將.Net程序集加載/注入到現有的.net進程中？

Question

在我的情況，我想加載自定義.NET程序集到運行.NET過程的域名，例如Windows Explorer，我曾嘗試已是剛剛注射大會explorer.exe但這似乎並沒有沒有明顯的理由工作。

噴油器代碼：

public class CodeInjector 
{ 
    [DllImport("kernel32.dll", SetLastError = true)] 
    public static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, uint dwProcessId); 

    [DllImport("kernel32.dll", SetLastError = true)] 
    public static extern int CloseHandle(IntPtr hObject); 

    [DllImport("kernel32.dll", SetLastError = true)] 
    public static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName); 

    [DllImport("kernel32.dll", SetLastError = true)] 
    public static extern IntPtr GetModuleHandle(string lpModuleName); 

    [DllImport("kernel32.dll", SetLastError = true)] 
    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint flAllocationType, uint flProtect); 

    [DllImport("kernel32.dll", SetLastError = true)] 
    public static extern int WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] buffer, uint size, int lpNumberOfBytesWritten); 

    [DllImport("kernel32.dll", SetLastError = true)] 
    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttribute, IntPtr dwStackSize, IntPtr lpStartAddress, 
     IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId); 

    private static CodeInjector _instance; 

    public static CodeInjector GetInstance 
    { 
     get { return _instance ?? (_instance = new CodeInjector()); } 
    } 

    public InjectionResult Inject(string sProcName, string sDllPath) 
    { 
     if (!File.Exists(sDllPath)) 
     { 
      return InjectionResult.DllNotFound; 
     } 

     var procs = Process.GetProcesses(); 
     var procId = (from t in procs where t.ProcessName == sProcName select (uint)t.Id).FirstOrDefault(); 

     if (procId == 0) 
     { 
      return InjectionResult.ProcessNotFound; 
     } 

     if (!Inject(procId, sDllPath)) 
     { 
      return InjectionResult.InjectionFailed; 
     } 

     return InjectionResult.InjectionSucceed; 
    } 

    private static bool Inject(uint pToBeInjected, string sDllPath) 
    { 
     var hndProc = OpenProcess((0x2 | 0x8 | 0x10 | 0x20 | 0x400), 1, pToBeInjected); 

     if (hndProc == IntPtr.Zero) 
     { 
      return false; 
     } 

     var lpLlAddress = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"); 

     if (lpLlAddress == IntPtr.Zero) 
     { 
      return false; 
     } 

     var lpAddress = VirtualAllocEx(hndProc, (IntPtr)null, (IntPtr)sDllPath.Length, (0x1000 | 0x2000), 0X40); 

     if (lpAddress == IntPtr.Zero) 
     { 
      return false; 
     } 

     var bytes = Encoding.ASCII.GetBytes(sDllPath); 

     if (WriteProcessMemory(hndProc, lpAddress, bytes, (uint)bytes.Length, 0) == 0) 
     { 
      return false; 
     } 

     if (CreateRemoteThread(hndProc, (IntPtr)null, IntPtr.Zero, lpLlAddress, lpAddress, 0, (IntPtr)null) == IntPtr.Zero) 
     { 
      return false; 
     } 

     CloseHandle(hndProc); 

     return true; 
    } 
} 

Answer 1

您也可以使用現有的庫的另一個選項 - ManagedInjector - https://github.com/cplotts/snoopwpf/tree/master/ManagedInjector。有一個工具snoopwpf可以顯示任何WPF進程的細節，並且它使用進程注入。我前一段時間使用它，它運行良好。

您需要構建它，添加到您的項目作爲參考，並調用這樣的：

Injector.Launch(someProcess.MainWindowHandle, 
        typeof(Loader).Assembly.Location, 
        typeof(Loader).FullName, 
        "Inject"); 

Loader是將被加載到進程和Inject是將要執行的靜態方法類型的名稱。在我的情況下，我有：

public class Loader 
{ 

    public static void Inject() 
    { 
      // i did CBT Hook on main window here 
      // and also displayed sample message box for debugging purposes 
      MessageBox.Show("Hello from another process"); 
    } 
} 

ManagedInjector是用Managed C++代碼編寫的。基本上它將自己的非託管C++方法作爲MessageHookProc掛鉤，它將在注入後啓動指定的程序集並運行指定的方法。它應該適用於託管和非託管程序。在我的情況下，我將它用於非託管程序。

UPDATE

我在本地測試，它成功地注入在Windows 8.1 x64的我的消息框到Explorer進程。我編譯了ManagedInjector64-4.0，我的示例控制檯項目在平臺選擇中也有x64。這是我的工作代碼：

class Program 
{ 
    static void Main(string[] args) 
    { 
     var proc = Process.GetProcessesByName("explorer").FirstOrDefault(); 
     Injector.Launch(proc.MainWindowHandle, typeof(Loader).Assembly.Location, typeof(Loader).FullName, "Inject"); 
    } 
} 

public class Loader 
{ 
    public static void Inject() 
    { 
     MessageBox.Show("Hello"); 
     Task.Run(() => 
     { 
      Thread.Sleep(3000); 
      MessageBox.Show("Hello again"); 
      Thread.Sleep(5000); 
      MessageBox.Show("Hello again again"); 
     }); 
    } 
}