//工具类
DWORD Asm_PushImm(PBYTE Order, DWORD Imm)
{
Order[0] = 0x68; // push imm32
*(PDWORD)&Order[1] = Imm; // 正确地设置32位立即数
return 5; // push imm32 总是占用5个字节
}
DWORD Asm_Call(PBYTE Order, DWORD Imm,DWORD Addr)
{
Order[0] = 0xe8; // call rel32
Addr += 5; // 调整为下一条指令的地址
*(PDWORD)&Order[1] = Imm - Addr; // 计算相对偏移
return 5; // call rel32 总是占用5个字节
}
DWORD Asm_Return(PBYTE Order)
{
Order[0] = 0xc3;
return 1;
}
//构建调用代码
BYTE Order[32]{};
DWORD pos = 0;
pos += Asm_PushImm(Order, 0);
pos += Asm_PushImm(Order + pos, DLL_PROCESS_ATTACH);
pos += Asm_PushImm(Order + pos, (DWORD)pDllBase);
pos += Asm_Call(Order + pos, (DWORD)pDllBase + pNtHeader->OptionalHeader.AddressOfEntryPoint, (DWORD)pMemoEx + pos);
Asm_Return(Order + pos);
//写入调用代码
WriteProcessMemory(hProcess, pMemoEx, Order, 32, NULL);
//启动线程
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pMemoEx, NULL, 0, NULL);
if (hThread == NULL) {
delete[] FileData;
CloseHandle(hProcess);
return FALSE;
}
// 等待线程完成
std::cout << "Waiting for thread to finish..." << std::endl;
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
