[求助]无dll的远程线程注入代码引发被注入程序的崩溃

2018-08-18 10:21:14 296 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

【外挂编程】外挂编程技术揭秘(三)DLL注入引言：一个礼拜没有更新这个主题文章了，这周三看到一个微信推送。某某某博士由于写外挂被抓。当时心里那是一个崩溃,不过之前写了这个主题，还是会继续写完，不能半途而废。不过了解这本技术的千万不要拿去捞偏门。我刚写这篇文章的时候在想这个主题要不要改一改。叫《我们一起写外挂吧，会被抓那种》，^ - ^，玩笑了。开始我们今天的内容吧，我们还是继续讲内存挂，不过我们今天的主题是讲注入。文中介绍的注入... 阅读详情

[求助]写了一段无dll的远程线程注入代码，可是为什么每次注入都会引发被注入程序的崩溃？一直没有找到原因，请大家帮个忙，谢谢！

#include <cstdio>

#include <cstdlib>

#include <iostream>

#include <string>

#include <string.h>

#include <windows.h>

#include <strsafe.h>

#include <tlhelp32.h>

 

#define MAX_LENGTH 30

#pragma warning(disable:4996)

 

using namespace std;

 

typedef struct _RemoteParam

{

    CHAR szOperation[10];

    CHAR szAddrerss[MAX_LENGTH];

    DWORD dwSeAdress;

}RemoteParam;

 

DWORD WINAPI ThreadProc(RemoteParam *lprp)

{

    typedef HINSTANCE(WINAPI *MShellExecute)(HWND hwnd, LPCSTR lpOperation, LPCSTR lpFile, LPCSTR lpParameters, LPCSTR lpDirectory, INT nShowCmd);

    MShellExecute MSE;

    MSE = (MShellExecute)lprp->dwSeAdress;

    MSE(NULL, lprp->szOperation, lprp->szAddrerss, NULL, NULL, SW_SHOWNORMAL);

    return 0;

}

 

DWORD GetProcessID(CHAR *ProcessName)

{

    PROCESSENTRY32 pe32;

    pe32.dwSize = sizeof(pe32);

    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (hProcessSnap == INVALID_HANDLE_VALUE)

    {

        printf("CreateToolhelp32Snapshot error");

        return 0;

    }

    BOOL bProcess = Process32First(hProcessSnap, &pe32);

    while (bProcess)

    {

        if (strcmp(strupr(pe32.szExeFile), strupr(ProcessName)) == 0)

            return pe32.th32ProcessID;

        bProcess = Process32Next(hProcessSnap, &pe32);

    }

    CloseHandle(hProcessSnap);

    return 0;

}

 

int EnableDebugPriv(const TCHAR *name)

{

    HANDLE hToken;

    TOKEN_PRIVILEGES tp;

    LUID luid;

    if (!OpenProcessToken(GetCurrentProcess(),

        TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,

        &hToken))

    {

        printf("OpenProcessToken error\n");

        return 1;

    }

    if (!LookupPrivilegeValue(NULL, name, &luid))

    {

        printf("LookupPrivilege error!\n");

        return 1;

    }

    tp.PrivilegeCount = 1;

    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    tp.Privileges[0].Luid = luid;

    if (!AdjustTokenPrivileges(hToken, 0, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL))

    {

        printf("AdjustTokenPrivileges error!\n");

        return 1;

    }

    return 0;

}

 

BOOL InjectProcess(const DWORD dwPid)

{

    if (EnableDebugPriv(SE_DEBUG_NAME)) return FALSE;

    HANDLE hWnd = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);

    if (!hWnd) return FALSE;

    RemoteParam rp;

    ZeroMemory(&rp, sizeof(RemoteParam));

    rp.dwSeAdress = (DWORD)GetProcAddress(LoadLibrary("Shell32.dll"), "ShellExecuteA");

    StringCchCopy(rp.szAddrerss, sizeof(rp.szAddrerss), "https://www.baidu.com");

    StringCchCopy(rp.szOperation, sizeof(rp.szOperation), "open");

    RemoteParam *pRemoteParam = (RemoteParam *)VirtualAllocEx(hWnd, 0, sizeof(RemoteParam), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    if (!pRemoteParam) return FALSE;

    if (!WriteProcessMemory(hWnd, pRemoteParam, &rp, sizeof(RemoteParam), 0)) return FALSE;

    LPVOID pRemoteThread = VirtualAllocEx(hWnd, 0, 1024 * 4, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    if (!pRemoteThread) return FALSE;

    if (!WriteProcessMemory(hWnd, pRemoteThread, &ThreadProc, 1024 * 4, 0)) return FALSE;

    HANDLE hThread = CreateRemoteThread(hWnd, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteThread, (LPVOID)pRemoteParam, 0, NULL);

    if (!hThread) return FALSE;

    return TRUE;

}

 

int WINAPI WinMain(_In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPSTR lpCmdLine, _In_ int nShowCmd)

{

    CHAR szProcName[MAX_LENGTH] = "\0";

    StringCchCopy(szProcName, MAX_LENGTH, "explorer.exe");

    InjectProcess(GetProcessID(szProcName));

    return 0;

}