
            ExecuteReadWrite = 0x40,
            ExecuteWriteCopy = 0x80,
            NoAccess = 0x01,
            ReadOnly = 0x02,
            ReadWrite = 0x04,
            WriteCopy = 0x08,
            GuardModifierflag = 0x100,
            NoCacheModifierflag = 0x200,
            WriteCombineModifierflag = 0x400
        }

        [Flags]
        enum FreeType
        {
            Decommit = 0x4000,
            Release = 0x8000,
        }
    }
}

请注意，此示例仅用于演示目的，并且可能需要进行更改和适应您的特定情况。此外，汇编代码的内容也可能需要根据您的需求进行更改。最后，请确保您有足够的权限来执行此操作。