快哭啦~ CreateRemoteThread x64位的远程线程老是把目标进程给干掉啦

2015-03-21 10:21:44 442 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

Shellcode免杀实战：对抗360、火绒与Defender的三重防御体系在网络安全领域，恶意软件检测与防御是攻防对抗的核心。杀毒软件通过静态特征扫描、动态行为监控和内存扫描等多层机制识别威胁。静态扫描匹配已知特征码，动态监控分析进程的敏感API调用序列，内存扫描则检测进程空间中的恶意代码片段。这些技术旨在阻止未经授权的代码执行，保护系统安全。理解这些原理对于安全研究、渗透测试和产品能力验证至关重要。本文聚焦于Shellcode免杀技术，探讨如何通过加密混淆、API调用链伪装、直接系统调用（Syscall）和进程注入等工程实践，绕过主流安全软件的检测。其中，直接系统调用（Sysc 阅读详情

我想用远程线程注入的方式目标进程中注入CloseHandle（）函数，win32正常执行，x64位目标进程的exe会异常退出，怎么办？

DWORD CloseRemoteHandle( LPCTSTR lpProcessName, DWORD processID, HANDLE handle )
{
DWORD dwThreadSize = 0x1000;
RemoteParam remoteData;
ZeroMemory(&remoteData, sizeof(RemoteParam));
HINSTANCE kernel32 = LoadLibrary(L"Kernel32.dll");
remoteData.pCloseHandle = (DWORD)GetProcAddress(kernel32, "CloseHandle");
remoteData.handle = handle;
HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, processID );

void* pRemoteThread = VirtualAllocEx(hProcess, 0, dwThreadSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hProcess, pRemoteThread, &threadProc, dwThreadSize, 0);

RemoteParam* pRemoteParam = (RemoteParam*)VirtualAllocEx( hProcess , 0, sizeof(RemoteParam), MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess, pRemoteParam, &remoteData, sizeof(remoteData), 0);

HANDLE hRemoteThread = CreateRemoteThread(
hProcess,
NULL,
0,
(DWORD (__stdcall *)(void *))pRemoteThread,
pRemoteParam,
0,
0);
::WaitForSingleObject(hRemoteThread, INFINITE);
CloseHandle(hRemoteThread);
return TRUE;
}

...全文