DWORD dwPID

最新推荐文章于 2022-03-12 21:39:50 发布

zhusg

最新推荐文章于 2022-03-12 21:39:50 发布

阅读量846

点赞数

本文链接：https://blog.csdn.net/zhusg/article/details/8137101

版权

void CCodeInjecterDlg::InjectMachineCode(DWORD dwPID)
{
	char *ansiMachine = NULL;
	CString strAsm = m_strAsm;
	strAsm.Append(_T("XOR EAX,EAX\r\n"));
	strAsm.Append(_T("RETN 0"));
	//预转换
	int nSize = AsmToMachine(0x00400000, ansiMachine);
	delete []ansiMachine;
	if (nSize == -1)
	{
		AfxMessageBox(_T("代码有误"));
		return;
	}

	HANDLE hProcess  = NULL;
	HANDLE hThread   = NULL;
	//DWORD dwSize     = 0;
	LPVOID pszRemoteAddr = NULL;
	LPTHREAD_START_ROUTINE lpThreadFun = NULL;
	DWORD dwRemoteAddr = 0;

	hProcess = ::OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);
	if (NULL == hProcess) return;

	pszRemoteAddr = ::VirtualAllocEx(hProcess, NULL, nSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	TRACE1("%p\n", pszRemoteAddr);
	if (NULL == pszRemoteAddr)
	{
		::CloseHandle(hProcess);
		return;
	}
	dwRemoteAddr = (DWORD)pszRemoteAddr;
	CString strLine;

	int j = 0;
	char *pAsm;
	t_asmmodel am;
	char ansiOut[TEXTLEN] = {0};
	char errtext[TEXTLEN] = {0};
	POSITION rPos = m_AsmList.GetHeadPosition();
	while (rPos != NULL)
	{
		strLine = m_AsmList.GetNext(rPos);
		pAsm = UnicodeToAnsi(strLine.GetBuffer());
		j = Assemble(pAsm, dwRemoteAddr, &am, 0, 2, errtext);
		delete []pAsm;
		::WriteProcessMemory(hProcess, (LPVOID)dwRemoteAddr, am.code, am.length, NULL);
		dwRemoteAddr += am.length;
	}

	hThread = ::CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pszRemoteAddr, NULL, 0, NULL);
	if (NULL == hThread)
	{
		::CloseHandle(hProcess);
		return;
	}
	if (::WaitForSingleObject(hThread, INFINITE) == WAIT_FAILED)
	{
		::VirtualFreeEx(hProcess, pszRemoteAddr, nSize, MEM_DECOMMIT);
		::CloseHandle(hThread);
		::CloseHandle(hProcess);
		return;
	}
	DWORD dwExitCode = 0;
	::GetExitCodeThread(hThread, &dwExitCode);
	TRACE1("%d", dwExitCode);
	::VirtualFreeEx(hProcess, pszRemoteAddr, nSize, MEM_DECOMMIT);
	::CloseHandle(hThread);
	::CloseHandle(hProcess);
}