代码远程注入关键段

HANDLE handleProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE
, FALSE
, dwProcessId);

//param
char szBuff[10]={0};
*(DWORD*)szBuff = 1000;
void* pDataRemote = VirtualAllocEx(handleProcess,0,sizeof(szBuff),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
WriteProcessMemory(handleProcess,pDataRemote,szBuff,sizeof(szBuff),NULL);

//fun
DWORD cbCodeSize = (LPBYTE)InjectFunEnd - (LPBYTE)InjectFun;
PDWORD pCodeRemote = (PDWORD)VirtualAllocEx(handleProcess,0,cbCodeSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
WriteProcessMemory(handleProcess,pCodeRemote,&InjectFun,cbCodeSize,NULL);

HANDLE hThread = CreateRemoteThread(handleProcess,NULL,0,(LPTHREAD_START_ROUTINE)pCodeRemote,pDataRemote,0,NULL);

DWORD dwExtCode;
if (hThread)
{
WaitForSingleObject(hThread,INFINITE);
GetExitCodeThread(hThread,&dwExtCode);

printf("return %d",dwExtCode);
//TRACE("return %d",dwExtCode);
CloseHandle(hThread);
}

VirtualFreeEx(handleProcess,pCodeRemote,cbCodeSize,MEM_RELEASE);
VirtualFreeEx(handleProcess,pDataRemote,sizeof(szBuff),MEM_RELEASE);

CloseHandle(handleProcess);