|
|
马上注册，结交更多好友，享用更多功能^_^
您需要 登录 才可以下载或查看，没有账号？立即注册
x
运行环境WIN10 x64,尝试使用CreateRemoteThread在计算器中创建远程进程后，计算器程序直接异常退出。。GetLastError的返回值为0（差不多是没能找到错误）
想请教以下各位大佬程序为啥会异常退出
以下是代码：
#include<stdio.h>
#include<windows.h>
HWND window_handle;
void t_main();
void t_end();
int main()
{
HANDLE process_handle;
HANDLE thread_handle=0;
DWORD process_ID;
DWORD64 thread_address;
DWORD thread_ID;
BOOL result;
int code_size=(LPBYTE)t_end-(LPBYTE)t_main;
printf("待嵌入的代码大小为：%d字节\n",code_size);
window_handle = FindWindow(NULL, "计算器");
printf("获取到的窗口句柄为0x%X\n",window_handle);
GetWindowThreadProcessId(window_handle,&process_ID);
process_handle=OpenProcess(PROCESS_ALL_ACCESS,FALSE,process_ID);
printf("获取到的进程句柄为0x%X\n", process_handle);
thread_address = VirtualAllocEx(process_handle,NULL,code_size,MEM_COMMIT,PAGE_EXECUTE_READ);
printf("申请到的进程中合适的地址为：0x%X\n",thread_address);
result = WriteProcessMemory(process_handle,thread_address,&t_main,code_size,NULL);
if (result != 0)
{
printf("在内存中写入数据成功！\n");
}
else
{
printf("在内存中写入数据失败。\n");
}
thread_handle = CreateRemoteThread(process_handle,NULL,0,thread_address,NULL,0,NULL);
printf("创建的线程句柄为0x%X\n", thread_handle);
// CloseHandle(window_handle);
// CloseHandle(process_handle);
// CloseHandle(thread_handle);
if (GetLastError())
{
printf("出现错误，错误代码为：%d\n", GetLastError()); //运行下来返回值为0
}
getchar();
}
static void t_main()
{
MessageBox(window_handle, "成功！","无",NULL);
}
static void t_end()
{
;
}
问你，当前进程的MessageBox地址和目标进程的MessageBox地址一样吗？不一样？那你为什么在目标进程中使用当前进程的MessageBox地址？
在目标进程中如何使用MessageBox ？
LoadLibrary和GetProcAddress了解一下
#include <stdio.h>
#include <windows.h>
#include <psapi.h>
HWND window_handle;
static DWORD WINAPI t_main(LPVOID lpParameter) {
void *(*parameter)[2] = (void *)lpParameter;
HMODULE (*LoadLibraryA)(LPCSTR lpLibFileName) = (*parameter)[0];
FARPROC (*GetProcAddress)(HMODULE hModule, LPCSTR lpProcName) = (*parameter)[1];
const char str_kernel32[] = "kernel32.dll";
HMODULE kernel32 = LoadLibraryA(str_kernel32);
const char str_user32[] = "user32.dll";
HMODULE user32 = LoadLibraryA(str_user32);
const char str_FreeLibrary[] = "FreeLibrary";
BOOL (*FreeLibrary)(HMODULE hLibModule) = (void *)GetProcAddress(kernel32, str_FreeLibrary);
const char str_MessageBoxA[] = "MessageBoxA";
int (*MessageBoxA)(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType) = (void *)GetProcAddress(user32, str_MessageBoxA);
const char str_ok[] = "ok!";
const char str_none[] = "none";
MessageBoxA(NULL, str_ok, str_none, MB_OK);
FreeLibrary(user32);
FreeLibrary(kernel32);
return 123;
}
static void WINAPI t_end(void) {}
static void *find_proc_address(HANDLE hProcess, const char *proc_name) {
HMODULE hMods[1024];
DWORD cbNeeded;
if(!EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded)) return NULL;
for(size_t i = 0; i < cbNeeded / sizeof(HMODULE); ++i) {
FARPROC proc = GetProcAddress(hMods[i], proc_name);
if(proc) return proc;
}
return NULL;
}
int main(void) {
HANDLE process_handle;
HANDLE thread_handle = 0;
DWORD process_ID;
LPVOID thread_address;
BOOL result;
int code_size = (LPBYTE)t_end - (LPBYTE)t_main;
printf("待嵌入的代码大小为：%d字节\n", code_size);
window_handle = FindWindowW(NULL, L"计算器");
printf("获取到的窗口句柄为%p\n", window_handle);
GetWindowThreadProcessId(window_handle, &process_ID);
process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_ID);
printf("获取到的进程句柄为%p\n", process_handle);
thread_address = VirtualAllocEx(process_handle, NULL, code_size, MEM_COMMIT, PAGE_EXECUTE_READ);
printf("申请到的进程中合适的地址为：%p\n", thread_address);
result = WriteProcessMemory(process_handle, thread_address, t_main, code_size, NULL);
if (result != 0) printf("在内存中写入数据成功！\n");
else printf("在内存中写入数据失败。\n");
void *parameter[2] = {find_proc_address(process_handle, "LoadLibraryA"), find_proc_address(process_handle, "GetProcAddress")};
LPVOID thread_parameter = VirtualAllocEx(process_handle, NULL, sizeof(parameter), MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(process_handle, thread_parameter, ¶meter, sizeof(parameter), NULL);
thread_handle = CreateRemoteThread(process_handle, NULL, 0, thread_address, thread_parameter, 0, NULL);
printf("创建的线程句柄为%p\n", thread_handle);
WaitForSingleObject(thread_handle, INFINITE);
DWORD ExitCode;
GetExitCodeThread(thread_handle, &ExitCode);
printf("ExitCode: %u\n", ExitCode);
CloseHandle(thread_handle);
VirtualFreeEx(process_handle, thread_parameter, 0, MEM_RELEASE);
VirtualFreeEx(process_handle, thread_address, 0, MEM_RELEASE);
CloseHandle(process_handle);
return 0;
}
|
|
( 粤ICP备18085999号-1 | 粤公网安备 44051102000585号)
狗仔卡
发表于 2022-9-10 10:49:53
置顶卡
千斤顶
显身卡
发表于 2022-9-10 16:48:30
楼主
。不管是我后来写的，还是大佬你给的代码都会出现这样的问题。。敢问大佬，这可能是运行环境的问题吗（win10,vs2017,其他什么没乱动过）