Win32编程

11、阶段合集

1、课程目标

  1. 回顾Win32编程的核心知识
  2. 通过综合项目巩固学习内容
  3. 掌握Windows API的综合应用
  4. 为后续安全开发打下基础

2、知识回顾

课时 核心内容
课时01 消息机制、窗口过程、消息循环
课时02 文件操作、目录遍历、文件映射
课时03 进程创建、线程管理、枚举
课时04 同步对象、临界区、互斥体、事件
课时05 静态库、动态库、DLL导出导入
课时06 虚拟内存、堆管理、跨进程操作
课时07 SEH、VEH、异常过滤器
课时08 TLS存储、TLS回调
课时09 注册表操作、持久化
课时10 窗口查找、枚举、控制

3、综合实战项目

3.1、项目1：进程管理器

#include <windows.h>
#include <tlhelp32.h>
#include <psapi.h>
#include <stdio.h>

#pragma comment(lib, "psapi.lib")

void ListProcesses() {
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 pe = {sizeof(pe)};
    
    printf("%-8s %-32s %-10s\n", "PID", "Name", "Memory");
    printf("----------------------------------------\n");
    
    if (Process32First(hSnapshot, &pe)) {
        do {
            HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
                                          FALSE, pe.th32ProcessID);
            DWORD memUsage = 0;
            
            if (hProcess) {
                PROCESS_MEMORY_COUNTERS pmc;
                if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) {
                    memUsage = pmc.WorkingSetSize / 1024;
                }
                CloseHandle(hProcess);
            }
            
            printf("%-8d %-32ls %-10d KB\n", 
                   pe.th32ProcessID, pe.szExeFile, memUsage);
        } while (Process32Next(hSnapshot, &pe));
    }
    
    CloseHandle(hSnapshot);
}

BOOL TerminateProcessByPid(DWORD pid) {
    HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, FALSE, pid);
    if (hProcess) {
        BOOL result = TerminateProcess(hProcess, 0);
        CloseHandle(hProcess);
        return result;
    }
    return FALSE;
}

3.2、项目2：文件监控器

#include <windows.h>
#include <stdio.h>

void MonitorDirectory(const TCHAR* path) {
    HANDLE hDir = CreateFile(path, FILE_LIST_DIRECTORY,
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
    
    if (hDir == INVALID_HANDLE_VALUE) return;
    
    char buffer[4096];
    DWORD bytesReturned;
    
    printf("Monitoring: %ls\n", path);
    
    while (ReadDirectoryChangesW(hDir, buffer, sizeof(buffer),
           TRUE, FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_LAST_WRITE,
           &bytesReturned, NULL, NULL)) {
        
        FILE_NOTIFY_INFORMATION* pNotify = (FILE_NOTIFY_INFORMATION*)buffer;
        
        do {
            WCHAR filename[MAX_PATH] = {0};
            wcsncpy(filename, pNotify->FileName, 
                    pNotify->FileNameLength / sizeof(WCHAR));
            
            const char* action = "Unknown";
            switch (pNotify->Action) {
                case FILE_ACTION_ADDED: action = "Created"; break;
                case FILE_ACTION_REMOVED: action = "Deleted"; break;
                case FILE_ACTION_MODIFIED: action = "Modified"; break;
                case FILE_ACTION_RENAMED_OLD_NAME: action = "Renamed From"; break;
                case FILE_ACTION_RENAMED_NEW_NAME: action = "Renamed To"; break;
            }
            
            printf("[%s] %ls\n", action, filename);
            
            if (pNotify->NextEntryOffset == 0) break;
            pNotify = (FILE_NOTIFY_INFORMATION*)
                      ((BYTE*)pNotify + pNotify->NextEntryOffset);
        } while (1);
    }
    
    CloseHandle(hDir);
}

3.3、项目3：简单远程执行

#include <windows.h>
#include <stdio.h>

BOOL InjectDll(DWORD pid, const char* dllPath) {
    HANDLE hProcess = OpenProcess(
        PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,
        FALSE, pid);
    
    if (!hProcess) return FALSE;
    
    // 在目标进程分配内存
    size_t pathLen = strlen(dllPath) + 1;
    LPVOID pRemote = VirtualAllocEx(hProcess, NULL, pathLen,
                                     MEM_COMMIT, PAGE_READWRITE);
    
    if (!pRemote) {
        CloseHandle(hProcess);
        return FALSE;
    }
    
    // 写入DLL路径
    WriteProcessMemory(hProcess, pRemote, dllPath, pathLen, NULL);
    
    // 获取LoadLibraryA地址
    LPTHREAD_START_ROUTINE pLoadLibrary = 
        (LPTHREAD_START_ROUTINE)GetProcAddress(
            GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    
    // 创建远程线程
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
                                         pLoadLibrary, pRemote, 0, NULL);
    
    if (hThread) {
        WaitForSingleObject(hThread, INFINITE);
        CloseHandle(hThread);
    }
    
    VirtualFreeEx(hProcess, pRemote, 0, MEM_RELEASE);
    CloseHandle(hProcess);
    
    return hThread != NULL;
}

4、API速查表

4.1、进程相关

API 用途
CreateProcess 创建进程
OpenProcess 打开进程
TerminateProcess 终止进程
GetCurrentProcessId 获取当前PID

4.2、线程相关

API 用途
CreateThread 创建线程
WaitForSingleObject 等待对象
TlsAlloc/TlsSetValue TLS操作

4.3、内存相关

API 用途
VirtualAlloc 分配虚拟内存
VirtualProtect 修改内存保护
ReadProcessMemory 读取进程内存
WriteProcessMemory 写入进程内存

4.4、文件相关

API 用途
CreateFile 创建/打开文件
ReadFile/WriteFile 读写文件
FindFirstFile 枚举文件
CreateFileMapping 文件映射

5、课后作业

  1. 进程管理器：实现带有进程列表和终止功能的程序
  2. 文件监控：实现实时文件变化监控工具
  3. DLL注入：实现简单的DLL注入功能
  4. 综合应用：结合所学知识开发一个系统信息收集工具