HANDLE __stdcall CreateRemoteThreadEx(HANDLE a_hProcess, LPSECURITY_ATTRIBUTES a_lpThreadAttributes, SIZE_T a_dwStackSize, LPTHREAD_START_ROUTINE a_lpStartAddress, LPVOID a_lpParameter, DWORD a_dwCreationFlags, LPPROC_THREAD_ATTRIBUTE_LIST a_lpAttributeList, LPDWORD a_lpThreadId)
{
int
nRet;
/
/
eax
DWORD v_nFlag;
/
/
er15
char bFlag;
/
/
si
NTSTATUS NtRet6;
/
/
eax
NTSTATUS NtRet5;
/
/
ebx
int
v_bIsSuspendThread2;
/
/
edx
SIZE_T v_dwStackSize1;
/
/
rax
HMODULE v_hModule_csrsrv;
/
/
rax
__int64 (__fastcall
*
v_lpfuncCsrCreateRemoteThread)(HANDLE, CLIENT_ID
*
);
/
/
rax
NTSTATUS NtRet2;
/
/
eax
NTSTATUS NtRet4;
/
/
eax
NTSTATUS NtRet3;
/
/
ecx
NTSTATUS NtRet1;
/
/
ebx
int
v23;
/
/
[rsp
+
A0h] [rbp
-
548h
]
char v_bIsSuspendThread1;
/
/
[rsp
+
B0h] [rbp
-
538h
]
char v_bflag;
/
/
[rsp
+
B1h] [rbp
-
537h
]
HANDLE v_ThreadHandle;
/
/
[rsp
+
B8h] [rbp
-
530h
] BYREF
__int64 v27;
/
/
[rsp
+
C0h] [rbp
-
528h
] BYREF
HANDLE v_hProcessHandle;
/
/
[rsp
+
C8h] [rbp
-
520h
] BYREF
PVOID Context[
2
];
/
/
[rsp
+
D0h] [rbp
-
518h
] BYREF
PACTIVATION_CONTEXT_STACK Stack;
/
/
[rsp
+
E0h] [rbp
-
508h
] BYREF
int
v31;
/
/
[rsp
+
E8h] [rbp
-
500h
] BYREF
PTEB Teb;
/
/
[rsp
+
F0h] [rbp
-
4F8h
] BYREF
ULONG SuspendCount;
/
/
[rsp
+
F8h] [rbp
-
4F0h
] BYREF
SIZE_T v_dwStackSize;
/
/
[rsp
+
100h
] [rbp
-
4E8h
]
LPVOID v_lpParameter;
/
/
[rsp
+
108h
] [rbp
-
4E0h
]
LPTHREAD_START_ROUTINE v_lpStartAddress;
/
/
[rsp
+
110h
] [rbp
-
4D8h
]
__int64 v_ThreadAttributes;
/
/
[rsp
+
118h
] [rbp
-
4D0h
] BYREF
CLIENT_ID v_tagClientID;
/
/
[rsp
+
120h
] [rbp
-
4C8h
] BYREF
unsigned __int64 Cookie;
/
/
[rsp
+
130h
] [rbp
-
4B8h
] BYREF
PROCESS_BASIC_INFORMATION v_tagProcessInformation;
/
/
[rsp
+
138h
] [rbp
-
4B0h
] BYREF
SECTION_IMAGE_INFORMATION v_tagSectionImageinformation;
/
/
[rsp
+
170h
] [rbp
-
478h
] BYREF
__int64 v42;
/
/
[rsp
+
1B0h
] [rbp
-
438h
] BYREF
__int64 v_aryAttributeList[
122
];
/
/
[rsp
+
1E0h
] [rbp
-
408h
] BYREF
void
*
retaddr;
/
/
[rsp
+
5E8h
] [rbp
+
0h
]
/
/
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
v_lpStartAddress
=
a_lpStartAddress;
v_dwStackSize
=
a_dwStackSize;
v_lpParameter
=
a_lpParameter;
v_bflag
=
0
;
*
(_OWORD
*
)Context
=
0i64
;
Stack
=
0i64
;
v_tagClientID
=
0i64
;
v_bIsSuspendThread1
=
0
;
v_ThreadHandle
=
0i64
;
if
( (a_dwCreationFlags &
0xFFFEFFFB
) !
=
0
)
/
/
检查a_dwCreationFlags是否被传入了无效参数,如果参数无效返回错误
0xC000000D
(STATUS_INVALID_PARAMETER)
{
NtRet3
=
-
1073741811
;
FUNC_END_ERROR:
BaseSetLastNTError(NtRet3);
return
0i64
;
}
nRet
=
BaseFormatObjectAttributes(&v42, a_lpThreadAttributes,
0i64
, &v_ThreadAttributes);
/
/
通过lpThreadAttributes参数格式化v_ThreadAttributes参数,为三环进
0
环做准备
if
( nRet <
0
)
/
/
检查返回值是否有效,小于
0
返回错误
goto LABEL_49;
v_aryAttributeList[
1
]
=
65539i64
;
v_aryAttributeList[
2
]
=
16i64
;
v_aryAttributeList[
4
]
=
0i64
;
v_aryAttributeList[
3
]
=
(__int64)&v_tagClientID;
v_aryAttributeList[
5
]
=
65540i64
;
v_aryAttributeList[
6
]
=
8i64
;
v_aryAttributeList[
8
]
=
0i64
;
v_aryAttributeList[
7
]
=
(__int64)&Teb;
LODWORD(v27)
=
2
;
if
( a_lpAttributeList )
/
/
判断是否有扩展参数列表,如果有扩展参数列表就使用BasepConvertWin32AttributeList进行转换
{
v23
=
30
;
nRet
=
BasepConvertWin32AttributeList(
(
int
*
)a_lpAttributeList,
1
,
(__int64)&v31,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
0i64
,
(__int64)v_aryAttributeList,
(__int64)&v27,
v23);
if
( nRet <
0
)
/
/
检查是否转换成功,如果nRet<
0
返回失败
{
LABEL_49:
NtRet3
=
nRet;
goto FUNC_END_ERROR;
}
}
v_aryAttributeList[
0
]
=
32i64
*
(unsigned
int
)v27
+
8
;
/
/
给index
=
0
的位置赋值, 如果没有扩展参数该值为:
2
*
32
+
8
=
72
v_nFlag
=
a_dwCreationFlags &
0x10000
;
/
/
给标志赋值: INHERIT_PARENT_AFFINITY(继承)
=
1
/
/
其他
=
0
v_hProcessHandle
=
0i64
;
bFlag
=
1
;
if
( a_hProcess !
=
(HANDLE)
-
1i64
)
/
/
判断句柄是否是
-
1
/
/
{
if
( NtDuplicateObject(
/
/
将进程句柄复制一份,为内核准备参数,并将句柄的引用数
+
1
(HANDLE)
0xFFFFFFFFFFFFFFFFi64
,
a_hProcess,
(HANDLE)
0xFFFFFFFFFFFFFFFFi64
,
&v_hProcessHandle,
0x402u
,
0
,
0
) >
=
0
)
a_hProcess
=
v_hProcessHandle;
/
/
如果句柄复制成功,传入内核
NtRet1
=
NtQueryInformationProcess(a_hProcess, ProcessBasicInformation, &v_tagProcessInformation,
0x30u
,
0i64
);
/
/
检索指向可用于确定指定进程是否正在调试的 PEB 结构的指针,以及系统用于标识指定进程的唯一值。
if
( NtRet1 >
=
0
&& (HANDLE)v_tagProcessInformation.UniqueProcessId !
=
NtCurrentTeb()
-
>ClientId.UniqueProcess )
/
/
判断句柄是否属于当前的进程(用来区分是否是远程线程创建)
{
bFlag
=
0
;
NtRet1
=
NtQueryInformationProcess(
a_hProcess,
ProcessImageInformation,
&v_tagSectionImageinformation,
0x40u
,
0i64
);
/
/
调用函数获取hProcess的SECTION_IMAGE_INFORMATION结构
if
( NtRet1 >
=
0
&& v_tagSectionImageinformation.SubSystemType
-
2
>
1
)
NtRet1
=
-
1073741823
;
/
/
如果返回值正确,但是SubSystemType类型错误,返回
0xC0000001
(STATUS_UNSUCCESSFUL)
}
if
( NtRet1 <
0
)
/
/
如果返回错误,关闭句柄,返回错误信息
{
if
( v_hProcessHandle )
NtClose(v_hProcessHandle);
NtRet3
=
NtRet1;
goto FUNC_END_ERROR;
}
}
if
( bFlag )
{
NtRet6
=
RtlQueryInformationActivationContext(
1u
,
0i64
,
0i64
,
1u
, Context,
0x10ui64
,
0i64
);
NtRet5
=
NtRet6;
if
( NtRet6 <
0
)
{
/
/
函数返回值错误,释放资源并返回
DbgPrint_0(
"SXS: %s - Failing thread create because RtlQueryInformationActivationContext() failed with status %08lx\n"
,
"CreateRemoteThreadEx"
,
(unsigned
int
)NtRet6);
goto RELEASE_RET;
}
if
( !g_bFlag && !NtCurrentTeb()
-
>SubProcessTag && (!Context[
0
] || ((__int64)Context[
1
] &
1
) !
=
0
) )
{
v_bIsSuspendThread1
=
0
;
goto LABEL_11;
}
v_bIsSuspendThread1
=
1
;
}
if
( !v_bIsSuspendThread1 )
{
LABEL_11:
v_bIsSuspendThread2
=
0
;
if
( (a_dwCreationFlags &
4
)
=
=
0
)
goto LABEL_17;
}
v_bIsSuspendThread2
=
1
;
LABEL_17:
v31
=
v_bIsSuspendThread2;
v_dwStackSize1
=
v_dwStackSize;
if
( v_nFlag )
v_dwStackSize1
=
0i64
;
NtRet5
=
NtCreateThreadEx(
/
/
进入内核创建线程
&v_ThreadHandle,
/
/
_Out_ PHANDLE ThreadHandle,
0x1FFFFFi64
,
/
/
_In_ ACCESS_MASK DesiredAccess, STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL
v_ThreadAttributes,
/
/
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
a_hProcess,
/
/
_In_ HANDLE ProcessHandle,
v_lpStartAddress,
/
/
_In_ PVOID StartRoutine,
v_lpParameter,
/
/
_In_opt_ PVOID Argument,
v_bIsSuspendThread2,
/
/
_In_ ULONG CreateFlags, 挂起线程或者正常 THREAD_CREATE_FLAGS_CREATE_SUSPENDED
0x00000001
0i64
,
/
/
_In_opt_ ULONG_PTR ZeroBits,
v_dwStackSize1,
/
/
_In_opt_ SIZE_T StackSize,
v_dwStackSize &
-
(__int64)(v_nFlag !
=
0
),
/
/
_In_opt_ SIZE_T MaximumStackSize, 如果是通过父进程创建最大栈大小不变,否则为
0
v_aryAttributeList);
/
/
_In_opt_ PVOID AttributeList
if
( NtRet5 <
0
)
goto RELEASE_RET;
if
( !v_bIsSuspendThread1 )
goto LABEL_21;
if
( NtCurrentTeb()
-
>SubProcessTag )
Teb
-
>SubProcessTag
=
NtCurrentTeb()
-
>SubProcessTag;
if
( Context[
0
] && ((__int64)Context[
1
] &
1
)
=
=
0
)
{
NtRet2
=
RtlAllocateActivationContextStack(&Stack);
/
/
分配可激活的线程上下文栈
NtRet5
=
NtRet2;
if
( NtRet2 <
0
)
{
DbgPrint_0(
"SXS: %s - Failing thread create because RtlAllocateActivationContextStack() failed with status %08lx\n"
,
"CreateRemoteThreadEx"
,
(unsigned
int
)NtRet2);
goto RELEASE_RET;
}
Teb
-
>ActivationContextStackPointer
=
Stack;
NtRet4
=
RtlActivateActivationContextEx(
1u
, Teb, Context[
0
], &Cookie);
/
/
激活线程上下文
NtRet5
=
NtRet4;
if
( NtRet4 <
0
)
{
DbgPrint_0(
"SXS: %s - Failing thread create because RtlActivateActivationContextEx() failed with status %08lx\n"
,
"CreateRemoteThreadEx"
,
(unsigned
int
)NtRet4);
goto RELEASE_RET;
}
v_bflag
=
1
;
}
if
( !g_bFlag
|| (v_hModule_csrsrv
=
GetModuleHandleA(
"csrsrv"
),
/
/
获取模块句柄
(v_lpfuncCsrCreateRemoteThread
=
(__int64 (__fastcall
*
)(HANDLE, CLIENT_ID
*
))GetProcAddressForCaller(
/
/
获取函数地址
v_hModule_csrsrv,
"CsrCreateRemoteThread"
,
retaddr))
=
=
0i64
)
|| (NtRet5
=
v_lpfuncCsrCreateRemoteThread(v_ThreadHandle, &v_tagClientID), NtRet5 >
=
0
) )
/
/
调用函数,将线程句柄传入获取ClientID
/
/
CsrCreateRemoteThread例程为不属于当前NT进程的NT线程创建CSR线程对象
{
LABEL_21:
if
( a_lpThreadId )
*
a_lpThreadId
=
(DWORD)v_tagClientID.UniqueThread;
/
/
获取线程
ID
if
( v_bIsSuspendThread1 && (a_dwCreationFlags &
4
)
=
=
0
)
/
/
CREATE_SUSPENDED
0x00000004
/
/
创建线程时,挂起标志为
1
,并且标志参数表示不挂起,恢复线程状态,修改线程挂起数量
NtResumeThread(v_ThreadHandle, &SuspendCount);
}
RELEASE_RET:
if
( Context[
0
] )
RtlReleaseActivationContext(Context[
0
]);
/
/
释放线程上下文
if
( v_hProcessHandle )
/
/
关闭进程句柄
NtClose(v_hProcessHandle);
if
( NtRet5 <
0
)
{
if
( v_bflag && Context[
0
] )
RtlReleaseActivationContext(Context[
0
]);
if
( Stack )
RtlFreeActivationContextStack(Stack);
/
/
释放栈空间
if
( v_ThreadHandle )
{
NtTerminateThread(v_ThreadHandle, NtRet5);
/
/
终止线程
NtClose(v_ThreadHandle);
}
BaseSetLastNTError(NtRet5);
/
/
设置NT错误信息
v_ThreadHandle
=
0i64
;
}
return
v_ThreadHandle;
/
/
返回线程句柄
}