BOOL
APIENTRY
_WaitForDebugEvent(
_Out_ LPDEBUG_EVENT lpDebugEvent,
_In_ DWORD dwMilliseconds
)
{
if (firstdbg==2) //第一次wait,必然伪造成
CREATE_PROCESS_DEBUG_EVENT
{
firstdbg = 1;
wchar_t name[200];
ULONG base=getmo(_pid, name); //获取主模块的路径(name),返回为模块在内存中地址
memset(&lpDebugEvent->u.CreateProcessInfo, 0, sizeof(lpDebugEvent->u.CreateProcessInfo));
lpDebugEvent->dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT;
lpDebugEvent->dwProcessId = _pid;
lpDebugEvent->dwThreadId = _tid[0];//设置成主线程
lpDebugEvent->u.CreateProcessInfo.hFile =CreateFile(name, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, NULL, NULL);
lpDebugEvent->u.CreateProcessInfo.hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, lpDebugEvent->dwProcessId);
lpDebugEvent->u.CreateProcessInfo.lpBaseOfImage = (void*)base;
HANDLE t = OpenThread(THREAD_ALL_ACCESS, 0, lpDebugEvent->dwThreadId);
lpDebugEvent->u.CreateProcessInfo.lpThreadLocalBase = (void*)GetThreadStartAddress(t);//获取主线程起始地址
lpDebugEvent->u.CreateProcessInfo.hThread = t;
lpDebugEvent->u.CreateProcessInfo.fUnicode = 1;
SuspendThread(t);//伪造附加线程暂停的现象
return TRUE;
}
return FALSE;
}
bool _stdcall dbgcontiu(
_In_ DWORD dwProcessId,
_In_ DWORD dwThreadId,
_In_ DWORD dwContinueStatus
)
{
if (dwContinueStatus == DBG_CONTINUE)
{
if (firstdbg == 1)
{
firstdbg = 0;
HANDLE t = OpenThread(THREAD_ALL_ACCESS, 0, dwThreadId);
ResumeThread(t); //继续线程
CloseHandle(t);
return TRUE;
}
}
return TRUE;
}
