用WriteProcessMemory做进程注入
来源:互联网 发布:分析照片的软件 编辑:程序博客网 时间:2024/06/03 12:29
今天要完成一个项内容,运行另一个应用程序abc.exe,实现它的父进程是explorer.exe。
最开始的思路是获得explorer.exe的句柄,用ShellExecute启动abc.exe。但是用explorer.exe的句柄创建的进程的父进程依然是调用和进程,而不是传入句柄的进程。
看来直接的不行,只能用间接的了。把运行abc.exe的代码段写到explorer.exe的内存里面去。然后让explorer来运行这段代码。
static DWORD CALLBACK ThreadProc()...{
::ShellExecute(NULL,"open","abc.exe",NULL,NULL,SW_SHOW);
::ShellExecute(NULL,"open","abc.exe",NULL,NULL,SW_SHOW);
return TRUE;
}
}
但是现在就出现问题了,ShellExecute在shell32模块里,还需要LoadLibrary和GetProcAddress。同时它也用了两个字符串常量,这些字串会出现在本进程的内存中,在explorer中运行代码就会出错,系统把它关掉。所以改用了WinExec来代替ShellExecute,同时要把需要的字串和函数指针都写到explorer的内存区里。
typedef UINT (WINAPI * WINEXEC)(LPCSTR,UINT);
typedef struct tagTHREADDATA...{
TCHAR fileName[20];
WINEXEC pWinexec;
}THREADDATA, *LPTHREADDATA;
static DWORD CALLBACK ThreadProc(LPTHREADDATA pData)...{
pData->pWinexec(pData->fileName,SW_SHOW);
return TRUE;
}
typedef struct tagTHREADDATA...{
TCHAR fileName[20];
WINEXEC pWinexec;
}THREADDATA, *LPTHREADDATA;
static DWORD CALLBACK ThreadProc(LPTHREADDATA pData)...{
pData->pWinexec(pData->fileName,SW_SHOW);
return TRUE;
}
DWORD getExplorerPID()...{
HWND startButtonHandle;
DWORD processID;
startButtonHandle = ::FindWindow (TEXT("Shell_TrayWnd"),NULL);
::GetWindowThreadProcessId( startButtonHandle, &processID );
return processID;
}
HWND startButtonHandle;
DWORD processID;
startButtonHandle = ::FindWindow (TEXT("Shell_TrayWnd"),NULL);
::GetWindowThreadProcessId( startButtonHandle, &processID );
return processID;
}
注入内存的过程:
user32Handle = ::GetModuleHandle(TEXT("kernel32"));
//得到kernel32模块句柄
processHandle = ::OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,FALSE,getExplorerPID());
//用explorer的PID来打开进程,并得到创建线程和写的权限。
dataAddr = ::VirtualAllocEx(processHandle,0,sizeof(THREADDATA),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
//在explorer的内存内里申请一块内存来存所用的数据
THREADDATA data = ...{TEXT("a.exe"),(WINEXEC)GetProcAddress(user32Handle,"WinExec"),};
WriteProcessMemory(processHandle,dataAddr,&data,sizeof(THREADDATA),&byteWrited);
//把数据写到申请的内存中
codeAddr = ::VirtualAllocEx(processHandle,0,sizeOfThreadProc,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
//申请代码的内存区
WriteProcessMemory(processHandle,codeAddr,&ThreadProc,sizeOfThreadProc,&byteWrited);
//把代码写进去,这时我们己经把我们要用的代码和数据都准备好了。
threadHandle = CreateRemoteThread(processHandle,NULL,0, LPTHREAD_START_ROUTINE)codeAddr,dataAddr,0,(LPDWORD)threadID);
//在explorer中创建一个线程,来执行启动abc.exe的代码。所需的数据都己经在explorer的内存块中,所以不会出问题。
WaitForSingleObject(threadHandle, INFINITE);
VirtualFreeEx(processHandle,dataAddr,0,MEM_RELEASE);
VirtualFreeEx(processHandle,codeAddr,0,MEM_RELEASE);
CloseHandle(threadHandle);
CloseHandle(processHandle);
//等待执行完毕,释放内存,关闭句柄。
//得到kernel32模块句柄
processHandle = ::OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,FALSE,getExplorerPID());
//用explorer的PID来打开进程,并得到创建线程和写的权限。
dataAddr = ::VirtualAllocEx(processHandle,0,sizeof(THREADDATA),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
//在explorer的内存内里申请一块内存来存所用的数据
THREADDATA data = ...{TEXT("a.exe"),(WINEXEC)GetProcAddress(user32Handle,"WinExec"),};
WriteProcessMemory(processHandle,dataAddr,&data,sizeof(THREADDATA),&byteWrited);
//把数据写到申请的内存中
codeAddr = ::VirtualAllocEx(processHandle,0,sizeOfThreadProc,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
//申请代码的内存区
WriteProcessMemory(processHandle,codeAddr,&ThreadProc,sizeOfThreadProc,&byteWrited);
//把代码写进去,这时我们己经把我们要用的代码和数据都准备好了。
threadHandle = CreateRemoteThread(processHandle,NULL,0, LPTHREAD_START_ROUTINE)codeAddr,dataAddr,0,(LPDWORD)threadID);
//在explorer中创建一个线程,来执行启动abc.exe的代码。所需的数据都己经在explorer的内存块中,所以不会出问题。
WaitForSingleObject(threadHandle, INFINITE);
VirtualFreeEx(processHandle,dataAddr,0,MEM_RELEASE);
VirtualFreeEx(processHandle,codeAddr,0,MEM_RELEASE);
CloseHandle(threadHandle);
CloseHandle(processHandle);
//等待执行完毕,释放内存,关闭句柄。
这就完成了代码的注入与执行。
英语还算不错的推荐去看看这篇文章,帮助很大。
Three Ways to Inject Your Code into Another Process
http://www.codeproject.com/threads/winspy.asp
- 用WriteProcessMemory做进程注入
- 用WriteProcessMemory做进程注入
- 用WriteProcessMemory做进程注入 (非DLL注入)
- 用WriteProcessMemory函数注入进程的流程
- WriteProcessMemory
- WriteProcessMemory
- 进程间通讯-WriteProcessMemory和ReadProcessMemory
- 进程间通讯-WriteProcessMemory和ReadProcessMemory
- 通过WriteProcessMemory改写进程的内存
- 通过WriteProcessMemory改写进程的内存
- ReadProcessMemory与WriteProcessMemory用例分析
- ReadProcessMemory与WriteProcessMemory用例分析
- ReadProcessMemory与WriteProcessMemory用例分析
- ReadProcessMemory与WriteProcessMemory用例分析 (转载)
- 偶遇WriteProcessMemory
- 用dll注入的方式隐藏进程
- 用dll注入的方式隐藏进程
- 用dll注入的方式隐藏进程
- 解决Oracle XDB与Tomcat等的8080端口的冲突
- test
- 我写的一个自定义分页标签
- java查询分页技术(1)
- Jdk和Tomcat的安装与配置
- 用WriteProcessMemory做进程注入
- java查询分页技术(2)
- 编译reactos
- 看穿面试这件事儿……
- c#文件操作
- Jive论坛系统完整分析(1)
- javascript 过滤或截取字符串
- 我的blog开张了!
- UNIX系统操作入门篇