线程注入失败!内存不能为written!

[clhposs]

编译以下代码当远程启动线程时就会出错！
为什么？哪错了?

#include <windows.h>
#include <TLHELP32.H>

DWORD start(LPVOID parent);

int WINAPI WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd )
{
	//提升进程权限
	HANDLE handle;
	if(OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&handle))
	{
		TOKEN_PRIVILEGES tkp;
		LookupPrivilegeValue(NULL,"SE_DEBUG_NAME",&tkp.Privileges[0].Luid);
		tkp.PrivilegeCount = 1;
		tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

		AdjustTokenPrivileges(handle,false,&tkp,sizeof(tkp),NULL,NULL);
		CloseHandle(handle);
	}
	
	//找到记事本进程的PID
	handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
	PROCESSENTRY32 pe32;
	DWORD dwID;
	Process32First(handle,&pe32);
	do 
	{
		if(!strcmp(pe32.szExeFile,"NOTEPAD.EXE"))
		{
			dwID = pe32.th32ProcessID;
			break;
		}
	} while (Process32Next(handle,&pe32));
	
	CloseHandle(handle);
	
	//打开记事本进程
	handle = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,false,dwID);
	DWORD dwSize = 1024;
	
	//申请内存空间
	LPVOID lpBuf = VirtualAllocEx(handle,NULL,dwSize,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	if(lpBuf == NULL)
	{
		CloseHandle(handle);
		MessageBox(NULL,"分配内存空间失败!","提示",0);
	}

	//写内存
	DWORD dwWrite;
	if(WriteProcessMemory(handle,lpBuf,(LPVOID)start,dwSize,&dwWrite))
	{
		if(dwSize != dwWrite)
		{
			VirtualFreeEx(handle,lpBuf,dwSize,MEM_DECOMMIT);
			CloseHandle(lpBuf);
			MessageBox(NULL,"写内存失败!","提示",0);
		}
	}
	else
	{
		
		VirtualFreeEx(handle,lpBuf,dwSize,MEM_DECOMMIT);
		CloseHandle(lpBuf);
		MessageBox(NULL,"写内存失败!","提示",0);
	}
	
	//创建一个远程线程来执行!
	HANDLE hThread = CreateRemoteThread(handle,NULL,NULL,(LPTHREAD_START_ROUTINE)start,NULL,0,NULL);
	WaitForSingleObject(hThread,INFINITE);
	VirtualFreeEx(handle,lpBuf,dwSize,MEM_DECOMMIT);
	return 0;
}

DWORD start(LPVOID parent)
{
	MessageBox(NULL,"注入成功","提示",0);
	return 0;
}

[stjay]

应该是执行start里的MessageBox报错内存不能为written
简单说说
将start代码复制过到NOTEPAD.EXE后，
MessageBox在该exe里的导入地址 在NOTEPAD.EXE指向的内存数据不确定
一执行就出错

[stjay]

反汇编看看
应该理解吧

[clhposs]

补充 是注入到记事本进程 所以首先先开启记事本 在运行此程序！

[arong1234]

遇到这样的错还继续么？
这个if又问题吧

 LPVOID lpBuf = VirtualAllocEx(handle,NULL,dwSize,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
    if(lpBuf == NULL)
    {
        CloseHandle(handle);
        MessageBox(NULL,"分配内存空间失败!","提示",0);
    }

[wutaihua]

lpBuf 为空 到那儿应该返回了吧

[arong1234]

virtualallocex要commit内存时，同时应该有reserve标志吧？
MEM_COMMIT|MEM_RESERVE

[arong1234]

楼主很多地方错误处理都是错误的，你都遇到错误了，就没有理由继续了，但是你还是继续了。例如：分配内存失败了，你还写内存干吗？线程根本没有成功创建，你还wait干吗？

[clhposs]

哦 我试下

[clhposs]

还是不行!你编译一下代码看下

记得 打开记事本！内存分配等都是没有错误的 只是远程开启一个线程后就有问题了！

[zyhfut]

关注中..9楼如何解决

[zyhfut]

问题出在,start的函数体地址在本进程中.notepad中并没有.所以失败

[zyhfut]

楼主,问题解决没?继续关注中

[mywangsheng]

是先DLL注入远程进程的地址空间
然后在创建远程线程来执行吧

start应该先注入到Notepad的地址空间，不然会出现访问违规的

[mywangsheng]

不好意思
当时没看清楚代码
楼主

PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW");

if (pfnThreadRtn )
{
    //创建一个远程线程来执行!
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, pfnThreadRtn, lpBuf, 0, NULL);
    WaitForSingleObject(hThread,INFINITE);
    VirtualFreeEx(handle,lpBuf,dwSize,MEM_DECOMMIT);

}

//这样应该就不会出现访问违规了

[lijingjie1985718]

hPrevInstance,怎么进去就空了？
是这个问题么？
等待下答案。。。

[greatws]

CreateRemoteThread的地址要是目标进程的地址，必须把汇编代码写入目标进程才行。否则就用LoadLibrary，但DLL的路径也必须在目标进程地址空间下，而且要为绝对路径。

给你个例子。

	HANDLE hSp = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	PROCESSENTRY32 pe32;
	pe32.dwSize = sizeof(PROCESSENTRY32);
	if (Process32First(hSp, &pe32))
	{
		do 
		{
			if(_tcsicmp(pe32.szExeFile, _T("NOTEPAD.EXE")) == 0)
			{
				break;
			}
		} while (Process32Next(hSp, &pe32));
		CloseHandle(hSp);
	}

	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);

	if (hProcess != NULL)
	{
		WCHAR wText[] = _T("注入成功");
		WCHAR wCaption[] = _T("提示");

		void* pRAddress = NULL;
		pRAddress = VirtualAllocEx(hProcess, NULL, sizeof(wText) + sizeof(wCaption) + 50, MEM_COMMIT, PAGE_READWRITE);
		WriteProcessMemory(hProcess, pRAddress, (PVOID)wText, sizeof(wText), NULL);
		WriteProcessMemory(hProcess, (BYTE*)pRAddress + sizeof(wText), (PVOID)wCaption, sizeof(wCaption), NULL);
		DWORD addr = (DWORD)GetProcAddress(GetModuleHandle(_T("user32.dll")), "MessageBoxW");
		unsigned char asmcode[] = {
			0x6a, 0x0,     //push uType
			0x68, 0x0, 0x0, 0x0, 0x0,     //push, lpCaption
			0x68, 0x0, 0x0, 0x0, 0x0,	//push, text
			0x6a, 0x0,   //push hWnd
			0xbe, 0x0, 0x0, 0x0, 0x0,   //MessageBox
			0xff, 0xd6,    //call esi
			0xc3};

		*((DWORD*)(asmcode + 3)) = (DWORD)pRAddress + sizeof(wText);
		*((DWORD*)(asmcode + 8)) = (DWORD)pRAddress;
		*((DWORD*)(asmcode + 15)) = addr;
		WriteProcessMemory(hProcess, (BYTE*)pRAddress + sizeof(wText) + sizeof(wCaption), (PVOID)asmcode, sizeof(asmcode), NULL);

		DWORD dwOldProtect;

		VirtualProtectEx(hProcess, pRAddress, sizeof(wText) + sizeof(wCaption) + 50, PAGE_EXECUTE_READWRITE, &dwOldProtect);

		PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)((BYTE*)pRAddress + sizeof(wText) + sizeof(wCaption));
		HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, pfnThreadRtn, NULL, 0, NULL);
		WaitForSingleObject(hRemoteThread, INFINITE);
		if (pRAddress != NULL)
		{
			VirtualFreeEx(hProcess, pRAddress, 0, MEM_RELEASE);
		}
		CloseHandle(hRemoteThread);
	}

[cadhy]

学习