Win7下如何正确的组织CsrClientCallServer函数所需的参数？

[draracle]

大家有谁知道？就是第一个参数，crsMsg，在函数申明中，这个参数是一个LPVOID，根本不知道是什么结构。。。。

另外，2000，xp，2003或者其他系统下，大家有知道的都请将结构体贴出来，谢谢！

CsrClientCallServer(&crsmsg,NULL,0x10000, sizeof(crsmsg));

[draracle]

补充一下，需要执行的操作是，在创建进程的过程中，最后一步通知csrss，创建的进程和线程的句柄。即0x10000号操作。

[Lactoferrin]

我测试的时候windows7下创建进程好像不需要CsrClientCallServer通知csrss,windows xp的需要

[Lactoferrin]

第一个参数是联合体，不同的api号用的就不同
typedef struct _PORT_MESSAGE
{
ULONG_PTR Length;
ULONG ZeroInit;
CLIENT_ID ClientId;
ULONG MessageId;
ULONG CallbackId;
}PORT_MESSAGE;
typedef struct _CSRSS_MESSAGE
{
ULONG CaptureData,ApiNumber,Status,Reserved;
}CSRSS_MESSAGE;

typedef struct _BASE_CREATEPROCESS_MESSAGE
{HANDLE ProcessHandle,ThreadHandle,ProcessId,ThreadId;
ULONG CreationFlags;
CLIENT_ID Debugger;
ULONG VdmBinaryType;
}BASE_CREATEPROCESS_MESSAGE;
typedef struct _CSR_API_MESSAGE
{
PORT_MESSAGE PortMessage;
CSRSS_MESSAGE CsrssMessage;
BASE_CREATEPROCESS_MESSAGE CreateProcess;
}CSR_API_MESSAGE;

[draracle]

上面的那个结构体是那个版本的？

[draracle]

能不能贴一份Win7下可以的代码给我？谢谢

[Lactoferrin]

我记得windows7不需要调用这个，你把你的代码弄上来

[draracle]

就是在csdn上下的那个myProcessCreator那个项目

void main()
{
WCHAR DosPathName[] = L"C:\\Windows\\Write.exe";
UNICODE_STRING NtPathName;
CURDIR DirectoryInfo;

OBJECT_ATTRIBUTES oa;
HANDLE FileHandle, SectionHandle, ProcessHandle, ThreadHandle;
ULONG Status;
IO_STATUS_BLOCK isb;
SECTION_IMAGE_INFORMATION sii;
ULONG StackSize;
USER_STACK iTeb;
PVOID p;
ULONG OldProtect;
CONTEXT Context;
CLIENT_ID ClientId;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
PROCESS_BASIC_INFORMATION pbi;
//BASE_API_MSG BaseApiMsg;
ULONG n, envCount;
PWCHAR penv;
// struct CRS_MSG crsmsg = {{0}, {0}, {0, 0, (DWORD)0, (DWORD)0}, {0}, 0, {0}};;

//转换文件名。
if (!RtlDosPathNameToNtPathName_U(DosPathName, &NtPathName, NULL, &DirectoryInfo)){
printf("erro!");
exit(0);
}
else
printf("NtPathName: %S\n", NtPathName.Buffer);

oa.Length = sizeof(oa);
oa.Attributes = OBJ_CASE_INSENSITIVE;
oa.ObjectName = &NtPathName;
oa.RootDirectory = NULL;
oa.SecurityDescriptor = NULL;
oa.SecurityQualityOfService = NULL;

//打开文件, FILE_EXECUTE 不是 FILE_ALL_ACCESS
Status = ZwOpenFile(&FileHandle, FILE_EXECUTE | FILE_READ_ATTRIBUTES |FILE_READ_DATA | SYNCHRONIZE, &oa, &isb, FILE_SHARE_READ | FILE_SHARE_DELETE, FILE_SYNCHRONOUS_IO_NONALERT |FILE_NON_DIRECTORY_FILE);
if (Status == 0)
printf("ZwOpenFile successfully!\n");
else
printf("ZwOpenFile Fail!\n");

//创建SECTION 对象并查询信息
Status = ZwCreateSection(§ionHandle, SECTION_ALL_ACCESS, NULL, NULL, PAGE_EXECUTE, SEC_IMAGE, FileHandle);
if (Status == 0)
printf("ZwCreateSection successfully!\n");
else
printf("ZwCreateSection Fail!\n");
ZwClose(FileHandle);

ZwQuerySection(SectionHandle, SectionImageInformation, &sii, sizeof(sii), NULL);
StackSize = sii.MaximumStackSize; //堆栈大小。

//创建进程 (TRUE)
Status = ZwCreateProcess(&ProcessHandle, PROCESS_ALL_ACCESS, NULL, NtCurrentProcess(), 4, SectionHandle, 0, 0);
if (Status == 0)
printf("ZwCreateProcess successfully!\n");
else
printf("ZwCreateProcess Fail!\n");
ZwClose(SectionHandle);

//下面为分配堆栈、CONTEXT，创建线程。
RtlZeroMemory(&iTeb, sizeof(iTeb));
ZwAllocateVirtualMemory(ProcessHandle, &iTeb.ExpandableStackBottom, 0, &StackSize, MEM_RESERVE, PAGE_READWRITE);
iTeb.ExpandableStackBase = (PCHAR)iTeb.ExpandableStackBottom + sii.MaximumStackSize;
iTeb.ExpandableStackLimit = (PCHAR)iTeb.ExpandableStackBase - sii.CommittedStackSize;
p = (PCHAR)iTeb.ExpandableStackLimit - PAGE_SIZE;

StackSize = PAGE_SIZE + sii.CommittedStackSize;
ZwAllocateVirtualMemory(ProcessHandle, &p, 0, &StackSize, MEM_COMMIT, PAGE_READWRITE);
StackSize = PAGE_SIZE;
ZwProtectVirtualMemory(ProcessHandle, &p, &StackSize, PAGE_READWRITE | PAGE_GUARD, &OldProtect);

RtlZeroMemory(&Context, sizeof(Context));
Context.ContextFlags = CONTEXT_FULL;
Context.SegGs = 0;
Context.SegFs = 0x3b;
Context.SegEs = 0x23;
Context.SegDs = 0x23;
Context.SegSs = 0x23;
Context.SegCs = 0x1B;
Context.EFlags = 0x3000;
Context.Esp = (ULONG)iTeb.ExpandableStackBase - 4;
Context.Eip = (ULONG)sii.TransferAddress;
Status = ZwCreateThread(&ThreadHandle, THREAD_ALL_ACCESS, NULL, ProcessHandle, &ClientId, &Context, &iTeb, TRUE);
if (Status == 0)
printf("ZwCreateThread successfully!\n");
else
printf("ZwCreateThread Fail!\n");

//进程的参数。
Status = ZwQueryInformationProcess(ProcessHandle, 0, &pbi, sizeof(pbi), NULL);
if (Status == 0)
printf("ZwQueryInformationProcess successfully peb=%x!\n", pbi.PebBaseAddress);
else
printf("ZwQueryInformationProcess Fail!\n");

RtlCreateProcessParameters(&ProcessParameters, &NtPathName, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
penv = (PWCHAR)ProcessParameters->Environment;
envCount = 0;
n = 0;
do{
n = wcslen(penv);
envCount += (n + 1) * 2;
penv = penv + n + 1;
}while(n != 0);
p = NULL;
ZwAllocateVirtualMemory(ProcessHandle, &p, 0, &envCount, MEM_COMMIT, PAGE_READWRITE);
ZwWriteVirtualMemory(ProcessHandle, p, ProcessParameters->Environment, envCount, NULL);
ProcessParameters->Environment = p;

p = NULL;
n = ProcessParameters->MaximumLength;

ZwAllocateVirtualMemory(ProcessHandle, &p, 0, &n, MEM_COMMIT, PAGE_READWRITE);
ZwWriteVirtualMemory(ProcessHandle, p, ProcessParameters, ProcessParameters->MaximumLength, NULL);
ZwWriteVirtualMemory(ProcessHandle, (PCHAR)pbi.PebBaseAddress + 0x10, &p, sizeof(p), NULL);
RtlDestroyProcessParameters(ProcessParameters);

//通知Csrss.exe
//RtlZeroMemory(&BaseApiMsg, sizeof(BaseApiMsg));
//BaseApiMsg.u.CreateProcessW.ClientId.UniqueProcess = ClientId.UniqueProcess;
//BaseApiMsg.u.CreateProcessW.ClientId.UniqueThread = ClientId.UniqueThread;
//BaseApiMsg.u.CreateProcessW.ProcessHandle = (HANDLE)((ULONG)ProcessHandle | 3);
// BaseApiMsg.u.CreateProcessW.ThreadHandle = ThreadHandle;
//BaseApiMsg.u.CreateProcessW.CreationFlags = 0xFFFFFFFC;
//Status = CsrClientCallServer(&BaseApiMsg,NULL,0x10000, sizeof(BaseApiMsg)); //参数大小。

//struct CSRSS_MESSAGE
//{
// ULONG Unknown1;
// ULONG Opcode;
// ULONG Status;
// ULONG Unknown2;
//};

//struct CRS_MSG
//{
// PORT_MESSAGE PortMessage;
// struct CSRSS_MESSAGE CsrssMessage;
// PROCESS_INFORMATION ProcessInformation;
// CLIENT_ID Debugger;
// ULONG CreationFlags;
// ULONG VdmInfo[2];
//};

// crsmsg.ProcessInformation.hProcess = ProcessHandle;
// crsmsg.ProcessInformation.hThread = ThreadHandle;
// crsmsg.ProcessInformation.dwProcessId = (DWORD)ClientId.UniqueProcess;
// crsmsg.ProcessInformation.dwThreadId = (DWORD)ClientId.UniqueThread;

// Status = CsrClientCallServer(&crsmsg,NULL,0x10000, sizeof(crsmsg)); //参数大小。
//if (Status == 0)
// printf("CsrClientCallServer successfully!\n");
//else
// printf("CsrClientCallServer Fail!\n");

//恢复Thread的执行
ZwResumeThread(ThreadHandle, NULL);
}

[Lactoferrin]

你先要理解这些代码的意思，然后自己把它写出来
我windows7下windows vista,windows xp用的都是我给你的，都没问题


如果不想从磁盘读取，你需要把

Status = ZwOpenFile(&FileHandle, FILE_EXECUTE | FILE_READ_ATTRIBUTES |FILE_READ_DATA | SYNCHRONIZE, &oa, &isb, FILE_SHARE_READ | FILE_SHARE_DELETE, FILE_SYNCHRONOUS_IO_NONALERT |FILE_NON_DIRECTORY_FILE);
if (Status == 0)  
printf("ZwOpenFile successfully!\n");
else
printf("ZwOpenFile Fail!\n");

//创建SECTION 对象并查询信息
Status = ZwCreateSection(§ionHandle, SECTION_ALL_ACCESS, NULL, NULL, PAGE_EXECUTE, SEC_IMAGE, FileHandle);
if (Status == 0)  
printf("ZwCreateSection successfully!\n");
else
printf("ZwCreateSection Fail!\n");
ZwClose(FileHandle);

ZwQuerySection(SectionHandle, SectionImageInformation, &sii, sizeof(sii), NULL);

换成创建一个基于页面文件的section，把你得到的pe数据根据节表转换后复制到这个section中，并要自己算出sii里面的东西，ZwQuerySection(SectionImageInformation)是不能再用的

[draracle]

能不能给我一个完整的代码？谢谢了！

[draracle]

我的邮箱是 [e-mail]

[Lactoferrin]

你要从内存中运行什么程序，有的程序不能这样启动的

[draracle]

是这样的，我现在正在做的是一个游戏资源管理的一个小工程，有一个启动器，然后所有的资源包括exe都被打包到资源包内，最理想的是将exe从包内解密到内存中直接执行。

[Lactoferrin]

很多程序会用CreateFile,ReadFile从其文件读取内容，这样的程序是不能从包内解密到内存中直接执行的

[Lactoferrin]

如果要测试一个程序是否需要读自己的exe文件，把exe放到ntfs文件系统，把文件的dacl改成只有一个Everyone的遍历文件夹/执行文件，然后运行exe,看是否出错