有关CreateToolhelp32Snapshot的问题

[u010467625]

我有一个API HOOK的DLL文件。在XP系统下一切正常，但是在Win7系统下，在使用pCreateToolhelp32Snapshot时总是会弹出好多窗口，例如资源管理器已停止操作等。请问这是什么原因？我应该怎么解决？代码如下：
int CProcessModule::EnumProcess()
{
m_dwProcessCount =0;
/*#ifdef WINNT
DWORD dwBytesNeeded;

if(!m_pEnumProcesses(&m_dwProcessIDs[0], sizeof(m_dwProcessIDs), &dwBytesNeeded))
return -1;

m_dwProcessCount = dwBytesNeeded / sizeof(DWORD);
#else*/
HANDLE hSnapShot;
PROCESSENTRY32 ProcessEntry32;
//MODULEENTRY32 ModuleEntry32;
BOOL Result;
//char *pszExtension;

hSnapShot = pCreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

if (hSnapShot == (HANDLE)-1)
return false;

ProcessEntry32.dwSize = sizeof(PROCESSENTRY32);

Result = pProcess32First(hSnapShot, &ProcessEntry32);

if (Result != TRUE)
{
CloseHandle(hSnapShot);
return false;
}

do
{
m_dwProcessIDs[m_dwProcessCount] = ProcessEntry32.th32ProcessID;
m_dwProcessCount ++;
} while (pProcess32Next(hSnapShot, &ProcessEntry32) && m_dwProcessCount < MAX_PROCESS_COUNT);

CloseHandle(hSnapShot);

//#endif

return m_dwProcessCount;
}
请各位大神帮帮忙，急啊！

[赵4老师]

以管理员身份运行，别在64位Win7下运行。

[u010467625]

我找到了原因，是因为DLL注入的问题，在XP下可以正常注入，但是win7不行，注入的代码是这样的 int WINAPI InjectLib(DWORD process_id, char *lib_name) { PTHREAD_START_ROUTINE pfnRemote =(PTHREAD_START_ROUTINE) GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA"); if(pfnRemote ==NULL) { if(g_pfnRemote==NULL) return -1; else pfnRemote=g_pfnRemote; } else { g_pfnRemote=pfnRemote; } HANDLE hProcess =OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_id); if(hProcess ==NULL) { WriteLog("InjectLib:OpenProcess %d failed!", process_id); return -1; } int mem_size =strlen(lib_name)+1; void *premote_mem =VirtualAllocEx(hProcess, NULL, mem_size, MEM_COMMIT, PAGE_READWRITE); if(premote_mem ==NULL) { CloseHandle(hProcess); return -1; } //if(hThread) SuspendThread(hThread); int ret =WriteProcessMemory(hProcess, premote_mem, lib_name, mem_size,NULL); if(ret ==STATUS_ACCESS_VIOLATION || ret ==false) { //if(hThread) ResumeThread(hThread); VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE); CloseHandle(hProcess); return -1; } //if(hThread) ResumeThread(hThread); HANDLE hThread =CreateRemoteThread(hProcess, NULL, 0, pfnRemote, premote_mem, 0, NULL); if(hThread ==NULL) { VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE); CloseHandle(hProcess); return -1; } //WriteLog2("c:\\hookapi_debug.log", "CreateRemoteThread ok"); WaitForSingleObject(hThread, INFINITE); VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE); CloseHandle(hProcess); CloseHandle(hThread); return 0; } 然后就会弹出好多窗口，例如资源管理器已停止操作等。我又试了如下代码： BOOL MyCreateRemoteThread(HANDLE hProcess, LPTHREAD_START_ROUTINE pThreadProc, LPVOID pRemoteBuf) { HANDLE hThread = NULL; FARPROC pFunc = NULL; if( IsVistaOrLater() ) // Vista, 7, Server2008 { pFunc = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtCreateThreadEx"); if( pFunc == NULL ) { //printf("MyCreateRemoteThread() : GetProcAddress(/"NtCreateThreadEx/") 调用失败！错误代码: [%d]/n", //GetLastError()); return FALSE; } ((PFNTCREATETHREADEX)pFunc)(&hThread, 0x1FFFFF, NULL, hProcess, pThreadProc, pRemoteBuf, FALSE, NULL, NULL, NULL, NULL); if( hThread == NULL ) { printf("MyCreateRemoteThread() : NtCreateThreadEx() 调用失败！错误代码: [%d]/n", GetLastError()); return FALSE; } } else // 2000, XP, Server2003 { hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, pRemoteBuf, 0, NULL); if( hThread == NULL ) { printf("MyCreateRemoteThread() : CreateRemoteThread() 调用失败！错误代码: [%d]/n", GetLastError()); return FALSE; } } if( WAIT_FAILED == WaitForSingleObject(hThread, INFINITE) ) { printf("MyCreateRemoteThread() : WaitForSingleObject() 调用失败！错误代码: [%d]/n", GetLastError()); return FALSE; } return TRUE; } int WINAPI InjectLib(DWORD process_id, char *lib_name) { PTHREAD_START_ROUTINE pfnRemote =(PTHREAD_START_ROUTINE) GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA"); if(pfnRemote ==NULL) { if(g_pfnRemote==NULL) return -1; else pfnRemote=g_pfnRemote; } else { g_pfnRemote=pfnRemote; } HANDLE hProcess =OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_id); if(hProcess ==NULL) { WriteLog("InjectLib:OpenProcess %d failed!", process_id); return -1; } int mem_size =strlen(lib_name)+1; void *premote_mem =VirtualAllocEx(hProcess, NULL, mem_size, MEM_COMMIT, PAGE_READWRITE); if(premote_mem ==NULL) { CloseHandle(hProcess); return -1; } //if(hThread) SuspendThread(hThread); int ret =WriteProcessMemory(hProcess, premote_mem, lib_name, mem_size,NULL); if(ret ==STATUS_ACCESS_VIOLATION || ret ==false) { //if(hThread) ResumeThread(hThread); VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE); CloseHandle(hProcess); return -1; } //if(hThread) ResumeThread(hThread); if(!MyCreateRemoteThread(hProcess, (LPTHREAD_START_ROUTINE)pfnRemote, premote_mem)) { VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE); CloseHandle(hProcess); return -1; } //WriteLog2("c:\\hookapi_debug.log", "CreateRemoteThread ok"); //WaitForSingleObject(hThread, INFINITE); VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE); CloseHandle(hProcess); //CloseHandle(hThread); return 0; } 这样就直接蓝屏啦，我都提权啦，提权代码如下： BOOL ObtainSeDebugPrivilege() { TOKEN_PRIVILEGES TokenPrivileges; TOKEN_PRIVILEGES PreviousTokenPrivileges; LUID luid; HANDLE hToken; DWORD dwPreviousTokenPrivilegesSize = sizeof(TOKEN_PRIVILEGES); if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) { WriteLog("debug 001"); return false; } if(!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) { WriteLog("debug 002"); return false; } TokenPrivileges.PrivilegeCount = 1; TokenPrivileges.Privileges[0].Luid = luid; TokenPrivileges.Privileges[0].Attributes = 0; if(!AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), &PreviousTokenPrivileges, &dwPreviousTokenPrivilegesSize)) { WriteLog("debug 003"); return false; } PreviousTokenPrivileges.PrivilegeCount = 1; PreviousTokenPrivileges.Privileges[0].Luid = luid; PreviousTokenPrivileges.Privileges[0].Attributes |= SE_PRIVILEGE_ENABLED; if(!AdjustTokenPrivileges(hToken, FALSE, &PreviousTokenPrivileges, dwPreviousTokenPrivilegesSize, NULL, NULL)) { WriteLog("debug 004"); return false; } //WriteLog("debug ok"); return true; } 还有什么办法能在win7下注入DLL，请各位大神帮帮忙，十一能不能放假就指它啦！