'远程DLL注入
'32位只用与32,64位只用与64位
#Include Once "win/mmsystem.bi"
Function RemoteDLLinjection(ByVal jID as DWord, ByVal nDLL as CWSTR) as String  '远程DLL注入
   Dim as Integer  lResult,i
   Dim as UInteger  Tt
   Dim lpThreadAttributes as SECURITY_ATTRIBUTES
   Dim hProcess as HANDLE, tmp_Addr as LPVOID, pfnStartAddr as FARPROC
   Dim DohThread as HANDLE
   hProcess = OpenProcess(&H1F0FFF, False, jID)
   'Print "hProcess=" & hProcess
   If hProcess <> 0 Then
      tmp_Addr = VirtualAllocEx(hProcess, Null, len(nDLL)*2+10, MEM_COMMIT Or MEM_RESERVE, &H4) '申请内存空间
'      Printa "tmp_Addr=" & hex(tmp_Addr)
      If tmp_Addr <> 0 Then
         If WriteProcessMemory(hProcess, tmp_Addr,nDLL.vptr, len(nDLL)*2, 0) > 0 Then '写入DLL文件（带文件夹路径）
            pfnStartAddr = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryW") '获取加载DLL函数入口
            'Print "pfnStartAddr=" & pfnStartAddr
            If pfnStartAddr <> 0 Then
               'For i=1 To 20
               DohThread = CreateRemoteThread(hProcess, @lpThreadAttributes, Null, Cast(LPTHREAD_START_ROUTINE, pfnStartAddr), tmp_Addr, 0, 0) '运行远程线程
               'If DohThread<>0 Then Exit For
               'DoEventsEX 100
               'Next
               'Print "DohThread=" & DohThread
               If DohThread <> 0 Then
                  'tt=timeGetTime
                  'DoEventsEX 1000
                  WaitForSingleObject DohThread, 5000
                  
                  CloseHandle DohThread '关闭线程句柄
                  
               Else
                  Function = "运行远程线程时失败，无法远程注入DLL"
               End If
            Else
               Function = "获取加载DLL函数入口失败，无法远程注入DLL"
            End If
         Else
            Function = "写入远程内存失败，无法远程注入DLL"
         End If
         VirtualFreeEx(hProcess, tmp_Addr, Null, &H8000&)  '清理内存
      Else
         Function = "申请内存空间入口失败，无法远程注入DLL"
      End If
      CloseHandle hProcess '关闭
   End If
   
End Function
