关于被注射入远程进程的代码的问题
pgcat 2003-04-22 11:13:04 写这段代码的时候遇到些问题,因为很难调,问问大家 谢。
CreateromtThread proc ProcID: dword
call GetPathAdd
GetPathAdd: ;得到路径变量地址
pop ecx
add ecx,offset PathName-offset GetPathAdd
call GetKnlGetSystemDirectoryA
KnlGetSystemDirectoryA dd ?
GetKnlGetSystemDirectoryA: ;得到当前系统文件夹
popeax
pop ebx
call[eax],ecx,100h
oreax,eax
jzshort ExitProtectProc
movebx,ecx ;这个地方也有疑惑
;push ebx
callGetFileAdd
GetFileAdd: 得到文件名常量地址
popecx
addecx,offset FileNametmp-offset GetFileAdd
call GetKnllstrcat
Knllstrcatdd?
GetKnllstrcat: ;路径和文件名连接起来
popeax
;popebx
call [eax],ebx,ecx ;这一步好象出错,由于无法调试
oreax,eax
jzshort ExitProtectProc
callGetKnlOpenProcess
KnlOpenProcess dd ?
GetKnlOpenProcess:
popeax
call[eax],PROCESS_ALL_ACCESS,FALSE,ProcID
oreax,eax
jzshort ExitProtectProc
movebx,eax
callGetKnlWaitForSingleObject
KnlWaitForSingleObject dd ?
GetKnlWaitForSingleObject:
popeax
call[eax],ebx,-1h
callGetFileNameAddress
GetFileNameAddress:
popecx
addecx,offset FileName-offset GetFileNameAddress
callGetKnlWinExec
KnlWinExec dd ?
GetKnlWinExec:
popeax
;popebx
call[eax],ebx,01
ExitProtectProc:
ret
CreateromtThread endp
FileName db 'c:\windows\system32\T-mouse.exe',0
PathName db100dup(?)
FileNametmp db '\T-mouse.exe',0
KnlOpenProcessStrdb 'OpenProcess',0
KnlWaitForObjectStrdb 'WaitForSingleObject',0
KnlWinExecStrdb 'WinExec',0
KnlGetSystemDirectoryAStr db 'GetSystemDirectoryA',0
KnllstrcatStrdb 'lstrcat',0
偶认为主要问题就是得到当前路径那个地方,因为直接写入内存,不好调试不知道该怎么处理 帮忙瞧瞧!!