先做個注入器

// Injector.cpp
#include <windows.h>
#include <tlhelp32.h>
#include <tchar.h>
#include <iostream>

BOOL InjectDLL(DWORD dwPID, const wchar_t* dllPath)
{
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);
    if (!hProcess) {
        std::wcout << L"打開進程失敗" << std::endl;
        return FALSE;
    }

    LPVOID pRemoteBuf = VirtualAllocEx(hProcess, NULL, (wcslen(dllPath) + 1) * sizeof(wchar_t),
        MEM_COMMIT, PAGE_READWRITE);
    if (!pRemoteBuf) {
        CloseHandle(hProcess);
        return FALSE;
    }

    WriteProcessMemory(hProcess, pRemoteBuf, dllPath,
        (wcslen(dllPath) + 1) * sizeof(wchar_t), NULL);

    HMODULE hKernel32 = GetModuleHandle(L"kernel32.dll");
    LPTHREAD_START_ROUTINE pLoadLibraryW =
        (LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32, "LoadLibraryW");

    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
        pLoadLibraryW, pRemoteBuf, 0, NULL);

    WaitForSingleObject(hThread, INFINITE);

    VirtualFreeEx(hProcess, pRemoteBuf, 0, MEM_RELEASE);
    CloseHandle(hThread);
    CloseHandle(hProcess);

    return TRUE;
}

int wmain(int argc, wchar_t* argv[])
{
    if (argc < 3) {
        std::wcout << L"用法: Injector.exe <PID> <DLL路徑>" << std::endl;
        return -1;
    }

    DWORD pid = _wtoi(argv[1]);
    const wchar_t* dllPath = argv[2];

    if (InjectDLL(pid, dllPath)) {
        std::wcout << L"注入成功！" << std::endl;
    }
    else {
        std::wcout << L"注入失敗。" << std::endl;
    }

    return 0;
}

再來個測試的DLL

#include <windows.h>
#include <tchar.h>

DWORD WINAPI InjectThread(LPVOID)
{
    Sleep(1000); // 等待窗口初始化

    DWORD myPID = GetCurrentProcessId();

    HWND hwnd = GetTopWindow(NULL);
    while (hwnd)
    {
        DWORD pid = 0;
        GetWindowThreadProcessId(hwnd, &pid);
        if (pid == myPID)
        {
            // 找子窗口：Edit 控件
            HWND hEdit = FindWindowEx(hwnd, NULL, L"Edit", NULL);
            if (hEdit)
            {
                const wchar_t* text = L"Hello from Injected DLL!\r\n";
                SendMessage(hEdit, WM_SETTEXT, 0, (LPARAM)text);
                return 0;
            }
        }
        hwnd = GetNextWindow(hwnd, GW_HWNDNEXT);
    }

    MessageBox(NULL, L"? 找不到 Notepad 編輯框", L"DLL 注入失敗", MB_OK);
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    if (ul_reason_for_call == DLL_PROCESS_ATTACH)
    {
        DisableThreadLibraryCalls(hModule); // 避免額外 DLL_THREAD_ATTACH 回調(diào)
        CreateThread(NULL, 0, InjectThread, NULL, 0, NULL); // ? 在新線程中執(zhí)行邏輯
    }
    return TRUE;
}

找子窗口 查看控件類 用Visual Studio 2022的Tool => spy++ show window 拖動 狙擊鏡 到notepad window