在win7 x64使用NtCreateThreadEx远程注入不成功

zemelaoshi 2015-05-05 10:26:08

在win7 x86下使用可以成功，但是在win7 x64使用却不成功，会报0xC0000005 Access Violation权限错误。下面是我的源码：

typedef struct

{

ULONG Size;

ULONG Unknown1;

ULONG Unknown2;

PULONG Unknown3;

ULONG Unknown4;

ULONG Unknown5;

ULONG Unknown6;

PULONG Unknown7;

ULONG Unknown8;

} NtCreateTheadExBuffer;

 

typedef DWORD WINAPI NtCreateThreadExProc(PHANDLE, ACCESS_MASK, LPVOID, HANDLE, LPTHREAD_START_ROUTINE, LPVOID, BOOL, DWORD, DWORD, DWORD, LPVOID);

 

HANDLE NtCreateThreadEx(HANDLE hProcess, LPVOID lpRemoteThreadStart, LPVOID lpRemoteCallback)

{

HANDLE hRemoteThread = NULL;

 

ULONG dw0 = 0, dw1 = 0;

NtCreateTheadExBuffer Buffer;

memset(&Buffer, 0, sizeof(NtCreateTheadExBuffer));

 

Buffer.Size = sizeof(NtCreateTheadExBuffer);

Buffer.Unknown1 = 0x10006;

Buffer.Unknown2 = 0x16;

Buffer.Unknown3 = &dw1;

Buffer.Unknown4 = 0;

Buffer.Unknown5 = 0x10008;

Buffer.Unknown6 = 8;

Buffer.Unknown7 = &dw0;

Buffer.Unknown8 = 0;

 

NtCreateThreadExProc *NtCreateThreadX =

(NtCreateThreadExProc*)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtCreateThreadEx");

 

if(NtCreateThreadX == NULL)

return NULL;

 

DWORD dw = 0;

if(!SUCCEEDED(dw = NtCreateThreadX(

&hRemoteThread, //THREAD_ALL_ACCESS, // STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,

0x1FFFFF, // All access

NULL,

hProcess,

(LPTHREAD_START_ROUTINE)lpRemoteThreadStart,

lpRemoteCallback,

FALSE,

NULL,

NULL,

NULL, //NULL

&Buffer

)))

{

//就在这里出错，会报权限错误

return NULL;

}

 

return hRemoteThread;

}