学步园

环境：Windows NT/2000

实现方法：采用将动态连接库注入到其他进程中的方法来实现。

    为了便于选择窗口，我借用了另一个程序"2000下显示带*号"来选择窗口。
如果要在98下实现你可用钩子同样实现。
程序运行界面如图一：

BOOL WINAPI RT_CTRL_BTN(LPCSTR lpszLibFile, HWND hWnd, DWORD dwID, LPRECT pRtBtn, LPCTSTR szCaptionBtn)
{
	try {
		DWORD dwProcessID;
		GetWindowThreadProcessId(hWnd, &dwProcessID);
		HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION |
				PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessID );
		if (!hProcess){
			return FALSE;
		}

		INJECT_DLL InjectInfo;
		InjectDLL_Info(&InjectInfo, lpszLibFile, hWnd, dwID, pRtBtn, szCaptionBtn);

		LPBYTE lpThreadAddr=(LPBYTE)::VirtualAllocEx(hProcess, NULL, MAXINJECTSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

		LPINJECT_DLL param = (LPINJECT_DLL) VirtualAllocEx( hProcess, 0, sizeof(INJECT_DLL), MEM_COMMIT, PAGE_READWRITE );

		WriteProcessMemory(hProcess, lpThreadAddr,&RemoteControlThread,	MAXINJECTSIZE, 0);
		WriteProcessMemory( hProcess, param, &InjectInfo, sizeof(InjectInfo), 0 );

		DWORD dwThreadId;
		HANDLE hThread = ::CreateRemoteThread(hProcess,NULL,0,
			(unsigned long (__stdcall *)(void *))lpThreadAddr,
			param, 0, &dwThreadId);


		if (!hThread){
			CloseHandle(hProcess);
			VirtualFreeEx( hProcess, lpThreadAddr, 0, MEM_RELEASE );
			VirtualFreeEx( hProcess, param, 0, MEM_RELEASE );
			return FALSE;
		}
		else {
			CloseHandle(hThread);
			CloseHandle(hProcess);
			VirtualFreeEx( hProcess, lpThreadAddr, 0, MEM_RELEASE );
			VirtualFreeEx( hProcess, param, 0, MEM_RELEASE );
		}
	
	}
	catch (...){
		return FALSE;
	}
	return TRUE;
}