LPVOID pRemoteDllPath = VirtualAllocEx(hRemoteProcess,NULL,strlen(DllPath)+1,MEM

Question

LPVOID pRemoteDllPath = VirtualAllocEx(hRemoteProcess,NULL,strlen(DllPath)+1,MEM_COMMIT,PAGE_READWRITE);
DWORD Size;
if(WriteProcessMemory(hRemoteProcess,pRemoteDllPath,DllPath,strlen(DllPath)+1,&Size) == NULL){
::MessageBox(NULL,"WriteProcessMemory error","error",NULL);
}
执行LPVOID pRemoteDllPath = VirtualAllocEx(hRemoteProcess,NULL,strlen(DllPath)+1,MEM_COMMIT,PAGE_READWRITE);的时候pRemoteDllPath的值是0xcccccccc，执行if(WriteProcessMemory(hRemoteProcess,pRemoteDllPath,DllPath,strlen(DllPath)+1,&Size) == NULL)不知道什么原因pRemoteDllPath的值变成0x00ad0000

Answer 1

第一个0xcccccccc说明pRemoteDllPath在定义时没有初始化，你是用debug方式进行编译的吧？
pRemoteDllPath的值变成0x00ad0000说明VirtualAllocEx()函数申请到的堆地址起始地址为0x00ad0000