pyfault.py 文件源码

def inject_dll(self,dll_path,pid):

        '''
        Inject a DLL of your choice into a running process.
        @type    dll_name:    String
        @param   dll_name:    The path to the DLL you wish to inject.
        @type    pid:         Integer
        @param   pid:         The process ID that you wish to inject into.

        @returns              True if the DLL was injected successfully, False if it wasn't.
        '''

        dll_len = len(dll_path)

        # Get a handle to the process we are injecting into.
        h_process = kernel32.OpenProcess(pyfault_defines.PROCESS_ALL_ACCESS, False, pid)

        # Now we have to allocate enough bytes for the name and path of our DLL.
        arg_address = kernel32.VirtualAllocEx(h_process,0,dll_len,pyfault_defines.VIRTUAL_MEM,pyfault_defines.PAGE_READWRITE)

        # Write the path of the DLL into the previously allocated space. The pointer returned
        written = ctypes.c_int(0)
        kernel32.WriteProcessMemory(h_process, arg_address, dll_path, dll_len, ctypes.byref(written))

        # Get a handle directly to kernel32.dll
        h_kernel32 = kernel32.GetModuleHandleA("kernel32.dll")

        # Get the address of LoadLibraryA
        h_loadlib = kernel32.GetProcAddress(h_kernel32,"LoadLibraryA")

        # Now we try to create the remote thread, with the entry point of 
        thread_id = ctypes.c_ulong(0)
        if not kernel32.CreateRemoteThread(h_process,None,0,h_loadlib,arg_address,0,ctypes.byref(thread_id)):
            raise faultx("CreateRemoteThread failed, unable to inject the DLL.")

        # Return the threadid of the newly injected DLL 
        return True