Win32编程

11、阶段合集

1、课程目标

  1. 回顾Win32编程的核心知识
  2. 通过综合项目巩固学习内容
  3. 掌握Windows API的综合应用
  4. 为后续安全开发打下基础

2、知识回顾

课时核心内容
课时01消息机制、窗口过程、消息循环
课时02文件操作、目录遍历、文件映射
课时03进程创建、线程管理、枚举
课时04同步对象、临界区、互斥体、事件
课时05静态库、动态库、DLL导出导入
课时06虚拟内存、堆管理、跨进程操作
课时07SEH、VEH、异常过滤器
课时08TLS存储、TLS回调
课时09注册表操作、持久化
课时10窗口查找、枚举、控制

3、综合实战项目

3.1、项目1：进程管理器

#include <windows.h>
#include <tlhelp32.h>
#include <psapi.h>
#include <stdio.h>

#pragma comment(lib, "psapi.lib")

void ListProcesses() {
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 pe = {sizeof(pe)};
    
    printf("%-8s %-32s %-10s\n", "PID", "Name", "Memory");
    printf("----------------------------------------\n");
    
    if (Process32First(hSnapshot, &pe)) {
        do {
            HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
                                          FALSE, pe.th32ProcessID);
            DWORD memUsage = 0;
            
            if (hProcess) {
                PROCESS_MEMORY_COUNTERS pmc;
                if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) {
                    memUsage = pmc.WorkingSetSize / 1024;
                }
                CloseHandle(hProcess);
            }
            
            printf("%-8d %-32ls %-10d KB\n", 
                   pe.th32ProcessID, pe.szExeFile, memUsage);
        } while (Process32Next(hSnapshot, &pe));
    }
    
    CloseHandle(hSnapshot);
}

BOOL TerminateProcessByPid(DWORD pid) {
    HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, FALSE, pid);
    if (hProcess) {
        BOOL result = TerminateProcess(hProcess, 0);
        CloseHandle(hProcess);
        return result;
    }
    return FALSE;
}

3.2、项目2：文件监控器

#include <windows.h>
#include <stdio.h>

void MonitorDirectory(const TCHAR* path) {
    HANDLE hDir = CreateFile(path, FILE_LIST_DIRECTORY,
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
    
    if (hDir == INVALID_HANDLE_VALUE) return;
    
    char buffer[4096];
    DWORD bytesReturned;
    
    printf("Monitoring: %ls\n", path);
    
    while (ReadDirectoryChangesW(hDir, buffer, sizeof(buffer),
           TRUE, FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_LAST_WRITE,
           &bytesReturned, NULL, NULL)) {
        
        FILE_NOTIFY_INFORMATION* pNotify = (FILE_NOTIFY_INFORMATION*)buffer;
        
        do {
            WCHAR filename[MAX_PATH] = {0};
            wcsncpy(filename, pNotify->FileName, 
                    pNotify->FileNameLength / sizeof(WCHAR));
            
            const char* action = "Unknown";
            switch (pNotify->Action) {
                case FILE_ACTION_ADDED: action = "Created"; break;
                case FILE_ACTION_REMOVED: action = "Deleted"; break;
                case FILE_ACTION_MODIFIED: action = "Modified"; break;
                case FILE_ACTION_RENAMED_OLD_NAME: action = "Renamed From"; break;
                case FILE_ACTION_RENAMED_NEW_NAME: action = "Renamed To"; break;
            }
            
            printf("[%s] %ls\n", action, filename);
            
            if (pNotify->NextEntryOffset == 0) break;
            pNotify = (FILE_NOTIFY_INFORMATION*)
                      ((BYTE*)pNotify + pNotify->NextEntryOffset);
        } while (1);
    }
    
    CloseHandle(hDir);
}

3.3、项目3：简单远程执行

#include <windows.h>
#include <stdio.h>

BOOL InjectDll(DWORD pid, const char* dllPath) {
    HANDLE hProcess = OpenProcess(
        PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,
        FALSE, pid);
    
    if (!hProcess) return FALSE;
    
    // 在目标进程分配内存
    size_t pathLen = strlen(dllPath) + 1;
    LPVOID pRemote = VirtualAllocEx(hProcess, NULL, pathLen,
                                     MEM_COMMIT, PAGE_READWRITE);
    
    if (!pRemote) {
        CloseHandle(hProcess);
        return FALSE;
    }
    
    // 写入DLL路径
    WriteProcessMemory(hProcess, pRemote, dllPath, pathLen, NULL);
    
    // 获取LoadLibraryA地址
    LPTHREAD_START_ROUTINE pLoadLibrary = 
        (LPTHREAD_START_ROUTINE)GetProcAddress(
            GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    
    // 创建远程线程
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
                                         pLoadLibrary, pRemote, 0, NULL);
    
    if (hThread) {
        WaitForSingleObject(hThread, INFINITE);
        CloseHandle(hThread);
    }
    
    VirtualFreeEx(hProcess, pRemote, 0, MEM_RELEASE);
    CloseHandle(hProcess);
    
    return hThread != NULL;
}

4、API速查表

4.1、进程相关

API用途
CreateProcess创建进程
OpenProcess打开进程
TerminateProcess终止进程
GetCurrentProcessId获取当前PID

4.2、线程相关

API用途
CreateThread创建线程
WaitForSingleObject等待对象
TlsAlloc/TlsSetValueTLS操作

4.3、内存相关

API用途
VirtualAlloc分配虚拟内存
VirtualProtect修改内存保护
ReadProcessMemory读取进程内存
WriteProcessMemory写入进程内存

4.4、文件相关

API用途
CreateFile创建/打开文件
ReadFile/WriteFile读写文件
FindFirstFile枚举文件
CreateFileMapping文件映射

5、课后作业

  1. 进程管理器：实现带有进程列表和终止功能的程序
  2. 文件监控：实现实时文件变化监控工具
  3. DLL注入：实现简单的DLL注入功能
  4. 综合应用：结合所学知识开发一个系统信息收集工具