DuplicateHandle 复制的线程句柄，为什么在主线程取不到GetExitCodeThread

2015-12-02 06:34:06 199 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

PowerShell进程注入完全指南：从Start-Hollow到Stage-RemoteDll实战解析进程注入是Windows安全领域的核心技术概念，它允许一个进程在另一个进程的地址空间中执行代码，其原理基于操作系统提供的进程间内存操作API。这项技术的核心价值在于实现代码的隐蔽执行和权限提升，在红蓝对抗、恶意软件分析和EDR绕过等应用场景中至关重要。通过调用VirtualAllocEx、WriteProcessMemory和CreateRemoteThread等关键API，攻击者能够实现内存写入和远程线程创建，而防御者则依赖这些行为特征进行检测。本文聚焦于PowerShell环境下的高级注入技术，系统讲解阅读详情



#include <windows.h>

#include <process.h>

#include <stdio.h>

#include <iostream>

using namespace std;



HANDLE g_Handle =NULL;

unsigned __stdcall thread_func(void* lpParam)

{



	BOOL ret = DuplicateHandle(GetCurrentProcess(),GetCurrentThread(),

		GetCurrentProcess(),&g_Handle,DUPLICATE_SAME_ACCESS,FALSE,0);



	if(!ret)

	{

		cout<<"DuplicateHandle Failed "<<GetLastError()<<endl;

	}

	

	Sleep(10000);

		

		

	return 9;

}







int main()

{

	HANDLE hThread = (HANDLE)_beginthreadex(NULL,0,thread_func,NULL,0,NULL);

	

	CloseHandle(hThread);

	int j = 10;

	while(j--)

	{

		if(g_Handle)

		{

			DWORD code;

			BOOL ret = GetExitCodeThread(g_Handle,&code);

			if(ret)

			{

				cout<<" ExitCode: "<<code<<endl;

			}

			else

			{

				cout<<"GetExitCodeThread return FALSE ErrorCode:"<<GetLastError()<<endl;

			}



		}

		else

		{

			cout<<"g_Handle Is NULL"<<endl;

		}

		Sleep(1000);

	}

	

	cout<<"press any key to continue..."<<endl;

	getchar();



}