• 这种方式可以注入到系统进程当中

#include <iostream>
#include <windows.h>
#include <Tlhelp32.h>
#include <stdio.h>
using namespace std;
/// <summary>
/// 根据进程名称获取进程信息
/// </summary>
/// <param name="info"></param>
/// <param name="processName"></param>
/// <returns></returns>
BOOL getProcess32Info(PROCESSENTRY32* info, const TCHAR processName[])
        HANDLE handle; //定义CreateToolhelp32Snapshot系统快照句柄
        handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);//获得系统快照句柄
        //PROCESSENTRY32 结构的 dwSize 成员设置成 sizeof(PROCESSENTRY32)
        info->dwSize = sizeof(PROCESSENTRY32);
        //调用一次 Process32First 函数，从快照中获取进程列表
        Process32First(handle, info);
        //重复调用 Process32Next，直到函数返回 FALSE 为止
        while (Process32Next(handle, info) != FALSE)
               if (wcscmp(processName, info->szExeFile) == 0)
                       return TRUE;
        return FALSE;
BOOL ZwCreateThreadExInjectDll(DWORD dwProcessId, const wchar_t* pszDllFileName)
        int pathSize = (wcslen(pszDllFileName) + 1) * sizeof(wchar_t);
        // 1.打开目标进程
        HANDLE hProcess = OpenProcess(
               PROCESS_ALL_ACCESS, // 打开权限
               FALSE, // 是否继承
               dwProcessId); // 进程PID
        if (NULL == hProcess)
               cout << L"打开目标进程失败！" << endl;
               return FALSE;
        // 2.在目标进程中申请空间
        LPVOID lpPathAddr = VirtualAllocEx(
               hProcess, // 目标进程句柄
               0, // 指定申请地址
               pathSize, // 申请空间大小
               MEM_RESERVE | MEM_COMMIT, // 内存的状态
               PAGE_READWRITE); // 内存属性
        if (NULL == lpPathAddr)
               cout << L"在目标进程中申请空间失败！" << endl;
               CloseHandle(hProcess);
               return FALSE;
        // 3.在目标进程中写入Dll路径
        if (FALSE == WriteProcessMemory(
               hProcess, // 目标进程句柄
               lpPathAddr, // 目标进程地址
               pszDllFileName, // 写入的缓冲区
               pathSize, // 缓冲区大小
               NULL)) // 实际写入大小
               cout << L"目标进程中写入Dll路径失败！" << endl;
               CloseHandle(hProcess);
               return FALSE;
        //4.加载ntdll.dll
        HMODULE hNtdll = LoadLibraryW(L"ntdll.dll");
        if (NULL == hNtdll)
               cout << L"加载ntdll.dll失败！" << endl;
               CloseHandle(hProcess);
               return FALSE;
        //5.获取LoadLibraryA的函数地址
        //FARPROC可以自适应32位与64位
        FARPROC pFuncProcAddr = GetProcAddress(GetModuleHandle(L"Kernel32.dll"),
               "LoadLibraryW");
        if (NULL == pFuncProcAddr)
               cout << L"获取LoadLibrary函数地址失败！" << endl;
               CloseHandle(hProcess);
               return FALSE;
        //6.获取ZwCreateThreadEx函数地址,该函数在32位与64位下原型不同
        //_WIN64用来判断编译环境 ，_WIN32用来判断是否是Windows系统
#ifdef _WIN64
        typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)(
               PHANDLE ThreadHandle,
               ACCESS_MASK DesiredAccess,
               LPVOID ObjectAttributes,
               HANDLE ProcessHandle,
               LPTHREAD_START_ROUTINE lpStartAddress,
               LPVOID lpParameter,
               ULONG CreateThreadFlags,
               SIZE_T ZeroBits,
               SIZE_T StackSize,
               SIZE_T MaximumStackSize,
               LPVOID pUnkown
#else
        typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)(
               PHANDLE ThreadHandle,
               ACCESS_MASK DesiredAccess,
               LPVOID ObjectAttributes,
               HANDLE ProcessHandle,
               LPTHREAD_START_ROUTINE lpStartAddress,
               LPVOID lpParameter,
               BOOL CreateSuspended,
               DWORD dwStackSize,
               DWORD dw1,
               DWORD dw2,
               LPVOID pUnkown
#endif 
        typedef_ZwCreateThreadEx ZwCreateThreadEx =
               (typedef_ZwCreateThreadEx)GetProcAddress(hNtdll, "ZwCreateThreadEx");
        if (NULL == ZwCreateThreadEx)
               cout << L"获取ZwCreateThreadEx函数地址失败！" << endl;
               CloseHandle(hProcess);
               return FALSE;
        //7.在目标进程中创建远线程
        HANDLE hRemoteThread = NULL;
        DWORD dwStatus = ZwCreateThreadEx(&hRemoteThread, PROCESS_ALL_ACCESS, NULL,
               hProcess,
               (LPTHREAD_START_ROUTINE)pFuncProcAddr, lpPathAddr, 0, 0, 0, 0, NULL);
        if (NULL == hRemoteThread)
               cout << L"目标进程中创建线程失败！" << endl;
               CloseHandle(hProcess);
               return FALSE;
        // 8.等待线程结束
        WaitForSingleObject(hRemoteThread, -1);
        // 9.清理环境
        VirtualFreeEx(hProcess, lpPathAddr, 0, MEM_RELEASE);
        CloseHandle(hRemoteThread);
        CloseHandle(hProcess);
        FreeLibrary(hNtdll);
        return TRUE;
const wchar_t dllPath[] = L"F:\\Dll1.dll";
int main()
        PROCESSENTRY32 info;
        // 查找指定进程名的PID
        if (getProcess32Info(&info, L"EditPlus.exe"))
               // 进程标识符PID。
               ZwCreateThreadExInjectDll(info.th32ProcessID, dllPath);
               cout << "注入成功" << endl;
        else {
               cout << "注入失败" << endl;
这是最简单的DLL注入的实现，在此基础，你可以完善MFC程序，想办法让获取DLL文件的路径和获取被注入程序的信息变得更加智能
你还可以修改DLL文件中的注入程序，执行其他的代码
                    1 简介网上确实有关于DLL注入的过程，但是很多写的都不全，或者内容有点老旧。DLL文件注入的原理是：接管被注入应用的控制权，并在应用程序运行的内存中开辟一条线程运行DLL文件中的入口函数的代码。项目需求：向一个.txt文件注入dll，然后会自动弹出一个窗口工具：VS20192 DLL动态链接库的编写在VS2019中新建项目-选择【动态链接库(DLL)】不要勾选：【将解决方案和项目放在同一目录中】创建完项目后，会有四个文件framework.hpch. hdllmain.
#include<stdio.h>
void UnInjectDLL(int PID) {
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID);
	//使用CE找到的想要卸载的DLL的地址
	LPVOID pRetAddress = (LPVOID)0x544B0000;
	//HMODULE hModule = LoadLibrary("KERNEL32.DLL")
#include <stdio.h> 
#include <tlhelp32.h> // 远程线程注入dll 
BOOL InjectDLL(DWORD dwPID, char *szDLLName); int main(int argc, char *argv[]) 
    printf("远程线程注入dll演示程序\n");     if (argc == 3) 
        DWORD dwPID = atoi(argv[1]); 
        char *szDLLName = argv[2]; 
        InjectDLL(dwPID, szDLLName); 
        printf("用法：InjectDLL.exe <PID> <DLLName>\n"); 
    }     return 0; 
} // 远程线程注入dll 
BOOL InjectDLL(DWORD dwPID, char *szDLLName) 
    HANDLE hProcess, hThread; 
    LPVOID lpBaseAddress; 
    LPTHREAD_START_ROUTINE lpStartAddress; 
    DWORD dwSize, dwThreadId; 
    char szPath[256]; 
    char szBuffer[1024];     // 打开进程 
    hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID); 
    if (hProcess == NULL) 
        printf("OpenProcess() Error: %d\n", GetLastError()); 
        return FALSE; 
    }     // 获取DLL的完整路径 
    GetFullPathName(szDLLName, 256, szPath, NULL);     // 在进程中申请虚拟内存 
    dwSize = strlen(szPath) + 1; 
    lpBaseAddress = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE); 
    if (lpBaseAddress == NULL) 
        printf("VirtualAllocEx() Error: %d\n", GetLastError()); 
        return FALSE; 
    }     // 将DLL路径写入到虚拟内存 
    int nBytesWritten; 
    WriteProcessMemory(hProcess, lpBaseAddress, szPath, dwSize, &nBytesWritten); 
    if (nBytesWritten != dwSize) 
        printf("WriteProcessMemory() Error: %d\n", GetLastError()); 
        return FALSE; 
    }     // 加载Kernel32.dll 
    HMODULE hKernel32 = GetModuleHandle("Kernel32"); 
    if (hKernel32 == NULL) 
        printf("GetModuleHandle() Error: %d\n", GetLastError()); 
        return FALSE; 
    }     // 获取LoadLibraryA函数地址 
    lpStartAddress = GetProcAddress(hKernel32, "LoadLibraryA"); 
    if (lpStartAddress == NULL) 
        printf("GetProcAddress() Error: %d\n", GetLastError()); 
        return FALSE; 
    }     // 创建远程线程 
    hThread = CreateRemoteThread(hProcess, NULL, 0, lpStartAddress, lpBaseAddress, 0, &dwThreadId); 
    if (hThread == NULL) 
        printf("CreateRemoteThread() Error: %d\n", GetLastError()); 
        return FALSE; 
    }     // 等待远程线程结束 
    WaitForSingleObject(hThread, INFINITE);     // 读取线程退出码 
    DWORD dwExitCode; 
    GetExitCodeThread(hThread, &dwExitCode); 
    if (dwExitCode == 0) 
        printf("LoadLibrary() Error: %d\n", GetLastError()); 
        return FALSE; 
    }     // 关闭句柄 
    CloseHandle(hProcess); 
    CloseHandle(hThread);     return TRUE; 
}我不能帮助你编写代码，但是我可以提供一些参考资料，帮助你编写远程线程注入dll代码。