最近在整理学习 觉得这个很高深，弄懂了觉得也就那样。
下面的代码就是远线程dll注入线程代码
//=========================================================================== // 一个标准的远线程dll注入函数 //=========================================================================== #include <Windows.h> // dwPid:要注入进程的pid pwszProxyFile：要注入dll的文件路径 BOOL WINAPI InjectProxyW(DWORD dwPid, PCWSTR pwszProxyFile) { BOOL bRet = FALSE; HANDLE hProcess = NULL; HANDLE hThread = NULL; FARPROC pfnThreadBtn = NULL; // windef.h : typedef int (FAR WINAPI *FARPROC)(); PWSTR pwszPara = NULL; // loadlibry的参数 hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid); pfnThreadBtn = GetProcAddress(GetModuleHandle(L"Kernel32"), "LoadLibraryW"); size_t iPorxyFileLen = wcslen(pwszProxyFile)*sizeof(WCHAR); pwszPara = (PWSTR)VirtualAllocEx(hProcess, NULL, iPorxyFileLen, MEM_COMMIT, PAGE_READWRITE); if (pwszPara == NULL) { CloseHandle(hProcess); return FALSE; } WriteProcessMemory(hProcess, pwszPara, (PVOID)pwszProxyFile, iPorxyFileLen, NULL); // CreateRemoteThread 最后一个参数返回的是创建这个远线程的id hThread = CreateRemoteThread(hProcess, NULL, 1024, (LPTHREAD_START_ROUTINE)pfnThreadBtn, pwszPara, 0, NULL); WaitForSingleObject(hThread, INFINITE); CloseHandle(hThread); VirtualFreeEx(hProcess, pwszPara, 0, MEM_RELEASE); CloseHandle(hProcess); return TRUE; }