请问一个在远程进程注入代码的有关问题
请教一个在远程进程注入代码的问题
代码如下,在创建远程线程的时候就挂了...
(注入的代码不超过256字节)
#include <iostream>
#include <windows.h>
using namespace std;
BOOL SetPrivilege() //提升权限
{
TOKEN_PRIVILEGES tkp;
HANDLE hToken;
if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
return FALSE;
LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken,FALSE,&tkp,0,(PTOKEN_PRIVILEGES)NULL,0);
return TRUE;
}
struct PARA
{
HMODULE hModule;
LPTSTR lpFilename;
DWORD nSize;
int fill[20];
};
void GetName(PARA* para)
{
GetModuleFileNameA(NULL, para-> lpFilename, para-> nSize);
}
int main()
{
if (!SetPrivilege())
return 1;
char * startAddress = (char*)&GetName;
char * codeAddress = startAddress + 5 + *(int*)(startAddress + 1); //计算代码地址
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 2400);
char* remoteResult = (char*)VirtualAllocEx(
hProcess, NULL, MAX_PATH, MEM_COMMIT, PAGE_READWRITE); //分配返回值的空间
PARA* remotePara = (PARA*)VirtualAllocEx(
hProcess, NULL, sizeof(PARA), MEM_COMMIT, PAGE_READWRITE); //分配参数空间
代码如下,在创建远程线程的时候就挂了...
(注入的代码不超过256字节)
#include <iostream>
#include <windows.h>
using namespace std;
BOOL SetPrivilege() //提升权限
{
TOKEN_PRIVILEGES tkp;
HANDLE hToken;
if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
return FALSE;
LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken,FALSE,&tkp,0,(PTOKEN_PRIVILEGES)NULL,0);
return TRUE;
}
struct PARA
{
HMODULE hModule;
LPTSTR lpFilename;
DWORD nSize;
int fill[20];
};
void GetName(PARA* para)
{
GetModuleFileNameA(NULL, para-> lpFilename, para-> nSize);
}
int main()
{
if (!SetPrivilege())
return 1;
char * startAddress = (char*)&GetName;
char * codeAddress = startAddress + 5 + *(int*)(startAddress + 1); //计算代码地址
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 2400);
char* remoteResult = (char*)VirtualAllocEx(
hProcess, NULL, MAX_PATH, MEM_COMMIT, PAGE_READWRITE); //分配返回值的空间
PARA* remotePara = (PARA*)VirtualAllocEx(
hProcess, NULL, sizeof(PARA), MEM_COMMIT, PAGE_READWRITE); //分配参数空间