csrss.exe进程用CretateRemoteThread无法注入DLL

#include 
#include  
#include 
#include 
#include 

#pragma comment(lib, "shlwapi.lib")

TCHAR ModuleFile[MAX_PATH];
FILE* fp;
TCHAR szText[128] = {0};
TCHAR szClass[64] = {0};
WNDPROC OldWindowProc;
HWND hWinLogon;
HMODULE hDll;

BOOL CALLBACK lpEnumWindowsProc(HWND hwnd, LPARAM lParam)
{
	if (IsWindow(hwnd))
	{
		::GetWindowText(hwnd, szText, _countof(szText));
		::GetClassName(hwnd, szClass, _countof(szClass));
		_ftprintf_s(fp, TEXT("%s\t\t%s\n"), szText, szClass);
		if (!_tcscmp(szText, TEXT("SAS window")))
		{
			hWinLogon = hwnd;
			//OldWindowProc = (WNDPROC)::SetWindowLongPtr(hwnd, GWL_WNDPROC, (LONG)NewWindowProc);
			//SendMessage(hwnd, WM_HOTKEY, 123456, NULL);
			return 0;
		}
	}
	return TRUE;
}

void ThreadFunc(void *Arg)
{
	_tfopen_s(&fp, TEXT("d:\\window.txt"), TEXT("wt,ccs=unicode"));
	HDESK hWinLogon = OpenDesktop(TEXT("Winlogon"), 0, FALSE, GENERIC_ALL);
	::EnumDesktopWindows(hWinLogon, lpEnumWindowsProc, NULL);
	CloseDesktop(hWinLogon);
	fclose(fp);
}

BOOL WINAPI DllMain(HINSTANCE hDllHandle, DWORD nReason, LPVOID Reserved)
{
	switch ( nReason )
	{
	case DLL_PROCESS_ATTACH:
		hDll = hDllHandle;
		GetModuleFileName(NULL, ModuleFile, _countof(ModuleFile));
		EnablePrivileges();

		if (StrStrI(ModuleFile, TEXT("winlogon.exe")))
		{
			_beginthread(ThreadFunc, 0, 0);
		}
		else if (StrStrI(ModuleFile, TEXT("Rundll32.exe")))
		{
			DWORD dwProcessId = 496;
			HANDLE hProcess = 0;  

			if (dwProcessId)
			{
				hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
			}
			if (!hProcess)
			{
				MessageBox(NULL, TEXT("进程句柄无效"), TEXT("进程句柄无效"), MB_ICONWARNING);
				return 0;
			}

			LPVOID Param = VirtualAllocEx(hProcess, 0, 256, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
			if (!Param)
			{
				MessageBox(NULL, TEXT("申请内存失败"), TEXT("申请内存失败"), MB_ICONWARNING);
				return 0;
			}

			GetModuleFileName(hDllHandle, ModuleFile, _countof(ModuleFile));

			if (!WriteProcessMemory(hProcess, Param, (LPVOID)ModuleFile, 256, NULL))
			{
				TCHAR sztmp[1024];
				_stprintf_s(sztmp, _countof(sztmp), TEXT("写入内存失败, 错误代码:%d, dll=%s"), GetLastError(), ModuleFile);

				MessageBox(NULL, sztmp, TEXT("写入内存失败"), MB_ICONWARNING);
				return 0;
			}
			HANDLE hThread = CreateRemoteThread(hProcess, 
				NULL, 
				NULL, 
				(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryW"),
				Param, 
				NULL, 
				NULL);

			if (hThread)
			{
				WaitForSingleObject(hThread, INFINITE);
			}
			else
			{
				TCHAR sztmp[1024];
				_stprintf_s(sztmp, _countof(sztmp), TEXT("创建远程线程失败, 错误代码:%d, dll=%s"), GetLastError(), ModuleFile);
				MessageBox(NULL, sztmp, TEXT("创建远程线程失败"), MB_ICONWARNING);
				return 0;				
			}
			VirtualFreeEx(hProcess, Param , 0, MEM_RELEASE);
			CloseHandle(hThread);
			CloseHandle(hProcess);
		}
		break;
	case DLL_THREAD_ATTACH:
		break;
	case DLL_THREAD_DETACH:
		break;
	case DLL_PROCESS_DETACH:
		//::SetWindowLongPtr(hWinLogon, GWL_WNDPROC, (LONG)OldWindowProc);
		break;
	default:
		break;
	}

	return 1;
}

EXTERN_C __declspec(dllexport) int Hook(void)
{
	return 1;
}

#include
int __stdcall DllMain(HINSTANCE ImageBase,DWORD Reason,DWORD EventType)
{
	if(Reason==DLL_PROCESS_ATTACH)
	{
		static char Text[256]="ProcessId:";
		_itoa(GetCurrentProcessId(),Text+10,10);
		OutputDebugStringA(Text);
	}
	return 1;
}
typedef ULONG(__stdcall*PRtlAdjustPrivilege)(ULONG Privilege,int Enable,int CurrentThread,int*Enabled);
typedef DWORD(__stdcall*PCsrGetProcessId)(void);
void __stdcall InjectCsrssW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow)
{
int b;PRtlAdjustPrivilege pRtlAdjustPrivilege;PCsrGetProcessId pCsrGetProcessId;HANDLE ProcessHandle;
HMODULE ntdll=GetModuleHandleW(L"ntdll.dll");
pRtlAdjustPrivilege=(PRtlAdjustPrivilege)GetProcAddress(ntdll,"RtlAdjustPrivilege");
pRtlAdjustPrivilege(20,1,0,&b);
pCsrGetProcessId=(PCsrGetProcessId)GetProcAddress(ntdll,"CsrGetProcessId");
ProcessHandle=OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,0,pCsrGetProcessId());
if(ProcessHandle)
{
	wchar_t FileName[260];void*Buffer;MEMORY_BASIC_INFORMATION mbi;
	VirtualQueryEx((HANDLE)-1,InjectCsrssW,&mbi,sizeof mbi);
	GetModuleFileNameW((HINSTANCE)mbi.AllocationBase,FileName,260);
	Buffer=VirtualAllocEx(ProcessHandle,0,260,MEM_RESERVE|MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	if(Buffer)
	{
		if(WriteProcessMemory(ProcessHandle,Buffer,FileName,260,0))
		{
			HANDLE ThreadHandle;
			ThreadHandle=CreateRemoteThread(ProcessHandle,0,0,(LPTHREAD_START_ROUTINE)LoadLibraryW,Buffer,0,0);
			if(ThreadHandle)
			{
				WaitForSingleObject(ThreadHandle,INFINITE);
				CloseHandle(ThreadHandle);
			}
		}
		VirtualFreeEx(ProcessHandle,Buffer,0,MEM_RELEASE);
	}
	CloseHandle(ProcessHandle);
}
}