The invention provides a method and a
system for injecting a 64-bit process into a remote 32-bit process. The
system comprises a function positioning layer and an injection
processing layer, the function positioning layer is used for switching a process space of a 32-bit
injector process from an x86 working mode to an x64 working mode, positioning a key
Native API function address in 64-bit ntdllrequired by a remote injection process in an x64 mode, switching to an x86 working mode after positioning is completed, and transmitting the key
Native API function address to an injection processinglayer; the injection
processing layer is used for packaging the information of the remote injection module into parameters required for calling the key
Native API function, and switching the process to an x64 working mode, calling a remote thread creation function to inject the remote module or the remote process into a 64-bit target process, and then switching to an x86 working mode. According tothe
system, the 32-bit remote process can be injected into the 32-bit process and the 64-bit process at the same time, and other auxiliary processes are not needed. The scheme is simple and convenient, so that hardware resources can play the maximum performance, the program execution efficiency is high, and function failure caused by process injection failure is avoided.