void WINAPI TestFunc()//程序真实入口
{
printf("hello world\n");
system("pause");
return ;
}
int main(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
wchar_t wszIePath[] = L"cmd";//傀儡进程路径
STARTUPINFOW StartupInfo = { 0 };
StartupInfo.cb = sizeof(StartupInfo);
PROCESS_INFORMATION ProcessInformation{ 0 };
CreateProcessW(NULL, wszIePath, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &StartupInfo, &ProcessInformation);
CONTEXT ThreadCxt;
ThreadCxt.ContextFlags = CONTEXT_FULL;
GetThreadContext(ProcessInformation.hThread, &ThreadCxt);
HMODULE hModuleBase = GetModuleHandleA(NULL);
PIMAGE_DOS_HEADER pDosHdr = (PIMAGE_DOS_HEADER)hModuleBase;
PIMAGE_NT_HEADERS pNtHdr = (PIMAGE_NT_HEADERS)((LPBYTE)hModuleBase + pDosHdr->e_lfanew);
DWORD dwImageSize = pNtHdr->OptionalHeader.SizeOfImage;
HMODULE OldModuleBase = 0;
ReadProcessMemory(ProcessInformation.hProcess, (LPVOID)(ThreadCxt.Rdx + 0x10), &OldModuleBase, sizeof(OldModuleBase), NULL);
typedef NTSTATUS(__stdcall* pfnZwUnmapViewOfSection)(IN HANDLE ProcessHandle, IN LPVOID BaseAddress);
pfnZwUnmapViewOfSection ZwUnmapViewOfSection = (pfnZwUnmapViewOfSection)GetProcAddress(GetModuleHandleA("ntdll.dll"), "ZwUnmapViewOfSection");
ZwUnmapViewOfSection(ProcessInformation.hProcess, OldModuleBase);
LPVOID lpAlloAddr = VirtualAllocEx(
ProcessInformation.hProcess, //需要在其中分配空间的进程的句柄.
hModuleBase, //想要获取的地址区域.
dwImageSize, //要分配的内存大小.
MEM_RESERVE | MEM_COMMIT,//内存分配的类型
PAGE_EXECUTE_READWRITE //内存页保护.
);
WriteProcessMemory(ProcessInformation.hProcess, hModuleBase, hModuleBase, dwImageSize, NULL);
WriteProcessMemory(ProcessInformation.hProcess, (LPVOID)(ThreadCxt.Rdx + 0x10), &hModuleBase, sizeof(hModuleBase), NULL);
ThreadCxt.ContextFlags = CONTEXT_FULL;
ThreadCxt.Rcx = (DWORD64)TestFunc;
SetThreadContext(ProcessInformation.hThread, &ThreadCxt);
//恢复进程这里开始出错，24h2报错0xc00000141
ResumeThread(ProcessInformation.hThread);
}
