-
-
这注入为啥 WIN8 不支持呢
-
发表于: 2014-12-19 04:04
-
找不到原因了 WIN7 XP 都挺好的 APC 也不支持WIN8 这EIP 也是不支持 为啥？STARTUPINFOW si = { 0 };
PROCESS_INFORMATION pi = { 0 };
si.cb = sizeof(STARTUPINFOW);
::CreateProcessW(pProcessPath, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
CONTEXT ct = { 0 };
ct.ContextFlags = CONTEXT_ALL;
GetThreadContext(pi.hThread, &ct);
DWORD dwSize = sizeof(WCHAR) * 1024;
BYTE *pProcessMem = (BYTE *)::VirtualAllocEx(pi.hProcess, NULL, dwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
DWORD dwWrited = 0;
::WriteProcessMemory(pi.hProcess, (pProcessMem + 0x100), pDllPath, (wcslen(pDllPath) + 1) * sizeof(WCHAR), &dwWrited);
FARPROC pLoadLibraryW = (FARPROC)::GetProcAddress(::GetModuleHandle(L"Kernel32"), "LoadLibraryW");
BYTE ShellCode[32] = { 0 };
DWORD *pdwAddr = NULL;
ShellCode[0] = 0x60; // pushad
ShellCode[1] = 0x9c; // pushfd
ShellCode[2] = 0x68; // push
pdwAddr = (DWORD *)&ShellCode[3]; // ShellCode[3/4/5/6]
*pdwAddr = (DWORD)(pProcessMem + 0x100);
ShellCode[7] = 0xe8;
pdwAddr = (DWORD *)&ShellCode[8]; // ShellCode[8/9/10/11]
*pdwAddr = (DWORD)pLoadLibraryW - (DWORD)(pProcessMem + 7) - 5;
ShellCode[12] = 0x9d; // popfd
ShellCode[13] = 0x61; // popad
ShellCode[14] = 0xe9; // jmp
pdwAddr = (DWORD *)&ShellCode[15]; // ShellCode[15/16/17/18]
*pdwAddr = ct.Eip - (DWORD)(pProcessMem + 14) - 5;
::WriteProcessMemory(pi.hProcess, pProcessMem, ShellCode, sizeof(ShellCode), &dwWrited);
ct.Eip = (DWORD)pProcessMem;
::SetThreadContext(pi.hThread, &ct);
::ResumeThread(pi.hThread);
::CloseHandle(pi.hProcess);
::CloseHandle(pi.hThread);
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
|
|
|---|---|
|
|
|
|
|
|
|
|
哈哈，我调试了一下，在win7上就不行了，因为，因为，程序那时候刚起来，kernel32还没被映射进进程空间，xp是一开始就映射模块的了，你可以用windbg调调看
 。可以考虑hook入口点做事情就这鸟样 0:001:x86> u kernel32!LoadLibraryW Couldn't resolve error at 'kernel32!LoadLibraryW' 0:001:x86> lmf start end module name 00c60000 00c90000 notepad notepad.exe 740b0000 740b8000 wow64cpu C:\Windows\SYSTEM32\wow64cpu.dll 740c0000 7411c000 wow64win C:\Windows\SYSTEM32\wow64win.dll 74120000 7415f000 wow64 C:\Windows\SYSTEM32\wow64.dll 777a0000 77949000 ntdll ntdll.dll 77980000 77b00000 ntdll_77980000 ntdll.dll |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
你说的好复杂，不知道你为何如此设计
附带一个demo玩玩 偷偷的上传，然后偷偷地删掉
|
|
|
|
|
|
|
|
|
|
|
|
|
