windows父进程欺骗

最新推荐文章于 2024-05-29 08:30:00 发布

放牛日记

最新推荐文章于 2024-05-29 08:30:00 发布

阅读量435

点赞数

文章标签： windows

本文链接：https://blog.csdn.net/Timmbe/article/details/121756390

版权

Windows 父进程欺骗技术,其实就是创建一个进程，指定其他进程为这个新创建进程的父进程。

#include <windows.h>
#include <TlHelp32.h>
#include <iostream>

DWORD getParentProcessID() { //返回explorer.exe的pid
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 process = { 0 };
    process.dwSize = sizeof(process);

    if (Process32First(snapshot, &process)) {
        do {
            //If you want to another process as parent change here
            if (!wcscmp(process.szExeFile, L"explorer.exe"))
                break;
        } while (Process32Next(snapshot, &process));
    }

    CloseHandle(snapshot);
    return process.th32ProcessID;
}

int main() {
    STARTUPINFOEXA sInfoEX;
    PROCESS_INFORMATION pInfo;
    SIZE_T sizeT;

    HANDLE expHandle = OpenProcess(PROCESS_ALL_ACCESS, false, getParentProcessID()); //打开explorer进程获取当前进程所有权限

    ZeroMemory(&sInfoEX, sizeof(STARTUPINFOEXA)); //用0填充数组
    InitializeProcThreadAttributeList(NULL, 1, 0, &sizeT); //初始化指定的属性列表以创建进程和线程
    sInfoEX.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, sizeT); //设置进程属性并从堆中分配内存
    InitializeProcThreadAttributeList(sInfoEX.lpAttributeList, 1, 0, &sizeT);
    UpdateProcThreadAttribute(sInfoEX.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &expHandle, sizeof(HANDLE), NULL, NULL); //更新用于进程和线程创建的属性列表中的指定属性。
    sInfoEX.StartupInfo.cb = sizeof(STARTUPINFOEXA);

    //CreateProcessA("C:\\Program Files\\internet explorer\\iexplore.exe", NULL, NULL, NULL, TRUE, CREATE_SUSPENDED | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, reinterpret_cast<LPSTARTUPINFOA>(&sInfoEX), &pInfo);
    CreateProcessA("notepad.exe", NULL, NULL, NULL, TRUE, CREATE_SUSPENDED | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, reinterpret_cast<LPSTARTUPINFOA>(&sInfoEX), &pInfo);

    ResumeThread(pInfo.hThread); //启动线程
    CloseHandle(pInfo.hThread); //关闭线程
    STARTUPINFOEXA si;
    PROCESS_INFORMATION pi;

    ZeroMemory(&si, sizeof(si));
    //si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));

   

    // Start the child process. 
    if (!CreateProcessA(NULL,   // No module name (use command line)
        (LPSTR)"notepad1.exe",        // Command line
        NULL,           // Process handle not inheritable
        NULL,           // Thread handle not inheritable
        FALSE,          // Set handle inheritance to FALSE
        0,              // No creation flags
        NULL,           // Use parent's environment block
        NULL,           // Use parent's starting directory 
        reinterpret_cast<LPSTARTUPINFOA>(&si),            // Pointer to STARTUPINFO structure
        &pi)           // Pointer to PROCESS_INFORMATION structure
        )
    {
        printf("CreateProcess failed (%d).\n", GetLastError());
        return 0 ;
    }

    while (1);
    return 0;
}