这个是创建子进程模块注射的VB版演示，本次演示进行了实际性的DLL注射。

　　TestDll_Thread.dll是我用ASM写的一个测试用DLL。

　　当它被加载到进程后，会自动启动一个线程，该线程每5秒自动弹出一个对话框。

　　只要创建的进程能正常启动，就表示代码没问题。

　　至于DLL是否注射成功，与所指定的DLL有关，还有与杀软的截拦有关。

　　只要保证我所提供的测试DLL在工程目录下，一般都会成功的。

　　下面给出来的代码中，不包含CONTEXT结构体的定义，请自行到《VB下的CONTEXT结构体》下载，或直接下载后面的工程文件。

Form1.frm

VERSION 5.00 Begin VB.Form Form1    Caption         =   "Form1"    ClientHeight    =   3090    ClientLeft      =   60    ClientTop       =   450    ClientWidth     =   4680    LinkTopic       =   "Form1"    ScaleHeight     =   3090    ScaleWidth      =   4680    StartUpPosition =   3  '窗口缺省 End Attribute VB_Name = "Form1" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Private Sub Form_Load()     Dim strDllPath As String     Dim startupinfo As startupinfo     Dim processinfo As PROCESS_INFORMATION     Dim bCreate As Boolean     Dim hProcess As Long, hThread As Long, hModule As Long     Dim context As context     Dim dwFuncAddr As Long, lpRemoteAddr As Long, lpStringAddr As Long, destaddr As Long     Dim cb As Integer     Dim buffer() As Byte          strDllPath = App.Path & IIf(Right(App.Path, 1) = "\", "", "\") & "TestDll_Thread.dll"     ZeroMemory startupinfo, Len(startupinfo)     startupinfo.cb = Len(startupinfo)     startupinfo.dwFlags = STARTF_USESHOWWINDOW     startupinfo.wShowWindow = SW_SHOW     bCreate = CreateProcess("c:\windows\system32\notepad.exe", vbNullString, ByVal 0, ByVal 0, 0, CREATE_SUSPENDED, ByVal 0, vbNullString, startupinfo, processinfo)     If bCreate Then         hProcess = processinfo.hProcess         hThread = processinfo.hThread         context.ContextFlags = CONTEXT_CONTROL         If GetThreadContext(hThread, context) <> 0 Then             hModule = GetModuleHandle("kernel32.dll")             If hModule > 0 Then                 dwFuncAddr = GetProcAddress(hModule, "LoadLibraryW")                 If dwFuncAddr > 0 Then                     lpStringAddr = VirtualAllocEx(hProcess, ByVal 0, ByVal MAX_PATH, MEM_COMMIT, PAGE_EXECUTE_READWRITE)                     WriteProcessMemory hProcess, ByVal lpStringAddr, ByVal StrPtr(strDllPath), MAX_PATH, ByVal 0                     cb = 17                     lpRemoteAddr = VirtualAllocEx(hProcess, ByVal 0, ByVal cb, MEM_COMMIT, PAGE_EXECUTE_READWRITE)                     ReDim buffer(cb - 1)                     buffer(0) = &H60                     buffer(1) = &H68                     CopyMemory buffer(2), lpStringAddr, 4                     buffer(6) = &HE8                     destaddr = dwFuncAddr - (lpRemoteAddr + 6) - 5                     CopyMemory buffer(7), destaddr, 4                     buffer(11) = &H61                     buffer(12) = &HE9                     destaddr = context.Eip - (lpRemoteAddr + 12) - 5                     CopyMemory buffer(13), destaddr, 4                     WriteProcessMemory hProcess, ByVal lpRemoteAddr, buffer(0), cb, ByVal 0                     context.Eip = lpRemoteAddr                     SetThreadContext hThread, context                     ResumeThread hThread                 End If                 CloseHandle hModule             End If         End If         CloseHandle hThread         CloseHandle hProcess     End If     End End Sub

modMain.bas

Attribute VB_Name = "modMain" Public Declare Sub ZeroMemory Lib "kernel32" Alias "RtlZeroMemory" (dest As Any, ByVal numBytes As Long) Public Declare Function CreateProcess Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Long, lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDriectory As String, lpStartupInfo As startupinfo, lpProcessInformation As PROCESS_INFORMATION) As Long Public Declare Function GetThreadContext Lib "kernel32" (ByVal hThread As Long, lpContext As context) As Long Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long) Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long Public Declare Function SetThreadContext Lib "kernel32" (ByVal hThread As Long, lpContext As context) As Long Public Declare Function ResumeThread Lib "kernel32" (ByVal hThread As Long) As Long Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Public Declare Function VirtualAllocEx Lib "kernel32.dll" (ByVal hProcess As Long, ByRef lpAddress As Any, ByRef dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long Public Declare Function VirtualFreeEx Lib "kernel32.dll" (ByVal hProcess As Long, ByRef lpAddress As Any, ByRef dwSize As Long, ByVal dwFreeType As Long) As Long Public Const STARTF_USESHOWWINDOW = &H1 Public Const SW_SHOW = 5 Public Const MEM_COMMIT As Long = &H1000 Public Const MEM_RELEASE As Long = &H8000 Public Const PAGE_READWRITE As Long = &H4 Public Const PAGE_EXECUTE_READWRITE As Long = &H40 Public Const CREATE_SUSPENDED = &H4 Public Const MAX_PATH = 260 Public Type startupinfo         cb As Long         lpReserved As String         lpDesktop As String         lpTitle As String         dwX As Long         dwY As Long         dwXSize As Long         dwYSize As Long         dwXCountChars As Long         dwYCountChars As Long         dwFillAttribute As Long         dwFlags As Long         wShowWindow As Integer         cbReserved2 As Integer         lpReserved2 As Long         hStdInput As Long         hStdOutput As Long         hStdError As Long End Type Public Type PROCESS_INFORMATION         hProcess As Long         hThread As Long         dwProcessId As Long         dwThreadId As Long End Type