C语言0xc0000142错误,[求助]C语言 傀儡进程替换报错0Xc0000005 求大神帮忙看看

创建了一个CREATE_SUSPENDED的傀儡进程，用幕后进程替换了傀儡进程之后报错0xc0000005，弄了好几天也没弄懂，我裂开了，哪位大侠路过帮帮忙

WIN7 x64系统，vs2017 x86编译器，两个进程都是32位进程。typedef NTSYSAPI NTSTATUS(__stdcall *ZwUnmapViewOfSection)(HANDLE, PVOID);

int main()

{

//加载ZwUnmapViewOfSection函数

HMODULE hModule = GetModuleHandle(L"ntdll.dll");

if (hModule == NULL)

return FALSE;

ZwUnmapViewOfSection UnmapViewOfSection = (ZwUnmapViewOfSection)GetProcAddress(hModule, "ZwUnmapViewOfSection");

//将幕后进程读取到缓存

FILE* pFile = NULL;

_wfopen_s(&pFile, filePath1, L"rb");

if (pFile == NULL)

{

MessageBox(0, L"fopen_s fail", 0, MB_OK);

return (INT_PTR)TRUE;

}

fseek(pFile, 0, SEEK_END);

DWORD szFile = ftell(pFile);

fseek(pFile, 0, SEEK_SET);

BYTE* pFileBuffer = (BYTE*)malloc(szFile);

fread(pFileBuffer, szFile, 1, pFile);

fclose(pFile);

//幕后进程的头信息

PIMAGE_DOS_HEADER pDosH = (PIMAGE_DOS_HEADER)pFileBuffer;

PIMAGE_FILE_HEADER pFileH = (PIMAGE_FILE_HEADER)((BYTE*)pDosH + pDosH->e_lfanew + 4);

PIMAGE_OPTIONAL_HEADER pOptH = (PIMAGE_OPTIONAL_HEADER)((BYTE*)pFileH + IMAGE_SIZEOF_FILE_HEADER);

PIMAGE_SECTION_HEADER pSectionH = (PIMAGE_SECTION_HEADER)((BYTE*)pOptH + pFileH->SizeOfOptionalHeader);

PROCESS_INFORMATION pi = { 0 };

STARTUPINFO si = { 0 };

si.cb = sizeof(STARTUPINFO);

BOOL created = CreateProcess(filePath3, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);

int err;

if (!created) {

err = GetLastError();

return 0;

}

CONTEXT context = { 0 };

context.ContextFlags = CONTEXT_FULL;

GetThreadContext(pi.hThread, &context);

//从线程上下获取取基址

SIZE_T read;

DWORD oldBase;

bool hasRead = ReadProcessMemory(pi.hProcess, (PDWORD)(context.Ebx + 0X8), &oldBase, sizeof(DWORD), &read);

if (!hasRead) {

return 0;

}

//卸载傀儡进程镜像

NTSTATUS flag = UnmapViewOfSection(pi.hProcess, (BYTE*)oldBase);

if (flag < 0) {

return 0;

}

//申请虚拟空间的内存

LPVOID addrExe = VirtualAllocEx(pi.hProcess, (LPVOID)pOptH->ImageBase,

pOptH->SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

if (addrExe == NULL) {

return 0;

}

//替换傀儡进程

SIZE_T written;

bool isOk = FALSE;

//头部分

isOk = WriteProcessMemory(pi.hProcess, (LPVOID)addrExe, pFileBuffer, pOptH->SizeOfHeaders, &written);

//节部分

for (int i = 0; i < pFileH->NumberOfSections; i++) {

isOk = WriteProcessMemory(pi.hProcess,

(LPVOID)((BYTE*)addrExe + pSectionH[i].VirtualAddress),

pFileBuffer + pSectionH[i].PointerToRawData,

pSectionH[i].SizeOfRawData,

&written);

}

//修改线程上下文

DWORD imageBase = (DWORD)addrExe;

context.Eax = imageBase + pOptH->AddressOfEntryPoint;

WriteProcessMemory(pi.hProcess, (PDWORD)(context.Ebx + 0X8), &imageBase, sizeof(DWORD), &written);

SetThreadContext(pi.hProcess, &context);

ResumeThread(pi.hThread);

return 0;

}

1.调用Nt/ZwUnmapViewOfSection()卸载镜像会报错

2.不卸载镜像，在空闲内存插入别的进程然后修改重定位表显示停止工作

最后于 2020-1-23 13:58

被吸语言编辑

，原因：