不知道问题放在这里合适不合适，望版主见谅

typedef struct _RemoteParam
{
        char szMsg[12];     //MessageBox函数显示的字符串
        DWORD dwMessageBox;//MessageBox函数的入口地址
        DWORD dwExitThread;//ExitThread函数的入口地址
        DWORD dwSleep;                //Sleep函数的入口地址
        DWORD dwLoadLib;
        char szdll[256];
} RemoteParam, * PRemoteParam;

//定义MessageBox类型的函数指针
typedef int (__stdcall * PFN_MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, DWORD);

typedef int (__stdcall * PFN_EXITTHREAD)(DWORD);

typedef int (__stdcall * PFN_LOADLIBRARY)(LPCTSTR);

        RemoteParam remoteData;
        ZeroMemory(&remoteData, sizeof(RemoteParam));
       
        HINSTANCE hUser32 = LoadLibrary("User32.dll");
        HINSTANCE hKernel32 =  LoadLibrary("Kernel32.dll");

        remoteData.dwMessageBox = (DWORD)GetProcAddress(hUser32, "MessageBoxA");
        remoteData.dwExitThread = (DWORD)GetProcAddress(hKernel32,"ExitThread");
        remoteData.dwLoadLib = (DWORD)GetProcAddress(hKernel32,"LoadLibraryA");
        strcat(remoteData.szMsg, "Hello");
        strcat(remoteData.szdll, "D:\\project\\vc6\\csCrack\\bin\\ogc.dll");

        //在宿主进程中分配存储空间
        RemoteParam* pRemoteParam = (RemoteParam*)/*VirtualAllocExPtr*/VirtualAllocEx(pProcInfo->hProcess, 0, sizeof(RemoteParam), MEM_COMMIT, PAGE_READWRITE);
        if (!pRemoteParam)
        {
                MessageBox(NULL, "Alloc memory failed !", "Notice", MB_ICONINFORMATION | MB_OK);
                return 0;
        }
        //将字符串和MessageBox函数的入口地址写入宿主进程
        if (!WriteProcessMemory(pProcInfo->hProcess,pRemoteParam, &remoteData, sizeof(remoteData), 0))
        {
                MessageBox(NULL, "Write data to target process failed !", "Notice", MB_ICONINFORMATION | MB_OK);
                return 0;
        }
        hRemoteThread = CreateRemoteThread(        pProcInfo->hProcess, NULL, 0,
                (DWORD(__stdcall *)(void*))pRemoteThread, pRemoteParam, 0, &dwRemoteThreadID);       
        // wait until the thread finishes
        WaitForSingleObject(hRemoteThread, INFINITE);

//线程函数定义
DWORD __stdcall threadProc(LPVOID lParam)
{
        RemoteParam* pRP = (RemoteParam*)lParam;
        PFN_EXITTHREAD pfnExitThread = (PFN_EXITTHREAD)pRP->dwExitThread;
        PFN_MESSAGEBOX pfnMessageBox = (PFN_MESSAGEBOX)pRP->dwMessageBox;
        PFN_LOADLIBRARY pfnLoadLib = (PFN_LOADLIBRARY)pRP->dwLoadLib;
        pfnMessageBox(NULL, pRP->szdll, pRP->szdll, 0);
//        pfnLoadLib(pRP->szdll);
        pfnMessageBox(NULL, pRP->szMsg, pRP->szMsg, 0);
//        pfnExitThread(5);
        return 0;
}

这个通过一个结构把函数的ExitThread等函数地址传给远程线程，但是他们并不是在同一地址空间，难道在两个不同的进程中用LoadLibrary后GetProcAddress得到的某动态库的某个函数的地址是一样的么？很质疑

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课