1 bool InjectDll(SIZE_T szPid)
 2 {
 3     //1.远线程注入
 4     HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,
 5         NULL, szPid);
 6 
 7     if (hProcess == INVALID_HANDLE_VALUE) {
 8         printf("打开进程失败！");
 9         return false;
10     }
11     //2.在远程进程中申请空间
12     LPVOID pszDllName = VirtualAllocEx(hProcess, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
13     //3.在远程进程中写入数据
14     TCHAR* szDllName = PATH;
15     if (!WriteProcessMemory(hProcess, pszDllName, szDllName, MAX_PATH, NULL)) {
16         return false;
17     }
18     //4.在远程进程中创建远程线程
19     HANDLE hlnjecthread = CreateRemoteThread(
20         hProcess,                                 //远程进程句柄
21         NULL,                                     //安全属性
22         0,                                         //栈大小
23         (LPTHREAD_START_ROUTINE)LoadLibrary,     //进程处理函数
24         pszDllName,                                 //传入参数
25         NULL,                                     //默认创建后的状态
26         NULL);                                     //线程ID
27 
28     if (hlnjecthread == NULL) {
29         return false;
30     }
31     //5.等待线程结束返回
32     DWORD dw = WaitForSingleObject(hlnjecthread, -1);
33     //6.获取线程退出码，即LoadLibray的返回值，即Dll的首地址
34     DWORD dwExitCode;
35     GetExitCodeThread(hlnjecthread, &dwExitCode);
36     HMODULE hMod = (HMODULE)dwExitCode;
37     //7.释放空间
38     if (!VirtualFreeEx(hProcess, pszDllName, 4096, MEM_DECOMMIT)) {
39         return false;
40     }
41     CloseHandle(hProcess);
42 
43     return true;
44 }

 1 BOOL CDllForPsApp::InitInstance()
 2 {
 3     CWinApp::InitInstance();
 4     //__debugbreak();
 5     OutputDebugString(L"注入成功！");
 6 
 7     CString Cstr;
 8     Cstr.Format(L"原资源:%d,原资源:%d",
 9         *g_pCapital, *g_pResources);
10     OutputDebugString(Cstr.GetBuffer());
11 
12     *g_pCapital = 5555555;
13     *g_pResources = 5555555;
14     
15     return TRUE;
16 }