/
/
子进程要执行的代码
void ChildProc()
{
MessageBox(NULL, L
"This is a child process!"
, L
"DebugMe2"
, MB_OK);
ExitProcess(
0
);
}
/
/
主函数
void _tmain(
int
argc, TCHAR
*
argv[])
{
TCHAR szPath[MAX_PATH]
=
{
0
, };
STARTUPINFO si
=
{ sizeof(STARTUPINFO), };
PROCESS_INFORMATION pi
=
{
0
, };
CONTEXT ctx
=
{
0
, };
_tprintf(L
"This is a parent process!\n"
);
if
(!GetModuleFileName(NULL, szPath, sizeof(TCHAR)
*
MAX_PATH))
{
printf(
"GetModuleFileName() failed! [%d]\n"
, GetLastError());
return
;
}
/
/
创建子进程
if
(!CreateProcess(
szPath,
NULL,
NULL,
NULL,
FALSE,
CREATE_SUSPENDED,
NULL,
NULL,
&si,
&pi))
{
printf(
"CreateProcess() failed! [%d]\n"
, GetLastError());
return
;
}
/
/
修改EIP
ctx.ContextFlags
=
CONTEXT_FULL;
if
(!GetThreadContext(pi.hThread, &ctx))
{
printf(
"GetThreadContext() failed! [%d]\n"
, GetLastError());
return
;
}
ctx.Eip
=
(DWORD)ChildProc;
if
(!SetThreadContext(pi.hThread, &ctx))
{
printf(
"SetThreadContext() failed! [%d]\n"
, GetLastError());
return
;
}
/
/
恢复线程
if
(
-
1
=
=
ResumeThread(pi.hThread))
{
printf(
"ResumeThread() failed! [%d]\n"
, GetLastError());
return
;
}
/
/
等待返回
WaitForSingleObject(pi.hProcess, INFINITE);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}