Windows 7 DLL Injection

I am trying to inject a dll into an existing process. I am trying to use the CreateRemoteThread LoadLibrary way. I understand how it works, but I cannot figure out why CreateRemoteThread is returning null (failing)... I am on Windows 7 so this may b开发者_StackOverflow社区e the reason, but I don't know for sure if it is.. Perhaps I need to set privaleges? My code is below:

#define DLL_NAME "message.dll"

void main()
{
    InjectDLL(1288, DLL_NAME);
}

BOOL InjectDLL(DWORD dwProcessId, LPCSTR lpszDLLPath)
{

    HANDLE  hProcess, hThread;
    LPVOID  lpBaseAddr, lpFuncAddr;
    DWORD   dwMemSize, dwExitCode;
    BOOL    bSuccess = FALSE;
    HMODULE hUserDLL;

    if((hProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_QUERY_INFORMATION|PROCESS_VM_OPERATION
        |PROCESS_VM_WRITE|PROCESS_VM_READ, FALSE, dwProcessId)))
    {
        dwMemSize = lstrlen(lpszDLLPath) + 1;
        if(lpBaseAddr = VirtualAllocEx(hProcess, NULL, dwMemSize, MEM_COMMIT, PAGE_READWRITE))
        {
            if(WriteProcessMemory(hProcess, lpBaseAddr, lpszDLLPath, dwMemSize, NULL))
            {
                if(hUserDLL = LoadLibrary(TEXT("kernel32.dll")))
                {
                    if(lpFuncAddr = GetProcAddress(hUserDLL, TEXT("LoadLibraryA")))
                    {
                        if(hThread = CreateRemoteThread(hProcess, NULL, 0, lpFuncAddr, lpBaseAddr, 0, NULL))
                        {
                            WaitForSingleObject(hThread, INFINITE);
                            if(GetExitCodeThread(hThread, &dwExitCode)) {
                                bSuccess = (dwExitCode != 0) ? TRUE : FALSE;
                            }
                            CloseHandle(hThread);
                        }
                    }
                    FreeLibrary(hUserDLL);
                }
            }
            VirtualFreeEx(hProcess, lpBaseAddr, 0, MEM_RELEASE);
        }
        CloseHandle(hProcess);
    }

    return bSuccess;
}

yes you need privileges before you open the precess, here's the code:

 int GimmePrivileges(){ 
HANDLE Token;  
TOKEN_PRIVILEGES tp;      
if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &Token)    
{ 
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);     
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL);    
}      
}   

An other thing... this code is confusing!!! you need to synthesize!