帮我看看这段进程隐藏代码有什么问题

[cnhnyu]

下面的代码想实现在explorer.exe进程中创建一个远程线程，在这个远程线程中创建一个窗口
由于涉及到代码重定位问题，下面的程序不能正确的运行，出現的情况是：
代码一执行，explorer.exe整个进程就被windows干掉了，哪位兄弟帮看看怎么解决？
// insertexe.c
#include <windows.h>

char szDesktopClass[] = TEXT("Progman");
char szDesktopWindow[] = TEXT("Program Manager");

LRESULT CALLBACK WindowProc(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam);
DWORD WINAPI Main(LPARAM lParam);


int WINAPI WinMain(IN HINSTANCE hInstance, IN HINSTANCE hPrevInstance, IN LPSTR lpCmdLine, IN int nShowCmd )
{
HWND hWnd;
HANDLE hThread;
DWORD dwProcessID;
DWORD dwThreadID;
HANDLE hProcess;

// 查找文件管理器窗口并获取进程ID，然后打开进程
hWnd = FindWindow(szDesktopClass, szDesktopWindow);
dwThreadID = GetWindowThreadProcessId(hWnd, &dwProcessID);

hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,
FALSE, dwProcessID);

if ( hProcess == NULL )
return -1;

hThread = CreateRemoteThread(hProcess, NULL, 0, Main, hInstance, 0, NULL);
CloseHandle(hThread);
CloseHandle(hProcess);


return 0;
}


LRESULT CALLBACK WindowProc(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
PAINTSTRUCT stPS;
RECT rc;

switch ( uMsg )
{
case WM_PAINT:
BeginPaint(hWnd, &stPS);
GetClientRect(hWnd, &rc);
DrawText(stPS.hdc, "This is a window create by a dll.", -1, &rc, DT_CENTER | DT_VCENTER);
EndPaint(hWnd, &stPS);
break;
case WM_CLOSE:
DestroyWindow(hWnd);
PostQuitMessage(0);
break;
default:
return DefWindowProc(hWnd, uMsg, wParam, lParam);
}
return TRUE;
}

DWORD WINAPI Main(LPARAM lParam)
{
char szClassName[] = TEXT("RemoteClass");
char szCaptionMain[] = TEXT("RemoteWindow");

WNDCLASSEX stWndClass;
MSG stMsg;
HWND hWinMain = NULL;
HANDLE hInstance = (HINSTANCE)lParam;

RtlZeroMemory(&stWndClass, sizeof(stWndClass));

stWndClass.hCursor = LoadCursor(NULL, IDC_ARROW);
stWndClass.hInstance = hInstance;
stWndClass.cbSize = sizeof(WNDCLASSEX);
stWndClass.style = CS_HREDRAW | CS_VREDRAW;
stWndClass.lpfnWndProc = WindowProc;
stWndClass.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
stWndClass.lpszClassName = szClassName;

RegisterClassEx(&stWndClass);

hWinMain = CreateWindowEx(WS_EX_CLIENTEDGE | WS_EX_TOPMOST, szClassName, szCaptionMain,
WS_OVERLAPPEDWINDOW, 100, 100, 600, 400,
NULL, NULL, hInstance, NULL);

ShowWindow(hWinMain, SW_SHOWNORMAL);
UpdateWindow(hWinMain);

while ( TRUE )
{
if ( GetMessage(&stMsg, NULL, 0, 0) )
{
TranslateMessage(&stMsg);
DispatchMessage(&stMsg);
}
}

return stMsg.wParam;
}

[zoulie]

不用DLL实现比较繁琐,自己对照看
========================================================================
typedef struct _RemotePara{
char pMessageBox[12];
DWORD dwMessageBox;
}RemotePara;

DWORD __stdcall ThreadProc (RemotePara *lpPara)
{
typedef int (WINAPI *MMessageBoxA)(HWND,LPCTSTR,LPCTSTR,DWORD);
MMessageBoxA myMessageBoxA;
myMessageBoxA =(MMessageBoxA) lpPara->dwMessageBox ;
myMessageBoxA(NULL,lpPara->pMessageBox ,lpPara->pMessageBox,0);
return 0;
}
int WINAPI WinMain (HINSTANCE hThisInstance,
HINSTANCE hPrevInstance,
LPSTR lpszArgument,
int nFunsterStil)
{
const DWORD THREADSIZE=1024;
DWORD byte_write;

HWND hWnd = FindWindow("SciCalc","计算器");
if(!hWnd) return 1;

DWORD dwProcessId = 0;
GetWindowThreadProcessId(hWnd, &dwProcessId);
HANDLE hRemoteProcess = OpenProcess
(PROCESS_ALL_ACCESS,FALSE,dwProcessId);
if(!hRemoteProcess) return 1;
void *pRemoteThread =VirtualAllocEx(hRemoteProcess,0, THREADSIZE,
MEM_COMMIT| MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if(!pRemoteThread)return 1;
if(!WriteProcessMemory(hRemoteProcess,
pRemoteThread,(void *)&ThreadProc,THREADSIZE,0)) return 1;

RemotePara myRemotePara;
ZeroMemory(&myRemotePara,sizeof(RemotePara));
HINSTANCE hUser32 = LoadLibrary ("user32.dll");
myRemotePara.dwMessageBox =(DWORD)
GetProcAddress (hUser32 , "MessageBoxA");
strcat(myRemotePara.pMessageBox,"hello\0");

RemotePara *pRemotePara =(RemotePara *) VirtualAllocEx(hRemoteProcess ,0,
sizeof(RemotePara),MEM_COMMIT,PAGE_READWRITE);
if(!pRemotePara) return 1;
if(!WriteProcessMemory (hRemoteProcess ,pRemotePara,
&myRemotePara,sizeof myRemotePara,0))return 1;

// 启动线程.
HANDLE hThread = CreateRemoteThread(hRemoteProcess ,0,0,
(LPTHREAD_START_ROUTINE)pRemoteThread ,pRemotePara,0,&byte_write);

}

[Yofoo]

CreateRemoteThread 的参数Main函数并没有在explorer.exe进程中, 代码需要注入到目标进程

[cnhnyu]

那么怎么注入呢？
需要说明的一点是，要求不能用dll注入

[knowledge_Is_Life]

这个简单啊,网上搜一下就得到答案了.

[UltraBejing]

不会,帮顶