void MyCreateRemoteThread( HANDLE hProcess,
LPTHREAD_START_ROUTINE lpThreadProc,
LPVOID lpContext)
/*
*/
{
BOOL bRet;
DWORD pid,tid,orgEip;
HANDLE hThread;
PVOID mem_base;
CONTEXT ct;
HMODULE hModule = GetModuleHandle( _T("kernel32.dll"));
char buffer[] = {
0x60,//pushad
0xe8,0x10,0x00,0x00,0x00,//call $ + 0x10
0x00,0x00,0x00,0x00, //orgEip
0x00,0x00,0x00,0x00, //addr of CreateThread
0x00,0x00,0x00,0x00, //thread_proc
0x00,0x00,0x00,0x00, //lpcontext
0x5b, //pop ebx
0x33,0xc0, //xor eax,eax
0x50, //push eax
0x50, //push eax
0xff,0x73,0x0c, //push [ebx+0c]
0xff,0x73,0x08, //push [ebx+08]
0x50, //push eax
0x50, //push eax
0x8b,0x03, //mov eax,[ebx]
0x89,0x5b,0x28, //????// mov [ebx+xx],ebx
0xff,0x53,0x04, //call [ebx+4]
0x61, //popad
0xff,0x25,0x00,0x00,0x00,0x00};//jmp to orgEip
pid = GetProcessId( hProcess );
tid = FindMainThreadId( pid );
hThread = OpenThread( THREAD_ALL_ACCESS,FALSE,tid );
SuspendThread( hThread );
ct.ContextFlags = CONTEXT_FULL;
GetThreadContext( hThread,&ct );
orgEip = ct.Eip;
mem_base = VirtualAllocEx( hProcess,NULL,sizeof(buffer),MEM_COMMIT,PAGE_EXECUTE_READWRITE );
//printf("base:%x\n",mem_base );
*(PDWORD)(buffer + 6) = orgEip;
*(PDWORD)(buffer + 10) = GetProcAddress( hModule,"CreateThread");
*(PDWORD)(buffer + 14) = lpThreadProc;
*(PDWORD)(buffer + 18) = lpContext;
WriteProcessMemory( hProcess,mem_base,buffer,sizeof(buffer),NULL);
ct.ContextFlags = CONTEXT_FULL;
ct.Eip = (DWORD)mem_base;
SetThreadContext( hThread,&ct );
ResumeThread( hThread );
CloseHandle( hThread );
return;
}
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
学习了，好想法，好智慧。原来好的想法都是在无聊的时候才想出来的
