问题描述

CreateRemoteThread返回非零值，WIN7 64位注入dll到explorer失败

2298为explorer的PID  DLL为64位

，process explorer查看不到explorer中有此DLL模块

// TODO: 在此添加控件通知处理程序代码

//This dll path should be relative to the target process or an absolute path
char* dll = "D:\ggg\TEST_TrayClock\x64Debug\TrayClockDll.dll";

//We need a handle to the process we will be injecting into
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 2298);
//Create the space needed for the dll we are going to be injecting
LPVOID lpSpace = (LPVOID)VirtualAllocEx(hProcess, NULL, strlen(dll), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

//Write inject.dll to memory of process
int n = WriteProcessMemory(hProcess, lpSpace, dll, strlen(dll), NULL);

HMODULE hModule = GetModuleHandle(L"kernel32.dll");
LPVOID lpBaseAddress = (LPVOID)GetProcAddress(hModule,"LoadLibraryA");
//Create Remote Thread using the address to LoadLibraryA and the space for the DLL
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpBaseAddress, lpSpace, NULL, NULL);

MessageBox(L"Inject");
//CDialogEx::OnOK();

解决方案

就你的需求来说，没有必要注入线程，windows shell接口允许你创建各种插件，光明正大。

解决方案二：

解决方案三：

类似软煤时间，将mytime.dll注入到exolorer

解决方案四：

你的相关dll是不是也都是64位的

解决方案五：

DLL是64位DLL，可通过全局钩子加到explorer中