关于被注射入远程进程的代码的问题

pgcat 2003-04-22 11:13:04

写这段代码的时候遇到些问题，因为很难调，问问大家谢。
CreateromtThread proc ProcID: dword
call GetPathAdd
GetPathAdd: ；得到路径变量地址
pop ecx
add ecx,offset PathName-offset GetPathAdd
call GetKnlGetSystemDirectoryA
KnlGetSystemDirectoryA dd ?
GetKnlGetSystemDirectoryA: ；得到当前系统文件夹
popeax
pop ebx
call[eax],ecx,100h
oreax,eax
jzshort ExitProtectProc
movebx,ecx ；这个地方也有疑惑
;push ebx
callGetFileAdd
GetFileAdd: 得到文件名常量地址
popecx
addecx,offset FileNametmp-offset GetFileAdd
call GetKnllstrcat
Knllstrcatdd?
GetKnllstrcat: ；路径和文件名连接起来
popeax
;popebx
call [eax],ebx,ecx ；这一步好象出错，由于无法调试
oreax,eax
jzshort ExitProtectProc
callGetKnlOpenProcess
KnlOpenProcess dd ?
GetKnlOpenProcess:
popeax
call[eax],PROCESS_ALL_ACCESS,FALSE,ProcID
oreax,eax
jzshort ExitProtectProc
movebx,eax
callGetKnlWaitForSingleObject
KnlWaitForSingleObject dd ?
GetKnlWaitForSingleObject:
popeax
call[eax],ebx,-1h
callGetFileNameAddress
GetFileNameAddress:
popecx
addecx,offset FileName-offset GetFileNameAddress
callGetKnlWinExec
KnlWinExec dd ?
GetKnlWinExec:
popeax
;popebx
call[eax],ebx,01
ExitProtectProc:
ret
CreateromtThread endp

FileName db 'c:\windows\system32\T-mouse.exe',0
PathName db100dup(?)
FileNametmp db '\T-mouse.exe',0

KnlOpenProcessStrdb 'OpenProcess',0
KnlWaitForObjectStrdb 'WaitForSingleObject',0
KnlWinExecStrdb 'WinExec',0
KnlGetSystemDirectoryAStr db 'GetSystemDirectoryA',0
KnllstrcatStrdb 'lstrcat',0

偶认为主要问题就是得到当前路径那个地方，因为直接写入内存，不好调试不知道该怎么处理帮忙瞧瞧！！

...全文