今天复习的是远程注入，废话不说，贴代码~

注入的代码，下次直接到这里找就好啦，嘿嘿~~还有个从进程id获取窗口句柄不错的代码，也贴过来吧
BOOL CXXXX::Inject(char* szDllName,HANDLE hDestProcess)
{
 HANDLE hThread;
 char szLibPath[MAX_PATH]={0};
 void* pLibRemote;
 DWORD hLibModule;
 strcpy(szLibPath,szDllName);
 HMODULE hKernel32=::GetModuleHandle(_T("Kernel32"));
 
 pLibRemote=::VirtualAllocEx(hDestProcess
  ,NULL
  ,sizeof(szLibPath)
  ,MEM_COMMIT
  ,PAGE_READWRITE
  );
 ::WriteProcessMemory(hDestProcess,pLibRemote,(void*)szLibPath
  ,sizeof(szLibPath)
  ,NULL);
 hThread=::CreateRemoteThread(hDestProcess
  ,NULL
  ,0
  ,(LPTHREAD_START_ROUTINE)::GetProcAddress (hKernel32,"LoadLibraryA")
  ,pLibRemote
  ,0
  ,NULL
  );
// ::WaitForSingleObject (hThread,INFINITE);
// ::GetExitCodeProcess(hThread,&hLibModule);
 ::CloseHandle(hThread);
 ::VirtualFreeEx(hDestProcess,pLibRemote,sizeof(szLibPath),MEM_RELEASE);

 return TRUE;
}

 

///

typedef struct _tagWNDINFO
{
    DWORD dwProcessId;
    CString strWindowText;
    HWND hWnd;
} WNDINFO, *LPWNDINFO;

BOOL CALLBACK EnumWindowsProc(HWND hWnd,LPARAM lParam)
{
    LPWNDINFO pInfo = (LPWNDINFO)lParam;
    DWORD dwProcessId = 0;
    GetWindowThreadProcessId(hWnd, &dwProcessId);
    wchar_t szText[32] = {0};
    ::GetWindowText( hWnd, szText, 32 );
    TRACE( _T("EnumWindowsProc..hWnd=0x%x, ProcessID=%d, WindowsText=%s /n"), hWnd, dwProcessId, szText );
    if(dwProcessId == pInfo->dwProcessId
  && (pInfo->strWindowText.IsEmpty() || pInfo->strWindowText.Compare(szText)==0) )
    {
        pInfo->hWnd = hWnd;
        return FALSE;
    }
    return TRUE;
}

HWND GetProcessMainWnd(DWORD dwProcessId, CString strText=_T(""))
{
    WNDINFO wi;
    wi.dwProcessId = dwProcessId;
    wi.strWindowText = strText;
    wi.hWnd = NULL;
    EnumWindows(EnumWindowsProc,(LPARAM)&wi);
    return wi.hWnd;
}

//