列宁先生，我痛苦地发现，这应该不是我的DLL的问题。换言之，我的DLL在这个注入方面很可能没有问题(因为它在WIN7上运行良好)，我极度压缩了对此问题的描述，悲剧地发现，很可能是XP远程线程机制我不够了解。
我把极度压缩后的问题编码如下：
#include <stdio.H>
#include <windows.h>
typedef DWORD (*THREAD_PROC)(void*);
BOOL WINAPI InjectDllToProcW(DWORD procID, LPCWSTR dll)
{
BOOL bRet = FALSE;
HANDLE hProc = NULL;
void* remoteMem = 0;
size_t len = 0;
do
{
THREAD_PROC loadLib = (THREAD_PROC)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryW");
if(!loadLib)
{
break;
}
hProc = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, procID);
if(!hProc)
{
break;
}
len = (wcslen(dll) + 1) * sizeof(wchar_t);
// 多分配俩字节，为了可能产生的内存对齐用
remoteMem = VirtualAllocEx(hProc, NULL, len, MEM_COMMIT, PAGE_READWRITE);
if(!remoteMem)
{
break;
}
char* dllAddr = (char*)remoteMem;
// 最好是2的整数倍，否则在WIN7上有平台兼容性问题
if((int)dllAddr % 2)
{
dllAddr++;
}
if(!WriteProcessMemory(hProc, dllAddr, (void*)dll, len, NULL))
{
break;
}
DWORD threadID = 0;
HANDLE hThread = CreateRemoteThread(hProc,
NULL,
0,
(LPTHREAD_START_ROUTINE)loadLib,
dllAddr,
CREATE_SUSPENDED,
&threadID);
if(!hThread)
{
break;
}
ResumeThread(hThread);
CloseHandle(hThread);
bRet = TRUE;
} while (FALSE);
if(hProc)
{
CloseHandle(hProc);
}
return bRet;
}
int main()
{
STARTUPINFO si = {0};
si.cb = sizeof(si);
si.wShowWindow = SW_SHOW;
si.dwFlags = STARTF_USESHOWWINDOW;
PROCESS_INFORMATION pi = {0};
CreateProcess(NULL, "C:\\windows\\system32\\notepad.exe", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
// 注入不存在的都会有问题，看来是 CreateRemoteThread 本身的机制问题，不创建远程线程就没事
// if(InjectDllToProcW(pi.dwProcessId, L"a"))
if(InjectDllToProcW(pi.dwProcessId, L"C:\\windows\\system32\\kernel32.dll"))
{
printf("注入成功\n");
getchar();
}
else
{
printf("注入失败\n");
}
ResumeThread(pi.hThread);
printf("%d\n", GetLastError());
return 0;
}
