CreateRemoteThread如何调用?
用CreateRemoteThread在另外一个进程(NotePad程序)插入线程ThreadFunc
源代码如下:
DWORD WINAPI ThreadFunc(PVOID pvParam)
{
::MessageBox(NULL,"Test",(PSTR)pvParam,MB_OK);
return 1;
}
void InjectThread(PCSTR pszTexts,PROC pfnThread)//pszTexts作为线程函数的参数
{
HANDLE hProcess=NULL,hThread=NULL;
PSTR pszTempTexts=NULL;
HWND hwndEdit=NULL,hwndNotepad;
DWORD dwProcessId=0,dwThreadId=0;
hwndNotepad=::FindWindow("NotePad",NULL);
if(!hwndNotepad)return;
hwndEdit=GetFirstChild(hwndNotepad);
/*GetFirstChild(hwnd) =::GetWindow(hwnd,GW_CHILD)*/
//hwndNotepad=AfxGetMainWnd()->m_hWnd;
dwThreadId=GetWindowThreadProcessId(hwndNotepad,&dwProcessId);
hProcess=OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,FALSE,dwProcessId);
if(!hProcess)return;
int cb=(1+lstrlen(pszTexts));
pszTempTexts=(PSTR)VirtualAllocEx(hProcess,NULL,cb,MEM_COMMIT,PAGE_READWRITE);
if(!pszTempTexts)return;
if(!(WriteProcessMemory(hProcess,pszTempTexts,(PVOID)pszTexts,cb,NULL)))return;
PROC *procWrite=(PROC *)VirtualAllocEx(hProcess,NULL,sizeof(pfnThread),MEM_COMMIT,PAGE_READWRITE);
if(!WriteProcessMemory(hProcess,procWrite,&pfnThread,sizeof(pfnThread),NULL))return;
hThread=CreateRemoteThread(hProcess,NULL,1024*1024,(PTHREAD_START_ROUTINE)(*procWrite),(PVOID)pszTempTexts,0,NULL);
if(hThread=NULL)return;
WaitForSingleObject(hThread,INFINITE);
CloseHandle(hThread);
CloseHandle(hProcess);
}
当这样调用:InjectThread("Test",(PROC)ThreadFunc)出来内存访问违规(Access Violation!)到底错在哪里?如果远程进程换成本地线程则运行正常.