#include "stdafx.h"
#include <stdio.h>
#include <windows.h>
//定义管道句柄
HANDLE hReadPipe, hWritePipe, hWriteFile, hReadFile;

//线程1接受命令写入管道2
DWORD WINAPI Thread2( LPVOID lpParam )
{
SECURITY_ATTRIBUTES sa;
DWORD nByteWritten;
char recv_buff[1024];
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = NULL;
sa.bInheritHandle = TRUE;
//创建管道
CreatePipe(&hReadPipe,&hWriteFile,&sa,0);
while(true)
{
Sleep(250);
//输入命令
gets(recv_buff);
//写入管道
WriteFile(hWriteFile,recv_buff,strlen(recv_buff),&nByteWritten,NULL);
}
return 0;
}

//线程2读取管道1中的数据
DWORD WINAPI Thread1( LPVOID lpParam )
{
SECURITY_ATTRIBUTES sa;
DWORD len=0;
char send_buff[2048];
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = NULL;
sa.bInheritHandle = TRUE;
  CreatePipe(&hReadFile,&hWritePipe,&sa,0);
while (true)
{
//读取管道中的数据
ReadFile(hReadFile,send_buff,2048,&len,NULL);
send_buff[len]='\0';
if (len!=0)
{
printf("%s\n",send_buff);
}
}
return 0;
}

int main(int argc, char* argv[])
{
  HANDLE hThread[2];
DWORD dwThreadIdA,dwThreadIdB;
PROCESS_INFORMATION pi;
STARTUPINFO si;

//创建两个进程，用于读取写入管道中的数据，实现通信
hThread[0]=CreateThread(NULL, 0, Thread1, NULL, 0, &dwThreadIdA);
hThread[1]=CreateThread(NULL, 0, Thread2, NULL, 0, &dwThreadIdB);
//暂停1秒,为了确保两个线程中的管道创建完毕，因为下面要对管道进行操作
  Sleep(1000);
GetStartupInfo(&si);
si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
//使cmd的输入输出和管道关联
si.hStdInput = hReadPipe;
si.hStdError = hWritePipe;
si.hStdOutput = hWritePipe;
si.wShowWindow = SW_HIDE;
char cmdline[256]={0};
//得到系统路径
GetSystemDirectory(cmdline,sizeof(cmdline));
  strcat(cmdline,"\\cmd.exe");
//创建cmd进程
if (CreateProcess(cmdline, NULL, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi) == 0)
{
printf ("CreateProcess Error \n");
return 0;
}  
//等待线程结束
WaitForMultipleObjects(2,hThread,true,INFINITE);   
return 0;
}
]

[课程]FART 脱壳王！加量不加价！FART作者讲授！