用C#写一个DLL注入程序

以下是一个使用C#实现DLL注入的示例程序：

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace DLLInjector
{
    class Program
    {
        // 定义常量
        const uint PROCESS_CREATE_THREAD = 0x0002;
        const uint PROCESS_QUERY_INFORMATION = 0x0400;
        const uint PROCESS_VM_OPERATION = 0x0008;
        const uint PROCESS_VM_WRITE = 0x0020;
        const uint PROCESS_VM_READ = 0x0010;
        const uint MEM_COMMIT = 0x1000;
        const uint MEM_RELEASE = 0x8000;
        const uint PAGE_READWRITE = 0x04;

        // 导入Win32 API函数
        [DllImport("kernel32.dll")]
        static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out IntPtr lpNumberOfBytesWritten);

        [DllImport("kernel32.dll")]
        static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttribute, uint dwStackSize, IntPtr lpStartAddress,
        IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

        [DllImport("kernel32.dll")]
        static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint dwFreeType);

        [DllImport("kernel32.dll")]
        static extern bool CloseHandle(IntPtr hObject);

        static void Main(string[] args)
        {
            // 获取目标进程ID
            Console.Write("请输入目标进程ID：");
            int pid = int.Parse(Console.ReadLine());

            // 获取DLL路径
            Console.Write("请输入DLL路径：");
            string dllPath = Console.ReadLine();

            // 打开目标进程
            IntPtr hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, pid);
            if (hProcess == IntPtr.Zero)
            {
                Console.WriteLine("打开进程失败！");
                return;
            }

            // 在目标进程中分配内存
            IntPtr lpBaseAddress = VirtualAllocEx(hProcess, IntPtr.Zero, (uint)(dllPath.Length + 1), MEM_COMMIT, PAGE_READWRITE);
            if (lpBaseAddress == IntPtr.Zero)
            {
                Console.WriteLine("分配内存失败！");
                CloseHandle(hProcess);
                return;
            }

            // 将DLL路径写入目标进程中
            IntPtr lpNumberOfBytesWritten;
            byte[] bytes = System.Text.Encoding.Default.GetBytes(dllPath);
            if (!WriteProcessMemory(hProcess, lpBaseAddress, bytes, (uint)bytes.Length, out lpNumberOfBytesWritten))
            {
                Console.WriteLine("写入进程内存失败！");
                VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
                CloseHandle(hProcess);
                return;
            }

            // 获取LoadLibrary函数地址
            IntPtr hModule = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
            if (hModule == IntPtr.Zero)
            {
                Console.WriteLine("获取LoadLibrary函数地址失败！");
                VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
                CloseHandle(hProcess);
                return;
            }

            // 在目标进程中创建远程线程
            IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, hModule, lpBaseAddress, 0, IntPtr.Zero);
            if (hThread == IntPtr.Zero)
            {
                Console.WriteLine("创建远程线程失败！");
                VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
                CloseHandle(hProcess);
                return;
            }

            Console.WriteLine("DLL注入成功！");
            VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
            CloseHandle(hThread);
            CloseHandle(hProcess);
        }

        // 获取模块句柄
        [DllImport("kernel32.dll")]
        static extern IntPtr GetModuleHandle(string lpModuleName);
    }
}

使用方法：

1. 编译上述代码生成DLLInjector.exe文件；
2. 将需要注入的DLL文件放到DLLInjector.exe文件所在目录下；
3. 打开CMD命令行窗口，切换到DLLInjector.exe文件所在目录；
4. 运行DLLInjector.exe，按照提示输入目标进程ID和DLL路径；
5. 如果DLL注入成功，程序会输出“DLL注入成功！”。

需要注意的是，DLL注入本身是一种非常危险的操作，如果使用不当可能会导致系统崩溃或程序运行异常。因此，建议仅在测试环境中使用该程序。