使用CreateRemoteThread()注入DLL时遇无效句柄（错误6）问题求助

问题现象 #

• 向notepad.exe进程注入自制DLL时，CreateRemoteThread()返回NULL，调用GetLastError()得到错误6（无效句柄），注入失败。
• 注入自身进程（使用GetCurrentProcessId()）时注入成功；向自行编译的同架构进程注入也成功。
• 已关闭Windows Defender等杀毒软件，且以管理员身份运行程序。系统为64位ARM架构Windows 11，DLL与注入器均编译为x64位。

编译信息 #

编译DLL的命令：

x86_64-w64-mingw32-g++ -shared -o mydll.dll mydll.cpp

VS Code编译配置：

{
    "configurations": [
        {
            "name": "Win64",
            "includePath": [
                "${workspaceFolder}/**",
                "c:/**"
            ],
            "defines": [
                "_DEBUG",
                "UNICODE",
                "_UNICODE"
            ],
            "compilerPath": "C:\\msys64\\mingw64\\bin\\gcc.exe",
            "cStandard": "c17",
            "cppStandard": "gnu++17",
            "intelliSenseMode": "windows-gcc-x64"
        }
    ],
    "version": 4
}

代码示例 #

注入器代码（injection.cpp） #

#include <windows.h>
#include <iostream>

int main(int argc, char* argv[])
{if (argc < 2) {
        printf("(--) usage: dll.exe <pid>");
        return EXIT_FAILURE;
    }

    DWORD PID = atoi(argv[1]);
    // Path to the target process
    const char* targetProcess = "C:\\Windows\\System32\\notepad.exe";

    // Path to the DLL to inject
    const char* dllPath = "C:\\Users\\fagner\\Desktop\\windowsM\\dll\\dlli2.dll";

    // Load the target process
    HANDLE hProcess = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD, FALSE,PID);// if I replace process ID with GetCurrentProcessId() it works 
   
    if (hProcess == NULL)
    {
        std::cout << GetLastError() << std::endl;
        return 1;
    }
    
    
    std::cout<<"id: "<<hProcess<<std::endl;

    // Allocate memory for the DLL path in the target process
    LPVOID dllPathAddress = VirtualAllocEx(hProcess, NULL, strlen(dllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
    
    if (dllPathAddress == NULL)
    {
        std::cout << GetLastError() << std::endl;
        CloseHandle(hProcess);
        return 1;
    }

    // Write the DLL path into the target process
    if (!WriteProcessMemory(hProcess, dllPathAddress, dllPath, strlen(dllPath) + 1, NULL))
    {   std::cout << GetLastError() << std::endl;
        
        VirtualFreeEx(hProcess, dllPathAddress, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return 1;
    }

    // Get the address of the LoadLibraryA function
    HMODULE hKernel32 = GetModuleHandle(TEXT("kernel32.dll"));
    
    if (hKernel32 == NULL)
    {
        std::cout << GetLastError() << std::endl;
        VirtualFreeEx(hProcess, dllPathAddress, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return 1;
    }

    LPTHREAD_START_ROUTINE loadLibraryAddr = (LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32, "LoadLibraryA");
    
    if (loadLibraryAddr == NULL)
    {
        std::cout << GetLastError() << std::endl;
        VirtualFreeEx(hProcess, dllPathAddress, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return 1;
    }

    // Create a remote thread in the target process to load the DLL
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, loadLibraryAddr, dllPathAddress, 0, NULL);
   

    // when I use another process such as notepad createRemoteThread returns NULL
    if (hThread == NULL)
    {
        // when I target any other porcess GetLasterror() returns 6 which mean "invalid error"
        std::cout << GetLastError() << std::endl;
        VirtualFreeEx(hProcess, dllPathAddress, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return 1;
    }
    

    std::cout << "DLL injected successfully!" << std::endl;

    // Wait for the remote thread to finish
    WaitForSingleObject(hThread, INFINITE);

    // Clean up resources
    VirtualFreeEx(hProcess, dllPathAddress, 0, MEM_RELEASE);
    CloseHandle(hThread);
    CloseHandle(hProcess);

    return 0;
}

DLL代码（dlli.dll） #

#include <Windows.h>
#include <fstream>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        // Create a file called "injected.txt" in the current directory
        std::ofstream file("injected.txt");
        if (file.is_open())
        {
            file << "DLL Injected Successfully!" << std::endl;
            file.close();
        }
        break;
    }
    return TRUE;
}

内容的提问来源于stack exchange，提问作者fagner nunes