LunaTranslator/plugins/shareddllproxy/dllinject.cpp

int dllinjectwmain(int argc, wchar_t *argv[])
{

    for (int i = 1; i < argc - 1; i += 1)
    {
        auto PROCESS_INJECT_ACCESS = (PROCESS_CREATE_THREAD |
                                      PROCESS_QUERY_INFORMATION |
                                      PROCESS_VM_OPERATION |
                                      PROCESS_VM_WRITE |
                                      PROCESS_VM_READ);
        auto pid = _wtoi(argv[i]);
        auto hProcess = OpenProcess(PROCESS_INJECT_ACCESS, 0, pid);
        if (hProcess == 0)
            return 0;
        auto size = (wcslen(argv[argc - 1]) + 1) * sizeof(wchar_t);
        auto remoteData = VirtualAllocEx(hProcess,
                                         nullptr,
                                         size,
                                         MEM_RESERVE | MEM_COMMIT,
                                         PAGE_READWRITE);
        if (remoteData == 0)
            return 0;
        WriteProcessMemory(hProcess, remoteData, argv[argc - 1], size, 0);
        auto hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryW, remoteData, 0, 0);
        // if (hThread == 0) return 0;很奇怪，为0但是成功
        WaitForSingleObject(hThread, 10000);
        CloseHandle(hThread);
        VirtualFreeEx(hProcess, remoteData, size, MEM_RELEASE);
        CloseHandle(hProcess);
    }
    return 1;
}