最后，如果幸运的话，您需要的功能实际上位于 exe 使用的 DLL 之一上，无论是作为导出函数还是作为 COM 接口。使用 Process Explorer 等查看运行时，看看是否有任何模块看起来有趣。就使用其他模块而言，DLL 显然要容易得多。
Don't know if this is what you're looking for, but if the other exe has a GUI, you can probably do some stuff by sending messages to it. Just run Spy++, do whatever you want with the other app, and watch the log when done. If no special controls are used, you can operate that GUI by getting the handles of the controls you want, and sending them the appropriate messages. If you don't want the user to know you're running the other app, you can run it on a different desktop.
Another option you can exploit is running your own thread inside the other exe's process, and communicating back to your app in one of the various IPC techniques available. Many questions have been asked here about remote thread injection, so just look around for it.
Lastly, if you're lucky the functionality you need is actually on one of the DLLs used by the exe, either as exported functions or as a COM interface. Take a look at run time using Process Explorer or so, and see if any of the modules looks interesting. As far as it goes to using other modules, DLLs are obviously much easier.
发布评论
评论（2）
你可以运行
一下看看它导出了哪些函数。然后您可以使用（无论 C# 等价物是什么）LoadLibrary () 和 GetProcAddress() 调用这些函数。
当然，您需要知道这些函数的签名才能正确调用它们；即参数的数量和顺序等。
You can run
and see what functions it exports. Then you can use (whatever is the C# equivalent of) LoadLibrary() and GetProcAddress() to call those functions.
Of course, you need to know the signatures of those functions in order to call them correctly; i.e. number and order of parameters, etc.
不知道这是否是您正在寻找的，但如果另一个 exe 有 GUI，您可能可以通过向其发送消息来执行一些操作。只需运行 Spy++，对其他应用程序执行您想做的任何操作，然后在完成后查看日志。如果没有使用特殊控件，您可以通过获取所需控件的句柄并向它们发送适当的消息来操作该 GUI。如果您不希望用户知道您正在运行其他应用程序，您可以在不同的桌面上运行它。
您可以利用的另一个选项是在另一个 exe 进程中运行您自己的线程，并使用各种可用的 IPC 技术之一与您的应用程序进行通信。这里已经问了很多关于远程线程注入的问题，所以只要四处看看就可以了。
最后，如果幸运的话，您需要的功能实际上位于 exe 使用的 DLL 之一上，无论是作为导出函数还是作为 COM 接口。使用 Process Explorer 等查看运行时，看看是否有任何模块看起来有趣。就使用其他模块而言，DLL 显然要容易得多。
Don't know if this is what you're looking for, but if the other exe has a GUI, you can probably do some stuff by sending messages to it. Just run Spy++, do whatever you want with the other app, and watch the log when done. If no special controls are used, you can operate that GUI by getting the handles of the controls you want, and sending them the appropriate messages. If you don't want the user to know you're running the other app, you can run it on a different desktop.
Another option you can exploit is running your own thread inside the other exe's process, and communicating back to your app in one of the various IPC techniques available. Many questions have been asked here about remote thread injection, so just look around for it.
Lastly, if you're lucky the functionality you need is actually on one of the DLLs used by the exe, either as exported functions or as a COM interface. Take a look at run time using Process Explorer or so, and see if any of the modules looks interesting. As far as it goes to using other modules, DLLs are obviously much easier.