问在Csrss中创建钩子进程

EN

function Inject(DLL: PAnsiChar; ProcessID: Cardinal):Boolean;
var
  lProcess: THandle;
  lMem:     Pointer;
  lLibrary: Pointer;
  Bytes:    NativeUInt;
  lThread:  DWORD;
  RemoteThread: DWORD;
begin
  Result := FALSE;
  if FileExists(DLL) then  { If Path of DLL is valid }
  begin
    lProcess:= OpenProcess(PROCESS_ALL_ACCESS,False,ProcessID); { Open process to DLL Inyect }
    if lProcess <>  0 then  { If Process is opened }
    begin
      lMem:= VirtualAllocEx(lProcess,nil,Length(DLL),MEM_COMMIT,PAGE_READWRITE); { Reserve virtual space for load DLL }
      if (Assigned(lMem)) then
      begin
        lLibrary:= GetProcAddress(GetModuleHandle('kernel32'),'LoadLibraryA');  { Parameter used for load library DLL in remote process }
        WriteProcessMemory(lProcess,lMem,Pointer(DLL),Length(DLL),Bytes); { Write DLL in remote space created with VirtualAllocEx }
        RemoteThread:= CreateRemoteThread(lProcess,nil,0,lLibrary,lMem,0,lThread); { Create Remote Thread for run DLL }
        if (RemoteThread <> 0) then
        begin
          WaitForSingleObject(RemoteThread, INFINITE); // Wait for the LoadLibraryA thread to finish
          CloseHandle(RemoteThread); { Close handle of Thread }
          Result := TRUE;
        end;
      end;
      CloseHandle(lProcess); { Close handle of process opened }
    end;
  end
end;

procedure DLLMain(dwReason: DWORD);
begin
  case dwReason of
  DLL_PROCESS_ATTACH:
  begin
    MessageBoxA(0,'Injected', 'Injected', MB_OK);
    //@TrampolineCreateProcess := InterceptCreate(@CsrCreateProcess, @HookCsrCreateProcess);
  end;
  end;
end;

begin
 DLLProc := @DLLMain;
 DLLMain(DLL_PROCESS_ATTACH);
end.