-
-
[求助]CreateRemoteThread导致目标进程崩溃
-
发表于:
2009-3-31 23:38
13696
-
[求助]CreateRemoteThread导致目标进程崩溃
我用CreateRemoteThread函数注入目标进程,其他进程注入都没问题,也实现了我的效果,但我注入系统进程(explorer.exe, svchot.exe等)时,就会导致目标进程崩溃,说"内存不能为'written',我调试过,是在执行CreateRemoteThread函数后导致目标进程崩溃的,代码如下,请各位帮帮忙,谢谢了!
BOOL EnableDebugPrivilege(BOOL bEnable)
{
//提高本进程权限的函数
BOOL bOK = FALSE;
HANDLE hToken;
if(::OpenProcessToken(::GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))
{
LUID uID;
::LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&uID);
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount=1;
tp.Privileges[0].Luid=uID;
tp.Privileges[0].Attributes=bEnable?SE_PRIVILEGE_ENABLED:0;
::AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);
bOK = (::GetLastError()==ERROR_SUCCESS);
CloseHandle(hToken);
}
return bOK;
}
void LoadModule(DWORD dwPID,LPCTSTR lpszModuleName)
{
HANDLE hprocess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPID);
if(!hprocess)
{
CloseHandle(hprocess);
return ;
}
this->EnableDebugPrivilege(1);
//计算dll路径名需要的空间
int cb = 1+strlen(lpszModuleName);
//使用VirtualAllocEx函数在远程进程的内存地址空间分配dll文件缓冲区
LPVOID pszLibFileRemote = VirtualAllocEx(hprocess,NULL,cb,MEM_COMMIT,PAGE_READWRITE);
//使用WriteProcessMemory函数将dll的路径名复制到远程进程的内存空间
BOOL iReturnCode = WriteProcessMemory(hprocess,pszLibFileRemote,(PVOID)lpszModuleName,cb,NULL);
if(iReturnCode)
{
//计算LoadLibrary的入口地址
LPTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");
//启动远程线程LoadLibrary,通过远程线程调用用户的dll文件
HANDLE hRemoteThread = CreateRemoteThread(hprocess,NULL,0,pfnStartAddr,pszLibFileRemote,0,NULL);
if(hRemoteThread)
CloseHandle(hRemoteThread);
}
CloseHandle(hprocess);
}
[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法