#define STRLEN 20

 typedef struct _DATA

 {

     DWORD dwLoadLibrary;

     DWORD dwGetProcAddress;

     DWORD dwGetModuleHandle;

     DWORD dwGetModuleFileName;

     char User32Dll[STRLEN];

     char MessageBox[STRLEN];

     char Str[STRLEN];

 }DATA, *PDATA;

 void CNoDllInjectDlg::OnBnClickedButtonInject()

 {

     // TODO: 在此添加控件通知处理程序代码

     UpdateData(TRUE);

     InjectCode(m_dwPid);

 }

 DWORD WINAPI RemoteThreadProc(LPVOID lpParam)

 {

     PDATA pData = (PDATA)lpParam;

     HMODULE (__stdcall *MyLoadLibrary)(LPCSTR);

     FARPROC (__stdcall *MyGetProcAddress)(HMODULE, LPCSTR);

     HMODULE (__stdcall *MyGetModuleHandle)(LPCSTR);

     int (__stdcall *MyMessageBox)(HWND, LPCSTR, LPCSTR, UINT);

     DWORD (__stdcall *MyGetModuleFileName)(HMODULE, LPSTR, DWORD);

     MyLoadLibrary = (HMODULE (__stdcall *)(LPCSTR))pData->dwLoadLibrary;

     MyGetProcAddress = (FARPROC (__stdcall *)(HMODULE, LPCSTR))pData->dwGetProcAddress;

     MyGetModuleHandle = (HMODULE (__stdcall *)(LPCSTR))pData->dwGetModuleHandle;

     MyGetModuleFileName = (DWORD (__stdcall *)(HMODULE, LPSTR, DWORD))pData->dwGetModuleFileName;

     HMODULE hModule = MyLoadLibrary(pData->User32Dll);

     MyMessageBox = (int (__stdcall *)(HWND, LPCSTR, LPCSTR, UINT))MyGetProcAddress(hModule, pData->MessageBox);

     char szModuleName[MAX_PATH] = {};

     MyGetModuleFileName(NULL, szModuleName, MAX_PATH);

     MyMessageBox(NULL, pData->Str, szModuleName, MB_OK);

     return ;

 }

 void CNoDllInjectDlg::InjectCode(DWORD dwPid)

 {

     DebugPrivilege();

     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);

     if (NULL == hProcess)

     {

         AfxMessageBox(_T("OpenProcess Error!"));

         return;

     }

     DATA Data = {};

     Data.dwLoadLibrary = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");

     Data.dwGetProcAddress = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetProcAddress");

     Data.dwGetModuleHandle = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetModuleHandleA");

     Data.dwGetModuleFileName = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetModuleFileNameA");

     strcpy(Data.User32Dll, "user32.dll");

     strcpy(Data.MessageBox, "MessageBoxA");

     strcpy(Data.Str, "Inject Code !!");

     LPVOID lpData = VirtualAllocEx(hProcess, NULL, sizeof(DATA), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

     DWORD dwWriteNum = ;

     WriteProcessMemory(hProcess, lpData, &Data, sizeof(DATA), &dwWriteNum);

     DWORD dwFunSize = 0x2000;

     LPVOID lpCode = VirtualAllocEx(hProcess, NULL, dwFunSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

     WriteProcessMemory(hProcess, lpCode, RemoteThreadProc, dwFunSize, &dwWriteNum);

     HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, , (LPTHREAD_START_ROUTINE)lpCode, lpData, , NULL);

     WaitForSingleObject(hRemoteThread, INFINITE);

     CloseHandle(hRemoteThread);

     CloseHandle(hProcess);

 }

 void CNoDllInjectDlg::DebugPrivilege(void)

 {

     HANDLE hToken = NULL;

     BOOL bRet = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken);

     if (TRUE == bRet)

     {

         TOKEN_PRIVILEGES tp;

         tp.PrivilegeCount = ;

         LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[].Luid);

         tp.Privileges[].Attributes = SE_PRIVILEGE_ENABLED;

         AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);

         CloseHandle(hToken);

     }

 }