能力值:
( LV13,RANK:240 )
|
-
-
2 楼
CreateRemoteThread 需要的函数是有一个参数的。否则堆栈不平衡啊~~不过你可以在函数开头先ADD,ESP,4试试
|
能力值:
( LV4,RANK:40 )
|
-
-
3 楼
虽然你多申请了一字节空间,但貌似不见ret的存在?
至于堆栈,系统会自动平衡的,不用add esp,4
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
pushad
pushfd
popad
pushfd
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
远程注入 要注意堆栈平衡,不能用全局变量
|
能力值:
( LV3,RANK:20 )
|
-
-
6 楼
这样怎么执行也会出错??
static DWORD WINAPI Msg(LPVOID pData)
{
::MessageBox(NULL,(LPCWSTR)"abce",NULL,NULL);
return 0;
}
static void afterMsg()
{
}
void CzhuruDlg::OnBnClickedButton1()
{
// TODO: 在此添加控件通知处理程序代码
DWORD dwRemoteProcessId;
HANDLE hRemoteProcess;
BOOL iReturnCode;
DWORD startadr,endadr;
dwRemoteProcessId=0x3154;
hRemoteProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_WRITE|PROCESS_VM_OPERATION,FALSE,dwRemoteProcessId );
char szBuffer[10]="abcdefg";
*(DWORD*)szBuffer=1000;//for test
void *pDataRemote =(char*) VirtualAllocEx( hRemoteProcess, 0, sizeof(szBuffer), MEM_COMMIT, PAGE_READWRITE );
//步骤5:写内容到目标进程中分配的变量空间
WriteProcessMemory( hRemoteProcess, pDataRemote, szBuffer,sizeof(szBuffer),NULL);
//计算代码大小
DWORD cbCodeSize=((LPBYTE)afterMsg - (LPBYTE) Msg);
//分配代码地址空间
PDWORD pCodeRemote = (PDWORD) VirtualAllocEx( hRemoteProcess, 0, cbCodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
//步骤7:写内容到目标进程中分配的代码地址空间
WriteProcessMemory( hRemoteProcess, pCodeRemote, &Msg, cbCodeSize, NULL);
HANDLE hThread = CreateRemoteThread(hRemoteProcess, NULL, 0, (LPTHREAD_START_ROUTINE) pCodeRemote,pDataRemote, 0 , NULL);
}
|
能力值:
( LV3,RANK:20 )
|
-
-
7 楼
救救我吧。
|