Find centralized, trusted content and collaborate around the technologies you use most.
Teams
Q&A for work
Connect and share knowledge within a single location that is structured and easy to search.
我有一个场景,我想用CreateProcessW这个CREATE_SUSPENDED标志创建一个新进程。之后,我使用CreateRemoteThread该调用注入一个 DLL LoadLibraryA。DLL 启动良好,注入 DLL 的进程等待 DLL 完成它的工作。然后新的过程就恢复了。这一切都很好。但是我注意到,如果注入的 DLL 调用LoadLibraryA ('advapi.dll')例如(在主线程/进程被暂停时),则模块不会加载到进程中。这是为什么?
CreateProcessW
CREATE_SUSPENDED
CreateRemoteThread
LoadLibraryA
LoadLibraryA ('advapi.dll')