C++注入记事本

#include <iostream>;
using namespace std;
#include <windows.h>;
#include <tlhelp32.h>;
#include <tchar.h>;

BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam);
HWND GetMainWindow();

extern "C" BOOL APIENTRY DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    HWND hWnd;
    HWND hParWnd, hButWnd;
    int d, d1;
    switch (fdwReason)
    {
    case DLL_PROCESS_ATTACH:

        hWnd = GetMainWindow();
        if (hWnd)
            hWnd = ::FindWindowEx(hWnd, 0, TEXT("EDIT"), NULL);
        if (hWnd)
        {
            ::MessageBox(hWnd, TEXT("开始注入"), TEXT("提示"), MB_OK);
            for (int i = 0; i < 100; i++)
            {
                PostMessageW(hWnd, WM_CHAR, L'我', 1);
                PostMessageW(hWnd, WM_CHAR, L'喜', 1);
                PostMessageW(hWnd, WM_CHAR, L'欢', 1);
                PostMessageW(hWnd, WM_CHAR, L'你', 1);
                PostMessageW(hWnd, WM_KEYDOWN,VK_RETURN, 1);
            }
        }
        else
        {
            ::MessageBox(hWnd, TEXT("记事本不存在"), TEXT("提示"), MB_OK);
        }
        break;
    case DLL_PROCESS_DETACH:
        // detach from process
        break;

    case DLL_THREAD_ATTACH:
        // attach to thread
        break;

    case DLL_THREAD_DETACH:
        // detach from thread
        break;
    }
    return TRUE; // succesful
}

BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam)
{
    DWORD dwCurProcessId = *((DWORD*)lParam);
    DWORD dwProcessId = 0;

    GetWindowThreadProcessId(hwnd, &dwProcessId);
    if (dwProcessId == dwCurProcessId && GetParent(hwnd) == NULL)
    {
        *((HWND *)lParam) = hwnd;
        return FALSE;
    }
    return TRUE;
}


HWND GetMainWindow()
{
    DWORD dwCurrentProcessId = GetCurrentProcessId();
    if (!EnumWindows(EnumWindowsProc, (LPARAM)&dwCurrentProcessId))
    {
        return (HWND)dwCurrentProcessId;
    }
    return NULL;
}

#include <iostream>;
using namespace std;
#include <windows.h>;
#include <tlhelp32.h>;
#include <tchar.h>;

HANDLE hThread = NULL;
//进程名称查找进程ID
DWORD ProcessFind(LPCTSTR Exename) //进程名称
{
    HANDLE hProcess = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    if (!hProcess)
    {
        return FALSE;
    }
    PROCESSENTRY32 info;
    info.dwSize = sizeof(PROCESSENTRY32);
    if (!Process32First(hProcess, &info))
    {
        return FALSE;
    }
    while (TRUE)
    {
        /*for (int i = 0; i <= 25; i++) {
            char c = info.szExeFile[i];
            cout << c;
        }*/
        cout << endl;
        if (_tcscmp(info.szExeFile, Exename) == 0)
        {
            return info.th32ProcessID;//返回进程的ID
        }
        if (!Process32Next(hProcess, &info))
        {
            return FALSE;
        }
    }
    return FALSE;

}

int dll_inject() {
    //Dll文件地址,改成你自己的地址
    const TCHAR *pLocDll = TEXT("F:\工作\项目\控制台\injection\injection\x64\Release\injectionDll.dll");

    HANDLE hThread = NULL;

    //记事本进程名称
    DWORD ProcessID = ProcessFind(TEXT("notepad.exe"));
    if (!ProcessID) {
        cout << "查找不到当前程序" << endl;
    }
    else {
        //获取进程ID
        HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE, ProcessID);

        //获取dll大小
        SIZE_T PathSize = (_tcslen(TEXT("injectionDll.dll")) + 1) * sizeof(TCHAR);

        //申请内存
        LPVOID StartAddress = VirtualAllocEx(hProcess, NULL, PathSize, MEM_COMMIT, PAGE_READWRITE);

        //写入内存
        bool bSuccess = WriteProcessMemory(hProcess, StartAddress, TEXT("injectionDll.dll"), PathSize, 0);
        if (!bSuccess)
        {
            cout << "写入失败" << endl;
        }
        else {
            //在寄主申请内存
            LPVOID strRmt = VirtualAllocEx(hProcess, nullptr, MAX_PATH, MEM_COMMIT, PAGE_READWRITE);
            //获得注入DLL大小
            size_t lenLocDll = 2 * _tcslen(pLocDll);
            //判断寄主申请内存是否成功
            if (strRmt) {
                //把DLL写入寄主内存
                BOOL ret = WriteProcessMemory(hProcess, strRmt, pLocDll, lenLocDll, nullptr);
                //获得LoadLibraryW的函数地址以使用LoadLibrary函数
                LPTHREAD_START_ROUTINE loadlib = LPTHREAD_START_ROUTINE(GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW"));
                //注入
                hThread = CreateRemoteThread(hProcess, nullptr, 0, loadlib, LPVOID(strRmt), 0, nullptr);
            }
            
            /*
            HANDLE hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(_T("kernel32.dll")), "LoadLibrary"), StartAddress, 0, 0);*/

            if (hThread == NULL)
            {
                cout << "在进程中注入失败:";
                cout << GetLastError() << endl;
                return -1;
            }

            WaitForSingleObject(hThread, INFINITE);
            //到这里已经完成dll的加载即注入了，通过dll函数执行我们要完成的任务
            //释放
            VirtualFreeEx(hProcess, StartAddress,0, MEM_RELEASE);
            CloseHandle(hThread);
            CloseHandle(hProcess);
        }
    }
}
int main()
{
    dll_inject();
    system("pause");
}

注入DLL之后释放失败了，每次注入过一次之后，第二次注入都要重启记事本才能重新注入，有没有大神告诉我怎么解决