internal static bool InjectUnmanagedInternal(void *processHandle, string dllPath) { void *pLoadLibrary; void *pDllPath; void *threadHandle; uint exitCode; pLoadLibrary = NativeModule.GetFunctionAddressInternal(processHandle, "kernel32.dll", "LoadLibraryW"); // 获取LoadLibrary的函数地址 pDllPath = NativeProcess.AllocMemoryInternal(processHandle, (uint)dllPath.Length * 2 + 2, MemoryProtection.ExecuteRead); try { if (pDllPath == null) { return(false); } if (!NativeProcess.WriteStringInternal(processHandle, pDllPath, dllPath, Encoding.Unicode)) { return(false); } threadHandle = CreateRemoteThread(processHandle, null, 0, pLoadLibrary, pDllPath, 0, null); if (threadHandle == null) { return(false); } WaitForSingleObject(threadHandle, INFINITE); // 等待线程结束 GetExitCodeThread(threadHandle, out exitCode); return(exitCode != 0); // LoadLibrary返回值不为0则调用成功,否则失败 } finally { NativeProcess.FreeMemoryInternal(processHandle, pDllPath); } }