-
-
[求助]注入进程调用call，如何返回参数
-
发表于:
2008-7-28 21:39
6262
-
ParamAdd =VirtualAllocEx(pid, NULL,sizeof(moveParam), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pid, ParamAdd,&moveParam,sizeof(moveParam),NULL);
ThreadAdd =VirtualAllocEx(pid, NULL,4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pid, (LPVOID)ThreadAdd,(LPVOID)rdBld,4096,NULL);
hThread =CreateRemoteThread(pid, NULL, 0, (LPTHREAD_START_ROUTINE)ThreadAdd,ParamAdd, CREATE_SUSPENDED,hreadID);
ResumeThread(hThread);
void __stdcall rdBld(int *mp)
{
__asm
{
mov ecx, dword ptr [0x74206C]
mov eax, dword ptr [ecx]
mov eax, dword ptr [eax+0x1C]
push 0x0
push 0x0068F2EC
call eax
mov mp,eax
}
}
我想把参数调用后得到的eax的值存进mp，然后将mp返回。
可是在这个内联汇编里面，mp似乎不受影响。我测试了好几遍，感觉是参数的传入有问题。
应该怎么做呢？
[课程]Linux pwn 探索篇！
MP是MoneyParam的简写…………
