关于远程线程的调用

HANDLE WINAPI CreateRemoteThread(
	_In_  HANDLE                 hProcess,
	_In_  LPSECURITY_ATTRIBUTES  lpThreadAttributes,
	_In_  SIZE_T                 dwStackSize,
	_In_  LPTHREAD_START_ROUTINE lpStartAddress,
	_In_  LPVOID                 lpParameter,
	_In_  DWORD                  dwCreationFlags,
	_Out_ LPDWORD                lpThreadId
	);

#include "stdafx.h"

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
	{
		MessageBox(0, L"123", L"456", 0);
		break;
	}
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
	{
		MessageBox(0, L"xiezai", L"卸载", 0);
		break;
	}
		
	}
	return TRUE;
}

#include "stdafx.h"
#include <windows.h>
#include <TlHelp32.h>

BOOL WINAPI LoadDll(DWORD ProcessId, char* DllFullPathName);
BOOL WINAPI FreeDll(DWORD ProcessId, char* DllFullPathName);

int main()
{
	// DLL文件全路径名.
	char DllFullPathName[MAX_PATH] = { 0 };

	char CurrentPath[MAX_PATH] = { 0 };
	GetCurrentDirectoryA(MAX_PATH, CurrentPath);

	strcat(DllFullPathName, CurrentPath);
	strcat(DllFullPathName, "\\Hide.dll");
	


	DWORD ProcessId = 0;
	HWND hWnd = FindWindow(L"notepad",NULL);
	if (!hWnd) 
	{
		printf("Can‘t find the file!\n");
		return 0;
	}

	// 获得目标进程的进程号pid.
	GetWindowThreadProcessId(hWnd, &ProcessId);
	
	LoadDll(ProcessId, DllFullPathName);
	FreeDll(ProcessId, DllFullPathName);
}

BOOL WINAPI LoadDll(DWORD ProcessId, char* DllFullPathName)
{
	

	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);
	if (hProcess == NULL)
	{
		return 0;
	}

	int DllLength = strlen(DllFullPathName) + sizeof(char);

	PVOID DllAddress = VirtualAllocEx(hProcess,
		NULL,
		DllLength,
		MEM_COMMIT,
		PAGE_READWRITE);
	if (DllLength == NULL)
	{
		CloseHandle(hProcess);
		return 0;
	}

	SIZE_T WriteNum = 0;
	BOOL v1 = WriteProcessMemory(hProcess, DllAddress, DllFullPathName, DllLength, &WriteNum);


	//好多人先写这样，到下面强制类型转换，结果错误
	//FARPROC FunAddr = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");

	PTHREAD_START_ROUTINE FunAddress = (PTHREAD_START_ROUTINE)
		GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryA");

	HANDLE hThread = CreateRemoteThread(hProcess,
		NULL,
		0,
		FunAddress,
		DllAddress,
		0,
		NULL);
	int a = GetLastError();
	WaitForSingleObject(hThread, INFINITE);

	CloseHandle(hThread);
	CloseHandle(hProcess);
}

BOOL WINAPI FreeDll(DWORD ProcessId, char* DllFullPathName)
{
	BOOL   Result = FALSE;
	HANDLE hProcess = NULL;
	HANDLE hThread = NULL;
	HANDLE Snapshot = NULL;
	MODULEENTRY32 hMod = { sizeof(hMod) };

	__try
	{
		// 打开进程. 
		hProcess = OpenProcess(
			PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION,
			FALSE,
			ProcessId
			);

		if (hProcess == NULL)
			__leave;


		// 取得FreeLibrary函数在Kernel32.dll中的地址. 
		PTHREAD_START_ROUTINE pfnThread =
			(PTHREAD_START_ROUTINE)GetProcAddress(
				GetModuleHandle(L"Kernel32.dll"), "FreeLibrary");

		if (pfnThread == NULL)
			__leave;

		// 取得指定进程的所有模块映象. 
		Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessId);
		if (Snapshot == NULL)
			__leave;

		// 取得所有模块列表中的指定的模块. 
		BOOL bMoreMods = Module32First(Snapshot, &hMod);
		if (bMoreMods == FALSE)
			__leave;

		// 循环取得想要的模块. 
		for (; bMoreMods; bMoreMods = Module32Next(Snapshot, &hMod))
		{
			if ((wcscmp(hMod.szExePath, (WCHAR*)DllFullPathName) == 0) ||
				(wcscmp(hMod.szModule, (WCHAR*)DllFullPathName) == 0)) {
				break;
			}
		}

		hThread = CreateRemoteThread(hProcess,
			NULL,
			0,
			pfnThread,
			hMod.modBaseAddr,
			0,
			NULL);
		if (hThread == NULL)
			__leave;

		// 等待远程线程终止.
		WaitForSingleObject(hThread, INFINITE);

		Result = TRUE;

	}
	__finally
	{
		// 关闭句柄. 
		if (hThread != NULL)
			CloseHandle(hThread);

		if (Snapshot != NULL)
			CloseHandle(Snapshot);

		if (hProcess != NULL)
			CloseHandle(hProcess);
	}

	return Result;
}