CreateRemoteThread 失败错误码 5

最近在WIN7下调试DLL注入进程的时候，32位的注入总是返回失败，错误码5。64位没问题。经过反复的检查。发现是OpenProcess打开的方式不对。添加PROCESS_ALL_ACCESS，问题解决。查了一下微软的文档，发现这个参数在XP下可能是有问题的。所以建议XP和WIN7分别处理。代码如下：

//提权
VOID EnableDebugPriv(VOID)
{
HANDLE hToken;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0);
CloseHandle(hToken);
}
注入DLL
BOOL InjectDll(TCHAR* ptszDllFile, DWORD dwProcessId)
{
// 参数无效
if (NULL == ptszDllFile || 0 == ::_tcslen(ptszDllFile))
{
return FALSE;
}
// 指定 Dll 文件不存在
/**if (-1 == _access(ptszDllFile, 0))
{
return FALSE;
}**/
HANDLE hProcess = NULL;
HANDLE hThread = NULL;
DWORD dwSize = 0;
LPVOID ptszRemoteBuf = NULL;
LPTHREAD_START_ROUTINE lpThreadFun = NULL;
SIZE_T dwWritten;
HANDLE hModuleSnap = INVALID_HANDLE_VALUE;

// 获取模块快照
hModuleSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
if (INVALID_HANDLE_VALUE == hModuleSnap)
{
return FALSE;
}
MODULEENTRY32 me32;
memset(&me32, 0, sizeof(MODULEENTRY32));
me32.dwSize = sizeof(MODULEENTRY32);
// 开始遍历
if (FALSE == ::Module32First(hModuleSnap, &me32))
{
::CloseHandle(hModuleSnap);
return FALSE;
}
// 遍历查找指定模块
bool isFound = FALSE;
do
{
isFound = (0 == ::_tcsicmp(me32.szModule, ptszDllFile) || 0 == ::_tcsicmp(me32.szExePath, ptszDllFile));
if (isFound) // 找到指定模块
{
break;
}
} while (TRUE == ::Module32Next(hModuleSnap, &me32));
::CloseHandle(hModuleSnap);
if (TRUE == isFound)
{
return FALSE;
}
hProcess = NULL;
hThread = NULL;
// 获取目标进程句柄
hProcess = <span style="color:#ff0000;">::OpenProcess(PROCESS_ALL_ACCESS|PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessId);</span>
if (NULL == hProcess)
{
return FALSE;
}
// 在目标进程中分配内存空间
dwSize = lstrlenA(ptszDllFile) + 1;
ptszRemoteBuf = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);
if (NULL == ptszRemoteBuf)
{
::CloseHandle(hProcess);
return FALSE;
}
// 在目标进程的内存空间中写入所需参数(模块名)

if (FALSE == WriteProcessMemory(hProcess, ptszRemoteBuf, (LPVOID)ptszDllFile, dwSize, &dwWritten))
{
::VirtualFreeEx(hProcess, ptszRemoteBuf, dwSize, MEM_DECOMMIT);
::CloseHandle(hProcess);
return FALSE;
}
else if (dwWritten != dwSize) {
return FALSE;
}

// 从 Kernel32.dll 中获取 LoadLibrary 函数地址
#ifdef _UNICODE
lpThreadFun = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryW");
#else
HMODULE kernel = ::GetModuleHandle("Kernel32");
lpThreadFun = (PTHREAD_START_ROUTINE)::GetProcAddress(kernel, "LoadLibraryA");
#endif
if (NULL == lpThreadFun)
{
::VirtualFreeEx(hProcess, ptszRemoteBuf, dwSize, MEM_DECOMMIT);
::CloseHandle(hProcess);
return FALSE;
}
// 创建远程线程调用 LoadLibrary
hThread = ::CreateRemoteThread(hProcess, NULL, 0, lpThreadFun, ptszRemoteBuf, 0, NULL);
if (NULL == hThread)
{
::VirtualFreeEx(hProcess, ptszRemoteBuf, dwSize, MEM_DECOMMIT);
::CloseHandle(hProcess);
return FALSE;
}
// 等待远程线程结束
::WaitForSingleObject(hThread, INFINITE);
// 清理
::VirtualFreeEx(hProcess, ptszRemoteBuf, dwSize, MEM_DECOMMIT);
::CloseHandle(hThread);
::CloseHandle(hProcess);

return TRUE;
}