应用层阻止远程线程注入

利用DLL_THREAD_ATTACH即可。当有新线程加入时，进行过滤即可。

 BOOL WINAPI DllMain(HINSTANCE hinstDll, DWORD fdwReason, PVOID fImpLoad) 
 2 {
 3     switch (fdwReason) 
 4     {
 5 
 6     case DLL_PROCESS_ATTACH:
 7 
 8             break;
 9     
10     case DLL_THREAD_ATTACH:
11             // A new thread is being created in the current process.
12             break;
13         
14     case DLL_THREAD_DETACH:
15         // A thread is exiting cleanly.
16         break;
17 
18     case DLL_PROCESS_DETACH:
19         // The calling process is detaching the DLL from its address space.
20         break;
21     }
22     return(TRUE);
23 }

这里有一种办法解决：

            hThread = GetCurrentThread();
            NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &dwStaAddr, sizeof(dwStaAddr), &dwReturnLength);
            VirtualQuery(dwStaAddr, &mbi, sizeof(mbi));
            if (mbi.AllocationBase != GetModuleHandle(NULL)) {
                TerminateThread(hThread, 0);
            }

还有一张办法是用NtQueryInformationThread获得线程入口点地址，然后判断机器指令是否为LoadLibraryA即可。显然这种方法比较挫。