请教CreateRemoteThread远程注入进程的问题

Question

我在控制台程序里用代码在宿主进程里注入一个MessageBox函数，能够成功运行，宿主进程显示对话框后一切正常，可是我用相同的代码在MFC创建的基于对话框程的序里，使用按钮来实现时，注入的对话框能够成功显示，但是一旦关闭注入的对话框，宿主进程就崩溃，我就纳闷了。我试过权限的问题，管理员权限运行也不行，在代码里改令牌也不行，请问到底什么原因导致的这种现象。以下是代码。
控制台程序

 #include <windows.h>

typedef int (__stdcall * PFN_MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, DWORD);

struct RemoteParam
{
    char sShow[12];         
    DWORD dwMessageBox;     
};

DWORD WINAPI threadProc(LPVOID lpParameter)
{
    RemoteParam *rp=(RemoteParam*)lpParameter;
    PFN_MESSAGEBOX pfnMessageBox=(PFN_MESSAGEBOX)(rp->dwMessageBox);
    pfnMessageBox(NULL,rp->sShow,rp->sShow,0);
    return 0;
}

void main()
{

    DWORD proId;
    const DWORD dwThreadSize=4096;

    HWND windHandle=::FindWindow(NULL,"MyGame");
    ::GetWindowThreadProcessId(windHandle,&proId);
    HANDLE proHandle=::OpenProcess(PROCESS_ALL_ACCESS,false,proId);

    void* allcAddr=::VirtualAllocEx(proHandle,0,dwThreadSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

    ::WriteProcessMemory(proHandle,allcAddr,&threadProc,dwThreadSize,0);

    HMODULE hUser32=::LoadLibrary("User32.dll");


    RemoteParam RemoteData;
    ZeroMemory(&RemoteData,sizeof(RemoteParam));
    RemoteData.dwMessageBox=(DWORD)::GetProcAddress(hUser32,"MessageBoxA");

    strcat(RemoteData.sShow,"Hello\0");

    RemoteParam* paramAndFunc=(RemoteParam*)::VirtualAllocEx(proHandle,0,sizeof(RemoteData),MEM_COMMIT,PAGE_READWRITE);

    ::WriteProcessMemory(proHandle,paramAndFunc,&RemoteData,sizeof(RemoteData),0);


    DWORD dwId;

    HANDLE hRemoteHandle=::CreateRemoteThread(proHandle,NULL,0,(LPTHREAD_START_ROUTINE)allcAddr,paramAndFunc,0,&dwId);

    CloseHandle(hRemoteHandle);  
    FreeLibrary(hUser32);  

}

MFC按钮消息响应函数里的代码

typedef int (__stdcall * PFN_MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, DWORD);

struct RemoteParam
{
    char sShow[12];     
    DWORD dwMessageBox;     
};

DWORD WINAPI threadProc(LPVOID lpParameter)
{
    RemoteParam *rp=(RemoteParam*)lpParameter;
    PFN_MESSAGEBOX pfnMessageBox=(PFN_MESSAGEBOX)(rp->dwMessageBox);
    pfnMessageBox(NULL,rp->sShow,rp->sShow,0);
    return 0;
}
void CMyDlg::OnButtonPourinto() 
{
    //enableDebugPriv();
    DWORD proId;
    const DWORD dwThreadSize=4096;
    HWND windHandle=::FindWindow(NULL,"MyGame");
    ::GetWindowThreadProcessId(windHandle,&proId);
    HANDLE proHandle=::OpenProcess(PROCESS_ALL_ACCESS,false,proId);

    void* allcAddr=::VirtualAllocEx(proHandle,0,dwThreadSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE
        );
    ::WriteProcessMemory(proHandle,allcAddr,&threadProc,dwThreadSize,0);
    RemoteParam RemoteData;
    ZeroMemory(&RemoteData,sizeof(RemoteParam));
    HINSTANCE hUser32 = LoadLibrary("User32.dll");
    RemoteData.dwMessageBox=(DWORD)::GetProcAddress(hUser32,"MessageBoxA");
    strcat(RemoteData.sShow,"Hello\0");
    RemoteParam* paramAndFunc=(RemoteParam*)::VirtualAllocEx(proHandle,0,sizeof(RemoteData),MEM_COMMIT,PAGE_READWRITE);

    ::WriteProcessMemory(proHandle,paramAndFunc,&RemoteData,sizeof(RemoteData),0);

    DWORD dwId;
    HANDLE hRemoteHandle=::CreateRemoteThread(proHandle,NULL,0,(LPTHREAD_START_ROUTINE)allcAddr,paramAndFunc,0,&dwId);

    CloseHandle(hRemoteHandle);  
    FreeLibrary(hUser32);  
} 

Answer 1

不会是Debug/Release版本的问题吧？