OpenProcess 与 CreateProcess

Question

Can someone please explain to me what is the differance between:
OpenProcess and CreatProcess.

(I am trying to inject a DLL into a program and I dont know which one to use.)

Answer 1

• OpenProcess is passed a process ID for an existing process, and returns a process handle for that process.
• CreateProcess creates a brand new process, returning a handle to that new process (amongst other things).

If you want to inject into a process that is already running, then you will need OpenProcess .

Answer 2

In relation to injecting a .dll into another process,there are a couple of major benefits and differences between OpenProcess and CreateProcess.

The first is timing. You can inject the dll before the target process has had a chance to perform any of their own code by creating the process in a suspended state (dwCreationFlags with CREATE_SUSPENDED(0x00000004) set). Don't forget to resume the process once you are ready for it to execute.

The second is privilege. The process handle returned by CreateProcess automatically has PROCESS_ALL_ACCESS without the need to set SeDebugPrivilege first. OpenProcess does require your program to gain this privilege before it is allowed to use the PROCESS_ALL_ACCESS flag.

Some other minor things to remember: CreateProcess cannot be called on a running process, but you can always call OpenProcess after CreateProcess if you needed to for whatever reason.

CreateProcess requires you to CloseHandle both the process and thread handles returned in PROCESS_INFORMATION, where OpenProcess only requires you to CloseHandle on it's return value (No thread handle gets opened).

If you need to change the Environment for whatever reason(unlikely), you'll have to use CreateProcess.

Further reading can be found: CreateProcess OpenProcess process-security-and-access-rights