C++ 进程注入监视文件写出操作：实战指南

以下是一个简单的注入进程监视其文件写出操作的示例代码：

#include <windows.h>
#include <tlhelp32.h>
#include <psapi.h>
#include <iostream>
#include <fstream>
#include <string>
using namespace std;

// 目标进程的进程名和文件路径
const string TARGET_PROCESS_NAME = 'notepad.exe';
const string TARGET_FILE_PATH = 'C:\test.txt';

// 监视文件写出操作的钩子函数
LRESULT CALLBACK HookProc(int nCode, WPARAM wParam, LPARAM lParam)
{
    if (nCode >= 0 && wParam == FILE_SHARE_WRITE)
    {
        PFILE_NOTIFY_INFORMATION pNotifyInfo = (PFILE_NOTIFY_INFORMATION)lParam;
        wstring fileName(pNotifyInfo->FileName, pNotifyInfo->FileNameLength / sizeof(WCHAR));
        if (TARGET_FILE_PATH.find(wstring(fileName)) != string::npos)
        {
            // 目标文件被写出，记录日志
            ofstream outFile('log.txt', ios::app);
            outFile << 'File ' << TARGET_FILE_PATH << ' is written by process ' << GetCurrentProcessId() << endl;
            outFile.close();
        }
    }
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

int main()
{
    // 获取目标进程ID
    DWORD targetProcessId = 0;
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (snapshot != INVALID_HANDLE_VALUE)
    {
        PROCESSENTRY32 pe32;
        pe32.dwSize = sizeof(PROCESSENTRY32);
        if (Process32First(snapshot, &pe32))
        {
            do
            {
                if (string(pe32.szExeFile) == TARGET_PROCESS_NAME)
                {
                    targetProcessId = pe32.th32ProcessID;
                    break;
                }
            } while (Process32Next(snapshot, &pe32));
        }
        CloseHandle(snapshot);
    }

    if (targetProcessId == 0)
    {
        cout << 'Target process not found!' << endl;
        return 0;
    }

    // 打开目标进程，注入钩子函数
    HANDLE targetProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, targetProcessId);
    if (targetProcess)
    {
        HMODULE module = GetModuleHandle(NULL);
        HOOKPROC hookProc = (HOOKPROC)GetProcAddress(module, 'HookProc');
        HHOOK hook = SetWindowsHookEx(WH_NOTIFY, hookProc, module, 0);
        if (!hook)
        {
            cout << 'Failed to set hook!' << endl;
            return 0;
        }

        // 在目标进程中注入DLL
        char dllPath[MAX_PATH];
        GetFullPathName('Hook.dll', MAX_PATH, dllPath, NULL);
        LPVOID remoteDllPath = VirtualAllocEx(targetProcess, NULL, strlen(dllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
        WriteProcessMemory(targetProcess, remoteDllPath, dllPath, strlen(dllPath) + 1, NULL);
        HMODULE kernel32 = GetModuleHandle('kernel32.dll');
        LPTHREAD_START_ROUTINE loadLibrary = (LPTHREAD_START_ROUTINE)GetProcAddress(kernel32, 'LoadLibraryA');
        HANDLE remoteThread = CreateRemoteThread(targetProcess, NULL, 0, loadLibrary, remoteDllPath, 0, NULL);
        if (!remoteThread)
        {
            cout << 'Failed to inject DLL!' << endl;
            return 0;
        }

        // 等待注入完成，然后卸载钩子
        WaitForSingleObject(remoteThread, INFINITE);
        UnhookWindowsHookEx(hook);
        CloseHandle(remoteThread);
        VirtualFreeEx(targetProcess, remoteDllPath, strlen(dllPath) + 1, MEM_RELEASE);
        CloseHandle(targetProcess);
    }
    else
    {
        cout << 'Failed to open target process!' << endl;
        return 0;
    }

    cout << 'Done!' << endl;
    return 0;
}

这个示例代码的实现流程如下：

获取目标进程ID。
打开目标进程，并注入钩子函数。
在目标进程中注入一个DLL，以便在其中执行我们的钩子函数。
等待注入完成，然后卸载钩子。

这里的钩子函数是用于监视文件写出操作的，它会在目标文件被写出时记录日志。在实际使用中，你可以根据需要编写不同的钩子函数来监视不同的操作。