代码:

//创建远程线程,处理session隔离
//xSpy 2012.07.26
//xp ~ 7 /x86 ~ x64 自适应

typedef void* (__stdcall *LPFN_KernelBaseGetGlobalData)(void);

HANDLE LibCreateRemoteThread
(
 __in HANDLE hProcess, 
 __in LPTHREAD_START_ROUTINE lpStartAddress,
 __in_opt LPVOID lpParameter, 
 __in DWORD dwCreationFlags,
 __out_opt LPDWORD lpThreadId
)
{ 
 OSVERSIONINFOEX stOSVersionInfoEx={0};
       LPFN_CreateRemoteThreadEx pCreateRemoteThreadEx=NULL;
       LPFN_KernelBaseGetGlobalData pKernelBaseGetGlobalData=NULL;
       UCHAR* pCreateRemoteThread=NULL;
       UCHAR* pGlobalData=NULL;
       UCHAR* pMisc=NULL;
       HMODULE hKernelBase=NULL;
       HMODULE hKernel32=NULL;
       HANDLE hNewThread=NULL;
       ULONG ulIndex=0;
       WORD wCode=0;

       do 
       {
             stOSVersionInfoEx.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
             if (!GetVersionEx((OSVERSIONINFO*)&stOSVersionInfoEx))
             {
                   break;
             }

             //vista以前的系统不存在这个问题
             if ( (stOSVersionInfoEx.dwMajorVersion < 6) || (NtCurrentProcess() == hProcess) )
             {
                   hNewThread = CreateRemoteThread(hProcess,NULL,0,lpStartAddress,lpParameter,dwCreationFlags,lpThreadId);
                   break;
             }

             if ( (stOSVersionInfoEx.dwMajorVersion == 6) && (0 == stOSVersionInfoEx.dwMinorVersion) )
             {
                   //vista
                   hKernel32 = LoadLibraryA("Kernel32.dll");
                   pCreateRemoteThread = (UCHAR*)GetProcAddress(hKernel32,"CreateRemoteThread");

                   for (ulIndex=0; ulIndex < 0x300;ulIndex += 1)
                   {
                         wCode = *((USHORT*)(pCreateRemoteThread + ulIndex));

                         #ifdef _WIN64
                         if (0x3D80 == wCode )
                         {
                               pMisc = (*((ULONG*)(pCreateRemoteThread + ulIndex + 2))) + (pCreateRemoteThread + ulIndex + 7);
                               break;
                         }
                         #else
                         if (0x1D38 == wCode )
                         {
                               pMisc = (UCHAR*)(*((ULONG*)(pCreateRemoteThread + ulIndex + 2)));
                               break;
                         }
                         #endif
                   }
             }
             else if ( (stOSVersionInfoEx.dwMajorVersion == 6) && (1 == stOSVersionInfoEx.dwMinorVersion) )
             {
                   //win7
                   hKernelBase = LoadLibraryW(L"KernelBase.dll");
                   if (NULL == hKernelBase)
                   {
                         break;
                   }
                   pKernelBaseGetGlobalData = (LPFN_KernelBaseGetGlobalData)GetProcAddress(hKernelBase,"KernelBaseGetGlobalData");
                   if (NULL == pKernelBaseGetGlobalData)
                   {
                         break;
                   }

                   pGlobalData = (UCHAR*)pKernelBaseGetGlobalData();
                   if (NULL == pGlobalData)
                   {
                         break;
                   }

                   #ifdef _WIN64
                   pMisc = pGlobalData + 0x5C;
                   #else
                   pMisc = pGlobalData + 0x30;
                   #endif
             }
             else
             {
                   //手上的win8 Build 8250 没有session 隔离
             }

             //////////////////////////////////////////////////////////////////////////
             if (NULL == pMisc)
             {
                   break;
             }

             //Patch
             *pMisc = 1;

             //xx
             hNewThread = CreateRemoteThread(hProcess,NULL,0,lpStartAddress,lpParameter,dwCreationFlags,lpThreadId);

             //UnPatch
             *pMisc = 0;

       } while (FALSE);

       if (NULL != hKernelBase)
       {
             FreeLibrary(hKernelBase);
             hKernelBase = NULL;
       }

       return hNewThread;
}

在vista 32/64 win7 32/64 下测试通过.

手上的win8 Build 8250 因为是测试版的原因,没有session 隔离,可以任意注入.
但是session判断语句仍然存在,直接跳走了,估计正式版会放开.