—————————————————————————————————

class Program中的方法，注入dll到目标进程

——————————————————————-——————————

static String ChannelName = null;

        static void Main(string[] args)

        {

            Int32.TryParse(args[], out TargetPID) ;

            RemoteHooking.IpcCreateServer<FileMonInterface>(ref ChannelName, WellKnownObjectMode.SingleCall);

            string injectionLibrary = Path.Combine(Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location), "Inject.dll");

            RemoteHooking.Inject(

                        TargetPID,

                        injectionLibrary,

                        injectionLibrary,

                        ChannelName);

            Console.WriteLine("Injected to process {0}", TargetPID);

            Console.WriteLine("<Press any key to exit>");

            Console.ReadKey();

            }

__________________________________________________

MarshalByRefObject的实现，供dll进行调用，判断是否正常

__________________________________________________

 public class FileMonInterface : MarshalByRefObject

    {

        public void IsInstalled(Int32 InClientPID)

        {

            Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID);

        }

    }

—————————————————————————————————

注入成功后，调用Run方法，钩取SetWindowTextW  API，修改为DSetWindowText的委托

—————————————————————————————————

 public void Run(

            RemoteHooking.IContext InContext,

            String InChannelName)

        {

            // install hook...

                Hook = LocalHook.Create(

                    LocalHook.GetProcAddress("user32.dll", "SetWindowTextW"),

                    new DSetWindowText(SetWindowText_Hooked),

                    this);

                Hook.ThreadACL.SetExclusiveACL(new Int32[] {  });

         Interface.IsInstalled(RemoteHooking.GetCurrentProcessId());

            RemoteHooking.WakeUpProcess();while (true)

                {

                    Thread.Sleep();

                }

        }

—————————————————————————————————

委托

—————————————————————————————————

        [UnmanagedFunctionPointer(CallingConvention.StdCall,

            CharSet = CharSet.Ansi,

            SetLastError = true)]

        delegate bool DSetWindowText(

         IntPtr hWnd, //对于句柄采用IntPtr类型

         string text

     );

—————————————————————————————————

API

—————————————————————————————————

        [DllImport("user32.dll",

        CharSet = CharSet.Ansi,

        SetLastError = true,

        CallingConvention = CallingConvention.StdCall)]

        static extern bool SetWindowText(

         IntPtr hWnd,    string text

         );

—————————————————————————————————

 傀儡API

—————————————————————————————————

    static bool SetWindowText_Hooked(

            IntPtr hWnd,

             string text)

        {

            text = (int.Parse(text.Remove(text.Length-))+).ToString();//修改要显示的数据

            return SetWindowText( hWnd, text);//调用API

        }